When the machine decides: Is your privacy policy compliant with new automated decision-making transparency requirements?

Does this apply to your business?

The new requirements apply to ‘APP entities’ under the Privacy Act. Broadly, these are Australian Government agencies and private sector organisations with an annual turnover of more than $3 million, as well as some smaller businesses dealing with personal information, such as health service providers. For simplicity, we refer to ‘APP entities’ as ‘businesses’ in this Insights article.

A business must disclose the use of ADM in its privacy policy where all three of the following apply:

The OAIC guidance indicates how the OAIC intends to interpret some of the key concepts in the new ADM transparency requirements.

The OAIC guidance makes it clear that ‘computer program’ is intended to be applied broadly. It covers simple rule-based processes, artificial intelligence and machine-learning tools, and everyday software, apps and algorithms, including generative AI and AI chatbots. Further, a formula in a spreadsheet that automatically ranks clients for health and aged care services is considered by the OAIC to be a computer program.

A ‘decision’ is also understood by the OAIC to be interpreted broadly. It includes:

• choosing to take, or not to take, an action;
• doing something, or failing or refusing to do something; and
• an outcome that could reasonably be expected to benefit or disadvantage the individual.

The OAIC guidance also suggests that a computer program is doing something ‘substantially and directly related’ to a decision if the computer program is a key factor in the decision and the decision has a direct connection to it. Relevant factors outlined in the OAIC guidance include:

• the degree of reliance on the output of a computer program, with greater reliance likely resulting in a higher likelihood of the computer program being determinative rather than advisory;
• the ability and the likelihood of a human overriding the output of a computer program;
• the nature of the output (that is, advisory vs determinative);
• the transparency and explainability of outputs available to the decision-maker (that is, what the computer program did and why); and
• the complexity of the computer program and its integration into the decision-making workflow.

Critically, this means the requirement covers not only fully automated decisions, but also decisions made by people who rely substantially on a program’s output. That is, having a person review the output (that is, having a ‘human-in-the-loop’) does not, on its own, take a decision outside the transparency requirement. Where a human decision-maker relies on, or is otherwise significantly influenced by, the output of a computer program, the computer program is likely to be considered to be doing something ‘substantially and directly related’ to a decision.

If you are unsure whether your business’ use of a computer program falls within the scope of the transparency obligation, we suggest that businesses should follow the recommendation of the OAIC that businesses take a cautious approach and include the required information in your business’ privacy policy.

 What must be disclosed?

If the requirements apply, your business’ privacy policy must describe:

• the kinds of personal information used by those computer programs;
• the kinds of decisions made solely by those computer programs; and
• the kinds of decisions where the computer program does something ‘substantially and directly’ related to making the decision.

There is no clear specification of how much technical detail to include. It will depend on your business’ activities and circumstances. In its guidance, the OAIC has expressed the view that it expects businesses to:

• ensure individuals can understand how their personal information is handled;
• avoid including unnecessary amounts of granular technical information that would overwhelm the reader;
• make it easy for individuals to request further information;
• tailor information so it is relevant and specific to the business’ activities and circumstances; and
• frame information in a way that allows the information and the decision to be reviewed.

 In making disclosure, businesses can group similar decisions and types of personal information together, provided the description remains meaningful to a reasonable person. If a program relies on more sensitive information, such as health information or biometric templates (for example, face scans), this should be made clear.

 Exception for commercial-in-confidence information

Businesses do not need to disclose commercial-in-confidence information about their computer programs, such as commercially sensitive information or trade secrets. However, the exception is narrow. It covers information whose release could harm the business’ commercial interests, not simply information that has commercial value. It also does not cover information that would merely expose the business to ridicule, embarrassment or public criticism. For example, the OAIC guidance suggests a lender could keep confidential how its in-house tool weights data to detect fraud, but it must still disclose that it uses personal information for fraud detection.

 What should your business do now?

We suggest that you use the above three ‘ask yourself’ questions as a starting point. If your answer is, or may be, ‘yes’ to all of those above questions, your current privacy policy will likely need to be updated to meet the new ADM transparency requirements before 10 December 2026.

Piper Alderman’s Privacy & Data Protection and Cyber Security experts can help you assess the applicability of the ADM transparency requirements, and review and update your privacy policy.

Key Takeaways

• Privacy policies must disclose how personal information is used in automated decisions that could significantly affect the rights or interests of individuals.
• ‘Computer program’ is read broadly. It includes rule-based processes, AI and machine-learning tools, and everyday software, apps and algorithms.
• ‘Human-in-the-loop’ review does not, on its own, remove the requirement to disclose automated decision-making.
• Businesses have some flexibility in determining how much technical detail to disclose, but are expected to make clear the types of personal information used as part of ADM in their businesses.