From 10 December 2026, the new Australian Privacy Principle (APP) 1.7 in the Privacy Act 1988 (Cth) will require entities to disclose the use of automated (or substantially automated) decision-making (ADM) in their privacy policies.
Disclosure is required where computer programs are used to make decisions, or do things substantially and directly related to making decisions, that could reasonably be expected to significantly affect an individual’s rights or interests, and where personal information is used in the operation of the computer program.
If the test above is met, APP 1.8 requires the following information to be disclosed:
- the kinds of personal information used in relation to the program; and
- the kinds of such decisions made solely by the program; and
- the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the program.
On 30 September 2026, the Office of the Australian Information Commissioner (OAIC) published guidance on the forthcoming ADM transparency obligations. Key takeaways from the guidance include the following:
- A human decision-maker’s degree of reliance on the computer program’s outputs is relevant. A decision may still fall within APP 1.7 where a program provides recommendations or rankings that are a key factor in the ultimate outcome, even if a human ultimately reviews or approves the decision. Extensive human oversight makes the decision less likely to be captured, and the transparency and explainability of outputs available to the decision-maker are also relevant considerations. Conversely, where the program’s recommendations are rarely overturned or overridden, the decision is more likely to be in scope. Simply having a “human in the loop” does not automatically exclude a decision from APP 1.7.
- An output does not need to be the “final” decision. “Substantially” means where the computer program is a key factor in facilitating the human’s decision making. For example, if a decision would have been made differently, or may not have been made at all, without use of the computer program. An output will be “directly related” to a decision if it has a clear nexus to the decision. Anterior steps in the decision-making process may therefore fall within scope of APP 1.7 if they are “substantially and directly related” to the final decision. Entities should look at decision-making processes holistically, and consider the extent to which the outputs of a computer program meaningfully influence its decisions.
- Whether a decision significantly affects an individual’s rights or interests should be assessed objectively. The OAIC provides a non-exhaustive list of potentially significant rights and interests, including access to employment, housing, education, health services, insurance, credit, government benefits and “significant goods or services“, such as baby formula, gluten-free foods, pharmacy items and medications. The examples suggest that significance should be assessed with reference to the decision’s objective impact on affected individuals and, in the case of significant goods and services, necessity. However, an individual’s circumstances, including any vulnerability they may be experiencing, should also be considered when assessing whether a decision disproportionately affects them over others.
- Commercial-in-confidence information remains protected. Trade secrets and commercially sensitive information do not need to be disclosed under APP 1.7 if doing so could harm the entity’s commercial interests (for example, by removing an opportunity for revenue or reducing competitive advantage in the market). However, information is not exempt from disclosure simply because it has some commercial value, nor where it could cause ridicule, criticism or embarrassment.
- The level of detail disclosed must be meaningful to a reasonable person. The OAIC does not expect granular technical explanations of how the computer programs work that would overwhelm consumers. It is appropriate to aggregate the categories of decisions and types of information in the policy whilst still complying with the transparency obligation, provided that a reasonable person can understand how their personal information is being handled in the process.
- Information may be needed from suppliers. APP 1.7(a) requires disclosure of ADM that an entity “arranges for” (even if the entity does not use the computer program in question itself). The OAIC recommends that, in order to assist customers with the disclosure requirement, vendors of relevant third-party software or enterprise solutions provide clear, high-level information about how their software can be used to make decisions. However as this is guidance only (and not a firm legal obligation) it remains to be seen if vendors will comply.
Examples of ADM use cases where the OAIC considers that disclosure may be required include:
- use of facial recognition technology in a retail store or stadium for watchlist matching;
- recruitment software used to sort through candidate profiles and make hiring decisions;
- differential and/or personalised pricing practices used by online retailers in the sale of significant goods;
- computer programs used to approve or reject a loan or credit application;
- targeted advertising relating to the decision to sell significant goods or services; and
- reports created by AI used to rank employee performance and determine promotions, or decide bonus/remuneration outcomes.
Importantly, the OAIC has emphasised that the disclosure obligations are not onerous. If in doubt, entities should err on the side of transparency and adopt an inclusive approach when updating their privacy policies. The assessment underpinning the decision to disclose (or not) is the key exercise that the OAIC wants businesses to undertake.
Rather than treating particular technologies, decisions or activities as automatically within or outside scope, businesses operating in Australia should use the OAIC’s guidance to identify where ADM is being used in their operations, and determine whether each use case meets the threshold for disclosure. The way that businesses use software, tools and other computer programs can also change over time, and so any decisions on the applicability of APPs 1.7 – 1.9 should be reviewed on a regular basis.
Recent Comments