• Carry out an ADM assessment

  The primary obligation is to update the APP entity’s privacy policy to include the information required in new APPs 1.7 to 1.9. 

  While updating the privacy policy may seem simple, doing so will involve identifying where, and the extent to which, the organisation uses ADM, including assessing in each case whether:

  • a computer program makes a decision, or performs an act or function that is substantially and directly related to making a decision;
  • the decision significantly affects the rights or interests of an individual; and
  • the computer program uses the personal information of the individual to make the decision.

  This is likely to be a detailed process for most complex organisations. Determining the boundaries of whether a computer program is used to make, or is substantially and directly related to making, a decision and what decisions ‘significantly’ affect an individual’s rights or interests will likely involve many judgement calls and a careful consideration of OAIC’s guidance once it is released. 

  Many organisations that provide important services to customers such as utilities, financial institutions, education providers and so forth are likely to have some form of ADM ‘baked in’ to various lengthy processes that may ultimately impact individuals. 

  Determining the extent to which ADM is involved in making the final decision, and how it impacts the rights or interests of individuals, will be important. It is also not yet clear to what extent keeping a human in the loop will mean that a computer program has not been involved in making the decision.

  Updating the privacy policy will also necessitate an assessment of third-party arrangements and the extent to which third-party providers adopt ADM in the services they provide to an organisation. Organisations should leave sufficient time to liaise with service providers to ensure that the information they publish in their privacy policies is accurate.

• Update the privacy policy

  Once APP entities have assessed and identified the ADM that needs to be disclosed in the privacy policy, they should update the privacy policy to address the requirements of APP 1.7 to 1.9.  

• Review the AI governance framework

  APP entities should also consider whether their broader AI governance framework captures the process to be followed with respect to new AI tools that involve ADM and the use of personal information, so that any required updates to the organisation’s privacy policy are identified and made going forward.

• Assess controls

  While it is not explicitly required by the new provisions, APP entities should consider the controls they have in place around ADM and be prepared to respond to queries or complaints raised by individuals or regulators in response to any of the new information they publish in their privacy policies.

APP entities should also keep a close eye on emerging OAIC guidance, particularly on the boundaries of what is “substantially and directly related” to making a decision, what it means for a decision to “significantly affect” an individual’s rights or interests, and how these concepts apply where third-party tools or human oversight are involved.

Going forward, it will be important for APP entities that plan to adopt a new ADM program using personal information to conduct a detailed Privacy Impact Assessment (PIA).