Australia’s Privacy Act Reforms on Automated Decisions

Australia’s Privacy and Other Legislation Amendment Act 2024, No. 128, is in force and introduced a delayed automated-decision transparency obligation into Australian Privacy Principle 1. The new APP 1.7–1.9 provisions commence on December 10, 2026. They apply to an APP entity that arranges for a computer program to make a decision, or perform something substantially and directly related to making it, where personal information is used in the program’s operation and the decision could reasonably be expected to significantly affect an individual’s rights or interests. The obligation concerns decisions from the commencement date, even where the system arrangement or data use began earlier. Under APP 1.8, the APP privacy policy must describe the kinds of personal information used in operating relevant computer programs, the kinds of decisions made solely by the programs, and kinds of decisions for which the program performs a substantially and directly related step. APP 1.9 clarifies that making a decision includes refusing or failing to make one and does not depend on whether the result benefits or harms the person. Examples include benefits, life-insurance contracts and access to significant healthcare services. The law does not create a universal right to an explanation of each individual output, human reconsideration, source code or an opt-out. It is a policy transparency requirement. The OAIC is preparing guidance. Its 2026 issues paper and consultation explain the agency’s interpretation work, but those materials do not alter the statute. Organisations should distinguish the enacted Act and commencement date from current consultation and draft guidance. The obligation sits within the Privacy Act’s existing coverage and exemptions; it is not a comprehensive AI law and does not apply to every automated process regardless of personal data, entity status or impact.