The Privacy Act and AI: the regulatory baseline
The Privacy Act 1988 applies to Australian Government agencies and private sector organisations with annual turnover above $3 million. The 13 APPs govern every stage of how personal information is collected, stored, used, and disclosed — and apply fully to AI systems. APP 3 limits collection to information reasonably necessary for the organisation's functions. APP 5 requires notification at or before the time of collection (or as soon as practicable after, where prior notification is not practicable). APP 6 prevents using personal information collected for one purpose in AI systems for another purpose without consent. APP 11 requires reasonable security safeguards including for AI systems. APP 12 gives individuals access rights to personal information including data used in AI-assisted decisions.
Sensitive information and enforcement
Biometric data is sensitive information under the Privacy Act, attracting higher obligations including consent requirements. The OAIC enforces the Privacy Act and can seek civil penalties. The 2023 Clearview AI appeal upheld established extraterritorial jurisdiction over overseas companies collecting data about Australians. 2024 reforms strengthened enforcement powers, with further proposed reforms including a statutory tort for serious privacy invasions.
