Privacy and Other Legislation Amendment Act 2024 (128 of 2024)

Schedule 1   Privacy reforms

Part 15   Automated decisions and privacy policies

Privacy Act 1988

88   At the end of clause 1 of Schedule 1

Add:

Automated decisions

1.7 Without limiting subclause 1.3, the APP privacy policy of an APP entity must contain the information covered by subclause 1.8 if:

(a) the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; and

(b) the decision could reasonably be expected to significantly affect the rights or interests of an individual; and

(c) personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.

1.8 The information covered by this subclause is:

(a) the kinds of personal information used in the operation of such computer programs; and

(b) the kinds of such decisions made solely by the operation of such computer programs; and

(c) the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs.

1.9 For the purposes of subclauses 1.7 and 1.8:

(a) making a decision includes refusing or failing to make a decision; and

(b) doing a thing includes refusing or failing to do a thing; and

(c) a decision may affect the rights or interests of an individual, whether the rights or interests of the individual are adversely or beneficially affected; and

(d) the following are examples of the kinds of decisions that may affect the rights or interests of an individual:

(i) a decision made under a provision of an Act or a legislative instrument to grant, or to refuse to grant, a benefit to the individual;

(ii) a decision that affects the individual's rights under a contract, agreement or arrangement;

(iii) a decision that affects the individual's access to a significant service or support.