AustraliaPrivacy and Other Legislation Amendment Act 2024 (Cth), Automated Decision-Making Transparency
Privacy and Other Legislation Amendment Act 2024 (Cth) No. 128, 2024, Schedule 1, Part 15, inserting Australian Privacy Principles 1.7 to 1.9 into Schedule 1 to the Privacy Act 1988
A data subject rights rule binding public and private bodies.
- Private right of action
- No
- Enforcement body
- Office of the Australian Information Commissioner (OAIC)
- Audit expectation
- none
What it requires
- This measure is enacted but does not bind anyone until ; what follows is what it will require from that date.
- Disclose in the entity's APP privacy policy the kinds of personal information used, and the categories of decisions made, by a computer program that could reasonably be expected to significantly affect an individual's rights or interests.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Australian Privacy Principles 1.7 to 1.9 require the APP privacy policy to describe the kinds of personal information used by a decision-making computer program and the kinds of decisions made. That is a disclosure in a published policy; the clauses require no log or record of individual decisions.
- Kind
- None
- As of
What this law does
Inserts a new Australian Privacy Principle 1.7 to 1.9 requiring an APP entity's privacy policy to disclose, for computer programs the entity uses to make decisions that could reasonably be expected to significantly affect an individual's rights or interests, the kinds of personal information used in that decision-making and the categories of decisions made.
Received Royal Assent on , and the commencement table fixes the day for this Schedule at 24 months after Assent, so the disclosure duty takes effect on .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .