#
Meaningful ADM transparency reform is enacted but not yet in force, and biometric governance currently relies on case-by-case enforcement rather than a dedicated statute.
Sub-modules (6)
Profiling RestrictionsRed
No direct analogue to Art 22 profiling restrictions identified; searched OAIC ADM consultation materials and APP guidelines.
Absence provenance: unavailable. Searched: OAIC ADM Transparency consultation page, OAIC APP 1 guidelines chapter.
Automated Decision Making TransparencyAmber
New APP 1.7–1.9 ADM transparency duty enacted, commencing 10 December 2026.
Claims (1):
- From 10 December 2026, APP entities that arrange for a computer program to use personal information to make decisions reasonably expected to significantly affect an individual's rights or interests must include specified information about the kinds of personal information used and decisions made in their APP Privacy Policies (APP 1.7–1.9).
Ai Risk AssessmentsAmber
No standalone AI-risk-assessment mandate; OAIC preparing ADM guidance ahead of December 2026 commencement.
Claims (1):
- The OAIC intends to release guidance on the ADM Transparency Obligation by September 2026, ahead of the 10 December 2026 commencement date, following a consultation that closed 15 June 2026; Australia does not yet impose a standalone AI-specific risk-assessment mandate akin to the EU AI Act.
Biometric RegimeAmber
Facial recognition addressed via landmark OAIC determinations (Bunnings, Kmart) rather than a dedicated biometric statute.
Claims (1):
- The OAIC has issued landmark determinations addressing facial recognition technology use by retailers, including the Bunnings and Kmart decisions, updating the application of the Privacy Act to biometric technologies.
Genetic DataRed
No genetic-data-specific regime identified in this research pass.
Absence provenance: unavailable. Searched: OAIC APP guidelines special categories, OAIC Privacy Act review submissions.
State Surveillance CarveoutsAmber
APP 8.2 enforcement-body exception permits cross-border disclosure without standard reasonable-steps obligation.
Claims (1):
- APP 8.2 provides an exception permitting cross-border disclosure without the standard reasonable-steps requirement where an agency reasonably believes disclosure is necessary for enforcement-related activities and the overseas recipient performs functions similar to an Australian enforcement body.
Key findings (3)
- — source on file
- — source on file
- — source on file
Algorithmic, Biometric & Surveillance Governance
Two distinct developments define this module's current posture: a forward-looking disclosure duty approaching its commencement date, and an active enforcement investigation already underway. New APP 1.7-1.9, commencing 10 December 2026, will require many organisations to disclose in their privacy policy when a computer system, including AI, is used in a decision that significantly affects an individual. This is a transparency obligation rather than a substantive restriction on automated decision-making itself.
Separately, and already active, the OAIC opened an investigation on 7 October 2026 into the maker of the 'HeyCyan' smart-glasses phone application. This sits within a broader pattern of increasing OAIC scrutiny of smart glasses and other connected or surveillance-capable devices. The Commissioner has stated that entities can be liable as accessories for enabling such devices, a theory of liability that would extend OAIC enforcement reach beyond the device manufacturer itself to other entities facilitating the device's surveillance-capable functionality.
Taken together, the ADM disclosure duty and the active HeyCyan investigation indicate the OAIC is pursuing both a prospective transparency framework and present-tense enforcement against surveillance-capable technology simultaneously, rather than waiting for the Tranche 1 obligations to commence before acting on device-related privacy risk.
Outlook
The HeyCyan investigation's outcome will be an early test of the OAIC's accessory-liability theory for connected and surveillance-capable devices. Separately, 10 December 2026 will bring the ADM disclosure duty into force, requiring covered organisations to update privacy-policy disclosures for AI-driven significant decisions.
1 earlier distinct update(s)
Algorithmic, Biometric & Surveillance Governance
From 10 December 2026, APP entities that use automated decision-making significantly affecting individuals must disclose in their privacy policy which decision types are made by automated means and what personal information is used in making them. This obligation is enacted under the Privacy and Other Legislation Amendment Act 2024 but has not yet taken legal effect; it commences on the stated date. The OAIC has already moved to operationalise the coming duty at the guidance level, issuing Australian Privacy Principles Guidelines Chapter 1 version 2.0, effective 29 September 2026, which requires privacy policies to address computer-program and automated-decision usage ahead of the statutory obligation's commencement. Together these two instruments, one a guidance document and one a commenced-but-not-yet-effective Act provision, form the current shape of Australia's algorithmic-transparency regime: a disclosure duty tied specifically to privacy-policy content, applying where automated decision-making significantly affects an individual, rather than a broader algorithmic-accountability or audit regime.
Outlook
The obligation's legal effective date of 10 December 2026 is the determinative marker. Entities relying on automated decision-making that significantly affects individuals have until that date to align privacy-policy disclosures with both the statutory requirement and the OAIC's Chapter 1 v2.0 guidance; no further legislative change to this specific obligation was identified this cycle.
Sources and claims (4)
- ProbableOffice of the Australian Information Commissioner — From 10 December 2026, APP entities that arrange for a computer program to use personal information to make decisions reasonably expected to significantly affect an individual's rights or interests must include specified information about the kinds of personal information used and decisions made in their APP Privacy Policies (APP 1.7–1.9).observed
- ProbableOffice of the Australian Information Commissioner — The OAIC intends to release guidance on the ADM Transparency Obligation by September 2026, ahead of the 10 December 2026 commencement date, following a consultation that closed 15 June 2026; Australia does not yet impose a standalone AI-specific risk-assessment mandate akin to the EU AI Act.observed
- ProbableOffice of the Australian Information Commissioner — The OAIC has issued landmark determinations addressing facial recognition technology use by retailers, including the Bunnings and Kmart decisions, updating the application of the Privacy Act to biometric technologies.observed
- ProbableOffice of the Australian Information Commissioner — APP 8.2 provides an exception permitting cross-border disclosure without the standard reasonable-steps requirement where an agency reasonably believes disclosure is necessary for enforcement-related activities and the overseas recipient performs functions similar to an Australian enforcement body.observed