Broker guide
Automated Decision Making Under the Privacy Act
Privacy policies must soon explain automated decision making. See what the Privacy Act counts, who it covers and what brokers must disclose.
- Published
- Updated
Automated decision making uses a computer program to make a decision or materially help a person make one. The Privacy Act adds privacy-policy disclosures for covered decisions that use personal information and could significantly affect someone’s rights or interests.
For a brokerage, the question is how software influences decisions about people. A general statement that your business uses AI doesn’t describe that relationship.
What Automated Decision Making Means
Automated decision making includes decisions made entirely by software and decisions a person makes with substantial, direct computer assistance. The program can use fixed rules or AI. The legal test concerns its role in the decision, rather than its product label.
For example, software might produce a score that determines whether an enquiry reaches a broker. Another program might simply record the broker’s independently reached decision. Those functions need different assessments.
The transparency threshold also depends on the effect on the individual. A decision must be capable of significantly affecting their rights or interests in the way the legislation describes. A beneficial effect can count, as can refusing or failing to make a decision.
An Australian Privacy Principle (APP) entity is an agency or organisation covered by the principles. The Privacy Act determines that coverage. Being a small brokerage doesn’t, by itself, establish your position.
The New Privacy Act Rules
The Privacy and Other Legislation Amendment Act 2024 adds automated-decision transparency requirements to APP 1. These are enacted amendments, with their own commencement arrangements. The Act’s commencement table and Part 15 set the exact start and application rules.
APP 1.7 requires the extra privacy-policy information when all of these conditions apply:
- The entity has arranged for a computer program to make a decision, or perform something substantially and directly related to making it.
- The decision could reasonably be expected to significantly affect an individual’s rights or interests.
- The program uses personal information about that individual in doing so.
APP 1.8 then requires the policy to describe the kinds of personal information used. It must also identify decisions made solely by computer programs and decisions that programs substantially and directly help make.
The application provision covers decisions after commencement even where the software arrangement or information collection predates it. An existing subscription doesn’t, by itself, remove the disclosure duty.
Updating a policy also doesn’t establish that the underlying collection or use of personal information is lawful. Other Privacy Act obligations continue to apply.
Does It Apply to a Brokerage?
A brokerage’s position depends on its APP-entity status and the actual decision process. Software names alone can’t establish whether the statutory conditions apply.
The examples below are hypothetical assessment prompts. They identify what to examine without deciding whether a particular brokerage or product meets the legal threshold.
| Broker Workflow | What the Program Does | What to Assess |
|---|---|---|
| Lead scoring | Ranks enquiries using personal information. | Does the ranking only organise callbacks, or substantially influence who receives assistance? Assess the consequences for the person. |
| Serviceability tool | Estimates how much a person can borrow from financial inputs. | How does the result influence your decision to assist or progress a scenario? Identify the human assessment that follows. |
| AI document triage | Classifies uploaded evidence and flags gaps or concerns. | Does the output organise documents, or materially guide a decision about the client? Examine how staff rely on its flags. |
| Administrative recording | Stores a decision that the broker has already made independently. | Separate recording the outcome from software that helps determine the outcome. Check the actual workflow. |
The OAIC’s transparency flowchart separates personal-information use from the decision’s effect and the program’s involvement. Apply those questions to each process, including outsourced software.
Keep a record of what staff actually do with the output. An override button shows that an override is possible. It doesn’t establish whether staff exercise their own judgement or routinely follow the score.
What the OAIC Says
The Office of the Australian Information Commissioner (OAIC) explains automated decisions in version 2.0 of its APP 1 guidelines. Its announcement of the transparency resources identifies their release and the duty’s commencement.
The guidance says a human reviewing the output doesn’t automatically put a decision outside the obligation. Assess how much the person relies on the program and how directly its output contributes to the decision.
The OAIC also interprets computer programs broadly. Fixed-rule software can qualify alongside machine learning. Buying a third-party system doesn’t automatically transfer your disclosure responsibility to its supplier.
The effect on an individual depends on their circumstances. The OAIC includes access to essential banking and credit services among interests that can be affected. It also asks entities to consider whether a decision has a greater impact on someone experiencing vulnerability.
Privacy policies need meaningful, accessible descriptions of the relevant information and decisions. Explain those categories in language clients can understand. A technical description of a model alone won’t tell a client which decisions it helps make.
Update Your Privacy Policy
Where APP 1.7 applies, add a description of the information and decision categories required by APP 1.8. The law doesn’t prescribe one universal sentence for every brokerage.
Use the privacy policy template alongside your documented assessment of actual software use. The OAIC’s transparency fact sheet explains how to make the disclosure specific without overwhelming clients.
Your automated-decisions section needs to address these three statutory categories:
- Describe the kinds of personal information the relevant programs use. Name the categories that actually apply, such as employment details and financial circumstances.
- Describe the kinds of covered decisions made solely by programs. Distinguish these from recommendations that a broker considers.
- Describe the kinds of covered decisions for which programs perform a substantial, direct part of the decision process. Explain the program’s role clearly.
A hypothetical clause for a brokerage using software to help assess enquiries could read:
We use computer programs to analyse enquiry details and financial information when assessing requests for broking assistance. These programs produce recommendations that our brokers consider when deciding how to progress an enquiry.
That example covers one assisted-decision process. It doesn’t describe solely automated decisions, so it can’t replace the required account of those decisions where they occur. Use only statements that match your assessed workflow.
Before publishing, compare the proposed wording with the information the program uses and the decisions staff make. Ask the software provider for a clear description where needed. Have your privacy adviser resolve uncertain legal classifications and ensure the policy describes every covered decision category.
