AI Regulation ReferenceDoes Privacy Act 1988 — Automated Decision-Making Reforms require Data Governance?
Australia • enacted
Yes — 1 provision
Requirements at a glance
This regulation imposes 5 specific requirements for Data Governance across 1 provision:
- Data minimisation — Each AI data input must be reasonably necessary for the specific purpose
- No speculative collection — Cannot collect broad datasets for potential future AI use
- Primary purpose limitation — AI systems may only use personal data for primary collection purposes
- Enhanced consent — Specific, informed, voluntary, current consent required for AI training and profiling
- Vendor due diligence — Must assess third-party AI vendors for data handling practices
Data Minimisation for AI Systems #
The reformed Privacy Act explicitly prohibits collecting broad datasets "in case they might be useful" for AI training. Each data input to an AI system must be demonstrably necessary for the specific purpose. This directly impacts how organizations build training datasets and deploy AI models using personal information.
Requirements
| Requirement | Details |
|---|---|
| Data minimisation | Each AI data input must be reasonably necessary for the specific purpose |
| No speculative collection | Cannot collect broad datasets for potential future AI use |
| Primary purpose limitation | AI systems may only use personal data for primary collection purposes |
| Enhanced consent | Specific, informed, voluntary, current consent required for AI training and profiling |
| Vendor due diligence | Must assess third-party AI vendors for data handling practices |
Penalties
| Violation | Fine |
|---|---|
| Serious breach | Significant civil penalties per Privacy Act enforcement provisions |