Australia's privacy watchdog has found that only four of 23 government agencies authorized to use automated decision-making actually disclosed that use as required under the 1982 Freedom of Information Act. Information Commissioner Elizabeth Tydd delivered the finding Tuesday in a speech to the Australian Law Librarians' Association Conference, warning that AI adoption must not come at the cost of transparency or human-centered decision-making.
Starting December 10, organizations covered by the 1988 Privacy Act will need to disclose in their privacy policies what personal information they use in automated decision-making systems and what types of decisions those systems make or substantially influence. The requirement gives the public a legal right to know when a government algorithm is helping decide their fate.
What the compliance gap means
Tydd's remarks suggest the gap between policy and practice is wide. Of 23 agencies legally permitted to use automated decision-making, only four told the public they were doing so. That means most agencies appear to be operating these systems without the transparency the law demands.
"Organizations must maintain transparency, accountability and strong information governance as they increasingly adopt artificial intelligence and automated decision-making," Tydd said.
The commissioner's comments come as governments worldwide deploy AI tools for tasks ranging from benefits eligibility to immigration screening. Australia's disclosure requirements are designed to ensure citizens can find out when an algorithm is involved in decisions that affect them, and what data feeds those decisions.
What the December deadline changes
The upcoming Privacy Act amendments will force broader disclosure than the Freedom of Information Act currently requires. While the FOI Act covers specific agency records, the new privacy policy requirements apply to all entities under the Privacy Act and explicitly cover AI-assisted decisions.
For government employees, the practical effect is that privacy policies will need to be rewritten to describe automated systems in plain language. That includes naming the types of personal information used and specifying which decisions are made or substantially influenced by algorithms.
Government teams working on AI projects should treat this as a compliance deadline, not a paperwork exercise. The disclosure requirement creates a public record of where automated systems are being used, which means agencies will need to explain their AI tools in terms citizens can actually understand.
For those looking to get ahead of these requirements, resources on AI for Government can help teams understand what responsible deployment looks like. The AI Learning Path for Policy Makers covers the governance questions these new rules raise.
Why this matters for government professionals
If you work in an agency that uses or plans to use automated decision-making, December 10 is your deadline to audit those systems and document them in your privacy policy. The watchdog's finding that only four of 23 agencies complied with existing disclosure rules signals that enforcement attention will likely follow. Start by inventorying which decisions in your agency involve algorithms, what personal information they use, and whether your privacy policy accurately describes them. The cost of getting this wrong is not just a compliance finding - it's public trust in the systems your agency runs.
Your membership also unlocks:
