Changes to the Privacy Act impacting financial advice firms

New rules will be in place from 10 December under the Privacy and Other Legislation Amendment Act 2024, with transparency obligations that mean businesses must state clearly in their privacy policies when AI makes or informs decisions that significantly affect individual clients’ rights and interests.

These rules apply to Australian Privacy Principles (APP) entities, including sole traders, bodies corporate, partnerships and trusts with an annual turnover of more than $3 million. However, Australian financial services licence holders that arrange designated services are Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) reporting entities and therefore the Privacy Act applies to them regardless of turnover.

APP 1.7 to 1.9 require entities to “include additional information relating to automated decisions in an entity’s privacy policy”, the Office of the Australian Information Commissioner (OAIC) states on its website.

“This extends to circumstances where computer programs do not replace the entire decision-making process or are subject to human review,” an OAIC spokesperson tells Professional Planner.

If an organisation “has arranged a computer program” to make something that “substantially and directly” relates to making a decision that could affect the rights or interests of a person, and information about this person is used to make such a decision, organisations must outline in their privacy policy the kinds of information used, the decisions made solely by these software and the types of decisions that would be made by such software.

“The OAIC reads the term ‘computer program’ broadly to include rule-based tools, machine learning, generative AI, and chatbots, while ‘arranged for’ captures vendor software you licence, not just tools you built,” Tony Vizza, managing partner at digital risk management provider Novera, tells Professional Planner.

“The OAIC’s own examples of significant decisions include loans, credit and insurance eligibility, so financial outcomes are squarely the kind of thing it has in mind.

“For an advice practice, I would consider tools including but not limited to risk-profiling engines, automated portfolio or product-selection tools, digital advice platforms, automated onboarding or client-acceptance checks within scope, as well as any AI that generates recommendations from client data.”

Licensees and advice firms may question whether a recommendation is a decision that significantly affects a client, if the client is ultimately the one making the decision.

“Practitioners will read that both ways. The OAIC’s answer is that where you are unsure, take the cautious approach and include the disclosure. Given the cost of disclosure is low, that is the position I’d expect most licensees to land on, but firms should take their own advice on their own tools,” Vizza says.

“One more point: telling a client in the SOA or engagement letter that AI was used does not satisfy APP 1.7. The Act requires it to be in the APP privacy policy.”

The OAIC spokesperson says that transparency can help to stop bias and discrimination where it may be present in automated decision-making.

“The OAIC maintains that consumers deserve to know when computer programs are used to make significant decisions instead of a human.

“The OAIC’s Australian Community Attitudes to Privacy Survey 2026 (ACAPS) showed that Australians are increasingly cautious about the use of AI in decision-making that may affect them, with 91 per cent of those surveyed supporting the right to be informed when their personal information is used in automated decision-making.”

How firms should prepare and potential consequences

The change comes into effect in just over a month, ideally firms should inventory every tool that has access to client information.

“This should include planning software, CRM add-ons, risk-profiling tools, digital advice engines, and LLM assistants (including vendor products),” Vizza says.

He advises firms ask technology vendors for a plain-English description of what their tool decides or recommends.

“Then map which tools feed significant decisions and how much your advisers rely on them, and document that oversight. Then I suggest drafting the three disclosures APP 1.8 requires, grouped sensibly,” he says.

APP 1.8 refers to the kinds of personal information used, the kinds of such decisions made and the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by a computer program.

“The amendments allow you to withhold genuinely commercial-in-confidence details, but not the kinds of information used, or the kinds of decisions made,” he says.

More importantly, there are potential financial penalties that could result from failing to ensure a privacy policy contains the correct disclosures.

“A privacy policy that omits the required APP 1.7 content is likely to be deemed to be interfering with privacy,” Vizza says.

“From 10 December, APP 1.7 is listed in section 13K, the administrative tier which will let the OAIC issue an infringement notice – currently $4368 for an individual or $21,840 for a company; issue a compliance notice; or seek a court penalty of up to 200 penalty units – $72,800 – with a corporate multiplier of up to five times under the Regulatory Powers Act – up to $364,000.

“The mid-tier – up to 2000 units – and serious-interference tiers exist for interferences generally, and a policy gap discovered during a complaint or data-breach investigation is the realistic way most small firms would encounter them.

“It is also important to note that this is a desktop-checkable obligation, which is precisely the kind regulators find easy to enforce.”

Submissions to the consultation

The automated decision making (ADM) transparency obligation was introduced by the Privacy and Other Legislation Amendment Act 2024. The OAIC opened a consultation on its guidance on 18 May, and the obligation takes effect on 10 December.

The consultation covered 10 questions which included what factors are considered to increase the likelihood that a decision could affect an individual’s rights or interests. Some of the potential items in the answer included financial outcomes and sensitive information. The guidance was published in September.

In its submission, the Insurance Council of Australia recommended the final guidance to be published by late July to allow for entities to assess their position, identify gaps and implement required changes.

“Alternatively, the OAIC should signal an extended transitionary period before any enforcement activity commences, in the event of late publication of the guidance to provide time for entities to align with regulatory intent,” stated the submission.

Two other submissions followed along the same lines. The Financial Services Council’s submission recommended the deferral of the commencement of the obligation or to “adopt a facilitative and educative regulatory approach during the initial implementation period and provide early clarity on enforcement expectations”.

The Association of Superannuation Funds of Australia submitted that it supports the fundamental objective of increasing transparency around the use of ADM programs but it wrote there was “not enough time between now and 10 December 2026 for entities to undertake the significant work needed to plan, develop, and deliver the operational systems and processes needed to comply with these new obligations”.