Key points

• The Office of the Australian Information Commissioner (OAIC), Australia’s privacy regulator, has released two guidance notes on privacy and AI: Guidance on privacy and developing and training generative AI models (guidance on generative AI) and Guidance on privacy and the use of commercially available AI products (guidance on AI products).
• In the guidance on generative AI, the OAIC suggests that developers of generative AI models should carefully consider whether the data they intend to use to train the models contains any personal or sensitive information (and, if so, whether their use of this information to train generative AI models is compliant with their privacy obligations).
• In the guidance on AI products, the OAIC suggests that, among other things, businesses using AI products should ensure that their privacy policies contain clear information about their use of AI.

Background

Earlier this year, we discussed the current state of play for the regulation of AI in Australia. In that article, we noted that the Australian government had considered the use of personal information in the context of automated decision making in its response to the Privacy Act Review Report released in September 2023.

Our article also noted the interim response to the Australian government’s safe and responsible AI consultation published in January 2024, which considered submissions made by the OAIC.

OAIC guidance

The OAIC has now published two articles which provide guidance on privacy considerations in the context of AI. These are:

• guidance on privacy and the use of commercially available AI products, which sets out the OAIC’s expectations of businesses that use commercially available AI products; and
• guidance on privacy and developing and training generative AI models, which is directed at developers that are using personal information to train generative AI models.

Helpfully, the OAIC summarises the guidance in its “top five takeaways”:

What businesses and developers should do

For businesses that use personal information with commercially available AI products in their operations:

• It is important that their privacy policies clearly set out how AI is being used. In the guidance, the OAIC suggested that public facing AI tools (such as chatbots) should also be clearly identified as such to external users such as customers.
• Businesses should have in place policies and procedures that regulate their use of the AI products. This is consistent with the AI guardrails in the Australian Government’s Voluntary AI Safety Standard, which we discussed in detail in our recent article on the practical impact of the AI guardrails.

For developers of generative AI models that use personal information to train their models:

• Developers will need to consider whether the personal information they intend to use for the purposes of training AI models was collected for that primary purpose. Depending upon whether the individual would reasonably expect their personal information to be used for training AI models and whether or not the personal information is sensitive in nature, developers may need to obtain consent from the individual.
• Developers should take particular care with photographs or recordings of individuals, given the OAIC’s view that images of individuals may by itself constitute or contain sensitive information in which case it cannot be used as input data for AI systems without the individual’s consent.