AU Privacy Bill: An AI's Inference Counts as Collection

Posted: 5 September 2026 · Category: Legal, Compliance & HR

TL;DR: A draft bill released on 31 August would treat an inference an AI draws about you as collecting your personal information. That closes a real gap. It is still a draft, submissions close Friday 18 September, and it pointedly does not touch AI training data or automated decision-making.

What changed

On 31 August the Attorney-General released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, plus a consultation paper. Submissions close Friday 18 September 2026.

The line that matters for AI sits in the definition of "collects." The reform, the consultation paper says, will ensure that "inferences drawn by AI-enabled technology about an individual would be considered collection of information for the purpose of the Act."

Personal information, the draft adds, may be "generated or derived through means such as data analysis, artificial intelligence or other technological processes."

Consider what that fixes. A system is told your postcode and your shopping history. It works out that you are probably pregnant, or in financial stress. Today it is arguable whether anything was collected. Under this draft, it plainly was.

Three other changes sit around it. APPs 3, 4 and 6 collapse into a single fair and reasonable test. Consent must be "voluntary, informed, current, specific, and unambiguous." Precise geolocation becomes sensitive information.

Why it matters for Australians

Attorney-General Michelle Rowland put the case in one number. "Almost four in five Australians report they have very little or no control over how their personal information is collected or used."

The AI angle is not abstract. The government names smart glasses and connected vehicles — devices that "continuously collect and process personal information." Once an inference counts as collection, it must clear the fair and reasonable test.

One qualifier is being missed, and it cuts the other way. Holding information from which sensitive information could be derived does not, by itself, count as collecting sensitive information. Capability alone doesn't trigger those rules. That is a deliberate limit, and a fair one.

The right to erasure is narrower than the headlines suggest. It reaches only "large digital platforms" — $500 million or more in gross revenue, or 2.5 million average monthly end users in Australia. The big assistants plausibly clear that bar. The Australian SaaS tool you actually run your business on almost certainly does not. Who you bought from decides whether you can ask.

What it doesn't do

Two absences are worth naming. Automated decision-making does not appear in the consultation paper at all — not once. A separate ADM transparency obligation goes live on 10 December 2026. The draft also says nothing about AI training on personal information.

There is no start date either. Transitional provisions "will be incorporated once settled," and the bill "remains subject to further consideration."

Does this change our recommendation?

Not a single score, and it shouldn't — this is a draft, not law.

What it does is sharpen a question we already ask. Under Australian Fit, "what does this tool work out about you, and does it say so?" shifts from good practice toward legal exposure for the business deploying it. We will now ask it of tools that profile, score or rank people: lead scoring, candidate ranking, customer segmentation. Not just of tools that obviously store personal data.

If you have a view, you have until 18 September. The department asks for about 1,000 words.

This is general information, not legal advice. For your own obligations, talk to a qualified practitioner.

Update history

24 Sep 2026 — The AUD column was never grossed up for GST, and every word around it said it was. The header read “gross-up; GST unconfirmed” and the note beneath described a 10% uplift — while the figures themselves are plain conversions at 1.4045. Checked before changing a word: across the 63 files carrying this wording, 141 rows convert at 1.4045 and none at 1.4045 × 1.10. No figure changed here; only the description of them did. Two things were wrong beyond the arithmetic: gross-up names a tax uplift and was being used for a currency conversion, and GST unconfirmed is stale — our GST rule settled it on 5 September 2026, and a GST-registered Australian business supplying its ABN is not charged GST on an imported digital service. No USD price moved and no score changed. reviewed: untouched per our dating rule.

Frequently asked questions

What changed?

The Attorney-General released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 on 31 August 2026, with submissions closing 18 September. Its key AI provision would treat inferences drawn by AI-enabled technology about a person as collection of their personal information under the Privacy Act. It is a draft, not law.

Does this affect Australian users?

Eventually, and mostly through the businesses you deal with. If an AI works something out about you rather than being told it, that would count as collecting your information and would have to be fair and reasonable. The proposed right to erasure is limited to large digital platforms — $500 million or more in gross revenue, or 2.5 million average monthly Australian users.

Does it change our recommendation?

No score changes — it is a draft. It does sharpen our Australian Fit assessment: for tools that profile, score or rank people, we will ask explicitly what the tool infers about a person and whether it discloses that. No AI tool reviewed here replaces qualified professional advice.

Sources

Primary — Attorney-General's Department, Privacy Reform – Consultation on Exposure Draft legislation (opened 31 Aug 2026, closes 18 Sep 2026; scope covering AI and wearable devices; ~1,000-word submissions). https://consultations.ag.gov.au/rights-and-protections/privacy-reform/ · Wayback snapshot 31 August 2026
Primary — Attorney-General's Department, Privacy Reform Consultation Paper (inference-as-collection wording; the derived-sensitive-information qualifier; fair and reasonable test replacing APPs 3, 4 and 6; consent definition; Schedule 4 Part 2 erasure thresholds; transitional provisions "incorporated once settled"). Read in full 5 September 2026. https://consultations.ag.gov.au/rights-and-protections/privacy-reform/user_uploads/consultation_paper.pdf · Wayback snapshot 31 August 2026
Primary — The Hon Michelle Rowland MP, Attorney-General, Modernising Australia's privacy laws for the digital age, media release, 31 August 2026 (quotes; smart glasses and connected vehicles framing). https://ministers.ag.gov.au/media-centre/modernising-australias-privacy-laws-digital-age-31-08-2026 · Wayback snapshot 31 August 2026

All quoted wording is taken from the Attorney-General's Department's own consultation paper and media release, read on 5 September 2026. The exposure draft is a draft bill; nothing in it is law yet.

The AI Directory Australia is independent. We review and score AI tools for Australian users — AUD pricing, AU availability, data residency, GST. We don't write ads; affiliate links are disclosed and sponsored content is labelled. Edited by Adam.

Australia's new privacy bill says an AI's guess about you counts as collecting your data