Regulatory Radar

Organisations that collect or handle personal information, including those using artificial intelligence or connected devices in customer facing processes, may find it useful to read the exposure draft bill and consultation paper to understand which proposed changes would affect their current privacy policies, consent mechanisms and data handling practices. Because the measures remain in draft and are subject to further consultation and parliamentary process, any internal assessment at this stage is best treated as preparatory rather than as a response to settled law. Estimating the scale of system, policy and contractual changes the draft would require may assist with future budgeting and planning.

Organisations that collect, use or disclose personal information may wish to begin scoping what a fair and reasonable handling standard, a 72 hour breach notification timeframe and new controller and processor concepts would mean for current privacy policies, data handling agreements and incident response procedures. For professional service firms, this includes client data held under retainer and information shared with outsourced providers. Because the Bill remains an exposure draft that has not been introduced into Parliament, any changes made now should be treated as preparatory rather than final, with further adjustment likely once the government settles its position following consultation.

Retailers selling smart glasses or similar recording wearables, and businesses that manufacture, distribute or deploy such devices in Australia, may wish to monitor the Privacy Commissioner's response to this request, as any resulting guidance or regulatory focus could affect product design, point of sale disclosures or usage policies. Businesses operating premises where customers or staff may use such devices, including retail, hospitality and workplace settings, could also consider their existing policies on recording by visitors or employees in light of the privacy concerns raised.

Businesses that use artificial intelligence in customer facing products, services or decision making may find it useful to map where AI currently features in those processes, so that if a digital duty of care, consumer law changes or privacy reforms proceed, the business can assess its exposure quickly. As this announcement is a statement of policy direction rather than a settled legislative proposal, any internal review undertaken now is best treated as preparatory monitoring rather than a response to a confirmed legal requirement.