On 31 August, the Attorney-General's Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, the second tranche of Privacy Act reform, and consultation closed on 18 September. The draft carries roughly forty proposals, and most of the commentary has gone to the headline items: a fair and reasonable test in place of the current collection and use rules, a 72-hour window to notify the Information Commissioner of an eligible data breach, a controller and processor framework, and a right of erasure aimed at large digital platforms. The provision that matters most for any organisation using AI is quieter. As Clayton Utz reads the draft, collection is broadened to expressly capture AI-generated and derived data, "meaning inferences drawn by algorithms will attract full Privacy Act obligations".
Most boards will hear that as a data-handling change and route it to the privacy officer. That misreads what is being regulated. Today the privacy question in most organisations is about what customers hand over: the form, the app, the transaction record. Under this draft, a meaningful share of the personal information an organisation holds will be information nobody handed over at all. It will be what the organisation's own models concluded. The churn score, the credit propensity, the life-stage segment, the inferred household income, the flag that says a customer is probably vulnerable. None of it was collected in the ordinary sense. On this reading, all of it would be.
The detail worth sitting with is how the draft treats sensitive information, because that is where the governance event is hiding. Johnson Winter Slattery notes that where sensitive information could be derived from what an entity holds, it is not deemed collected unless the entity intends to collect it, or uses or discloses it. Allens draws the line with an example: a customer ordering halal meals has not handed over their religion, but using meal orders to infer religious belief for festival marketing is a collection. Allens also poses the case nobody can answer cleanly, which is whether a retailer marketing further maternity clothes to a customer has inferred a pregnancy. The trigger, in other words, is purpose. Whether your organisation has collected someone's health status, religion or sexuality will turn on what a model was built to predict and what the business then did with the answer. That choice is currently made by a data science team setting a target variable, and it is rarely, if ever, a decision a board has been asked to approve.
Two features raise the stakes. Clayton Utz reads the changes to permitted handling as generally applying to all personal information held, not only what is collected after commencement, which would bring the inferences already sitting in a customer data platform into scope. And no commencement date has been published, so the preparation window is unknown. This is an exposure draft and it will change before it becomes law, but the direction is not ambiguous, and it lands beside an automated decision-making disclosure obligation that commences on 10 December. That obligation asks what your organisation decides about people by machine. This one asks what your organisation knows about people by machine, and on what basis. Section 180 sets the standard as the care a reasonable person in that director's position would exercise, and it scales with the regulatory environment the entity sits in. A director of an organisation whose AI value case rests on inference, reading a draft that treats inference as collection, is expected to know what the organisation is inferring.
- Which of our models are built to predict something that, stated plainly, is health, religion, ethnicity, sexuality or political opinion, even where the model calls it something more comfortable?
- Can management give us a list of every attribute our models generate about identifiable customers or employees, as distinct from the data those people gave us? If nobody holds that list, what exactly would we produce in response to an access request?
- Who in this organisation decides what a model is built to predict, and at what point does that decision reach anyone accountable for privacy, let alone this board?
- If our customer data platform were breached tomorrow, would the incident team scope the inferred attributes as personal information inside a 72-hour clock, or would it report only what customers supplied?
- Of the AI business cases this board has approved in the last two years, how many depend on knowing something about a person that the person never told us, and would each of them survive a genuine fair and reasonable test?
- The reform handed to the privacy officer as a policy rewrite. The obligation sits in the modelling pipeline, and a privacy function with no visibility of what models are built to predict is being asked to certify something it cannot see.
- A data inventory that maps source systems and customer-supplied fields but stops at the edge of the analytics platform. On this draft, the most sensitive information you hold may be information you created yourself.
- Model outputs described in commercial language, such as life-stage, affinity or wellbeing, that nobody has translated into the category of personal information each output actually represents.
- Comfort taken from exposure-draft status. The text will be amended, but models built this year will still be running when it commences, and rebuilding a model costs far more than choosing its target carefully the first time.
- Supplier and processor contracts that are silent on inferences. If a vendor's model generates attributes about your customers, the controller and processor framework turns the question of who holds that inference, and who answers for it, into a contract term rather than an assumption.
- Treating 10 December compliance as the AI privacy work done. The automated decision-making obligation is about disclosing decisions, and it does not reach what the organisation infers and holds without ever deciding anything.
The opportunity is to decide deliberately, and ahead of the law, what this organisation is prepared to know about people. That sounds like a constraint, and in part it is, but it is also a strategy decision the board has never actually been offered. An organisation that can say plainly which inferences it draws, why it draws them, and which ones it has chosen not to draw holds a trust position competitors cannot quickly copy, and an AI portfolio built on value that survives a fair and reasonable test rather than value that depends on nobody asking. The work is also cheaper now than later. Mapping inferences while the model estate is still young is a register exercise. Doing it after commencement, against a 72-hour breach clock and a regulator holding new penalty tiers and infringement notices, is a remediation programme.
The risk is that much of the value in the AI roadmap sits exactly where the draft is heading. Personalisation, propensity, pricing and next-best-offer models earn their keep by knowing things customers did not say, and some of those inferences will land on the wrong side of a purpose test that turns on intent. If the board does not look now, it will discover which approved business cases depend on inferred sensitive information when an access request, a complaint or a breach notification forces the answer into the open. By then the choice is no longer which models to build. It is which models to switch off, what to tell customers about the inferences already held, and why nobody asked when the direction of the law was already public.
Treat this as a strategy question with a privacy consequence, not a privacy question with a technology footnote. Ask management for three things before the end of the year and put a date against each: an inference register covering every attribute a model generates about an identifiable person, what it is used for, and whether the output, stated plainly, falls into a category of sensitive information; a board-approved position on which inferences this organisation will and will not draw, written as policy rather than left to whoever sets a model's target; and confirmation that breach response, retention and access-request processes treat inferred attributes as personal information now, not from whenever the Bill commences. Then run the AI business cases already approved against that position and minute which of them depend on something the organisation would not be comfortable telling the customer it knows. The draft will change before it becomes law. The question underneath it will not: what does this organisation know about people that they never told it, and who decided it should?
Researched and drafted by Brad's agentic AI team. Edited and published by Brad Ferris.