Australia: Adopted Guidance on Privacy and Developing and Training Generative AI Models

On 21 October 2024, the Office of the Australian Information Commissioner issued guidance on privacy considerations for developing and training generative artificial intelligence (AI) models. The guidance outlines measures to address privacy concerns and the potential for bias in AI outputs. It emphasises the importance of using accurate, high-quality datasets, conducting testing, and providing disclaimers to address risks associated with AI's probabilistic nature. Developers are required to consider privacy obligations, particularly when handling sensitive information, and to ensure that publicly accessible data is not automatically permissible for AI training if it contains personal or sensitive information, which generally requires consent. Secondary uses of personal data should align with user expectations or obtain consent where necessary. The guidance highlights that generative AI models can face accuracy risks due to the use of large datasets from the internet, which may contain biases. Developers are required to manage these risks under the Australian Privacy Principles (APP) by taking reasonable steps to ensure that personal information used in AI models is accurate, up-to-date, and relevant. Compliance measures include adopting privacy-by-design principles, conducting privacy impact assessments, updating training data as necessary, and clearly communicating the limitations of the models.