The Privacy Act 1988 (Cth) requires all businesses to have a privacy policy in place, if that business is an Australian Privacy Principles entity (‘APP entity’).

A privacy policy is a document that sets out how a business collects, holds, uses, and discloses personal information.

Personal information is information that identifies a person, irrespective of whether the information is true or not. This information can include a person’s name, physical or email address, photograph, telephone number, or their payment details.

Back in February 2020, Holman Webb published an article ‘AI and Facial Identification Technology – the Face of the Future?’, which referred to an article in the New York Times highlighting Clearview AI, and the use of the company’s facial recognition technology by law enforcement agencies internationally.

At the time the Australian Parliament was considering the introduction of the Identity-matching Services Bill 2019 and Australian Passports Amendment (Identity-matching Services) Bill 2019 which would enable the Department of Home Affairs and Foreign Affairs and Trade to utilise similar facial recognition technology.

As it turns out, Holman Webb Lawyers were not the only ones taking a close look at Clearview AI. Since that time, it appears that Clearview AI was offering free software trials to numerous law enforcement agencies within Australia, some of whom have commenced their investigation into the use of the app and have been feeding visual data into the system.

HealthEngine, an online booking engine and review platform for medical practises has been hit with a $2.9M fine for sharing the non-clinical personal information of 135,000 patients.

Australia privacy rights are regulated by Commonwealth and State legislation and the laws protecting confidential information under the common law.

Australian privacy laws govern the collection, use and disclosure of “personal information”.  Further, individuals are provided with a right of access and correction of their own personal information.  There are also data security, data quality and cross-border transborder data flow requirements.