27 May 2026

The Privacy Commissioner’s MMH inquiry phase 1 report sets out what “reasonable security safeguards” actually means under Rule 5. It is essential reading for all agencies handling sensitive personal information.

There seems to be some confusion among some health practitioners as to the scope of the new rule 3A of the Health Information Privacy Code. This post endeavours to clear things up.

23 May 2026

An AI scribe’s FAQ says patient data isn’t used for training. Sounds good, but its privacy policy tells a more involved story. A reminder to read the fine print.

22 May 2026

On 1 May 2026, the new information privacy principle 3A took effect. If your organisation uses AI tools to process personal information, this change could affect you. And it could do so in two quite different scenarios.

30 May 2025

The Privacy Commissioner has issued its most prescriptive compliance notice yet. Public and private sector agencies handling large volumes of personal information may want to take note.

27 August 2024

Information sharing MOU templates in circulation that would or could allow secondary use and disclosure if permitted by law, may now need to be reconsidered in the light of AI.

19 August 2024

The rights of claimants to access their personal information under the Privacy Acts are not limited by certain specific provisions in welfare legislation and court rules.

18 August 2024

Have you thought about how, when the new IPP comes into force, it might affect one’s use of generative AI tools, when you’re asking an AI tool to supplement personal information you include in a prompt?

15 August 2024

In this article, I discuss an example of nuanced questions that can arise when we assess various uses of AI tools against the Privacy Act’s information privacy principles.