The Office of the Australian Information Commissioner has published its guidance on the new transparency obligations for the use of AI and automated decision-making.

Separately, the Privacy Commissioner has explained how current and proposed privacy laws could strengthen protections and increase obligations on companies collecting personal information through smart glasses or other wearables.

Automated decision-making
From 10 December 2026, Australian Privacy Principle 1.3 requires regulated entities to disclose in their privacy policies where a “computer program” makes, or is substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests.

The OAIC has published a transparency obligation flow chart (PDF) to help the decision process.

APP 1.7 requires APP entities to include the information outlined in APP 1.8 in their APP Privacy Policy if:

* the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making a decision (APP 1.7(a)); and
* the decision could reasonably be expected to significantly affect the rights or interests of an individual (APP 1.7(b)); and
* personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision (APP 1.7(c)).

APP 1.8 outlines the information which must be included in an entity’s APP privacy policy if the conditions in APP 1.7 are met.

This includes:
* the kinds of personal information used in the operation of such computer programs; and
* the kinds of such decisions made solely by the operation of such computer programs; and
* the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs.

Privacy and surveillance wearables including smart glasses
The Privacy Commissioner has responded to public discussion about ambient recording devices that enable always-on, concealed and even covert surveillance of images, sounds and other personal information, and community concern about smart glasses at sensitive public spaces such as swimming pools, playgrounds and gyms.

While the Privacy Act does not apply to individuals who collect others’ personal information, only to companies and Commonwealth agencies, the Privacy Commissioner has expressed the view that retailers that sell smart glasses – for example on an ecommerce website – or companies that manufacture them, may not have any Privacy Act obligations if they do not collect any personal information with respect to those devices. Instead, the entity providing the software used in the device is likely to be the entity that collects and holds the information for the purpose of privacy law.

The Commissioner notes that forthcoming changes to the Privacy Act broaden the definition of “personal information” so that it is likely that it will include images of an individual or recordings of their voice, depending on the context and capabilities of the regulated entity as to whether and in which circumstances the personal information they are collecting is personal information.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

ASIC has published its supervisory priorities for 2026-27 for the banking, superannuation, general insurance, life insurance and financial markets sectors.

Banking sector: ASIC will review the use of AI in customer-facing activities, decision-making and lending processes (including governance and risk assessment of new and proposed use cases of AI for consumers and small businesses) and will review lender conduct practices, such as incentives, referrer arrangements, and broker oversight. There will be an ongoing focus on offset accounts and controls to keep promises to customers and prevent systemic failures, and to improve outcomes for those in financial difficulty.

Superannuation sector: ASIC will continue its multi-year review of superannuation member services and begin new reviews on trustee oversight of advice fee deductions and retirement as well as death benefit claims handling. ASIC is currently testing how well superannuation trustees use member complaints data to identify and address systemic issues and to improve service delivery.

General insurance sector: ASIC will review the practices of for-profit claims management firms (including those commonly referred to as ‘disaster chasers’) and the potential implications of some firms’ practices for consumers. It will continue to focus on motor vehicle insurance premium disclosure and cash settlements in home building insurance.

Life insurance sector: ASIC will review life insurance practices related to funeral insurance and continue its review into service issues in life insurance.

Markets sector: ASIC will continue to use market intelligence and data, and targeted surveillance to examine distribution and fee and incentive structures.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

In Australian Securities and Investments Commission v Hollard Insurance Partners Limited [2026] FCA 1487, the Federal Court of Australia ordered Hollard to pay a $2 million penalty after Hollard admitted that its serious claim-handling failures resulted in Hollard breaching its duty of utmost good faith because of significant delays, poor communication and other failings in handling a home insurance claim by a family in regional Victoria, following a storm in October 2021 that damaged their home. The home was ultimately deemed a total loss.

Despite initially accepting the claim for the home’s damaged roof, Hollard delayed for 15 months before settling the claim.

Hollard admitted that it failed to comply with the Insurance Contracts Act 1984 (Cth) by a combination of:

(a) failing to promptly engage a structural engineer for expert opinion in assessing the damage caused by storm to the roof of the Insureds’ home;
(b) failing to assess correctly, and delaying in rectifying its mistake, as to the extent of the boundary fence which needed to be repaired;
(c) delaying in arranging further emergency works to the Insureds’ home, to protect the building against further loss or damage, after being notified that the original make-safe works had failed to stop water ingress;
(d) delaying in providing temporary accommodation to the Insureds;
(e) failing to sufficiently consider two written expert reports and an inspection report prepared by Hollard’s appointed claim manager that were relevant to the decision to offer a cash settlement for the damage to the external roof caused by the storm;
(f) failing to communicate in a sufficiently clear manner in writing with the Insureds about the reasoning and basis for the decision to offer a cash settlement for the damage to the external roof caused by the storm, and the value of the cash settlement that was offered in relation to that damage; and
(g) delaying in providing repairs to address growing mould.

In determining the penalty to be imposed, Justice Button proceeded on the basis that the combined conduct constituted a single contravention.

He accepted Hollard’s submissions that the changes it has made significantly reduce the possibility of the multiple failings that occurred in the handling of the Insureds’ claim recurring.

Justice Button observed:

“The saga experienced by the Insureds was extended and must have been stressful and traumatic. They were given the runaround in more ways than one, and lived in their ever-deteriorating home, as the saga wore on. The Court is not imposing a penalty to reflect everything the Insureds experienced; what the Insureds experienced in its totality cannot be substituted for the contravening conduct for which the civil penalty is to be imposed. Nor is the Court imposing a penalty reflecting every aspect of Hollard’s conduct at which one might look askance….
A business that identifies issues and takes steps to address them without the pressure of regulatory enforcement action prompting the change is, in my view, a business less in need of specific deterrence than a business driven to make changes by the pressure of litigation….
While significant improvements have been made in claims handling, there is always the risk of back-sliding, and the penalty imposed will serve to deter Hollard from tolerating any such back-sliding as would allow similar failings in claims handling to occur in the future.”

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The Australian Prudential Regulation Authority (APRA) has released a package of proposals to strengthen trustee investment governance to protect members’ retirement savings through a revised Prudential Standard SPS 530 Investment Governance for Responsible Superannuation Entity licensees.

The proposals increase requirements across eight key areas of risk and build on existing obligations for trustees particularly in the platform sector.

Three proposals would require trustees to:

• set and enforce member-level investment limits for higher-risk investments;
• strengthen the management of investment-related conflicts; and
• ensure their investment oversight capabilities and resources are commensurate with the size and complexity of their investment menus.

APRA is also proposing five changes to codify and strengthen existing expectations for investment onboarding, monitoring, remediation, valuations and accountability.

APRA is considering whether certain trustee remuneration requirements that currently apply to large trustees should be applied to complex trustees of all sizes to appropriately incentivise effective and prudent governance.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The Australian Financial Complaints Authority (AFCA) has released a consultation paper on proposed changes to its Scheme Rules to enable it to consider scam-related complaints under the Scams Prevention Framework (SPF) from 31 March 2027. Background.

The Australian Government has authorised AFCA as the single external dispute resolution scheme to consider scam-related complaints under the SPF about regulated entities under the first three designated SPF sectors; banking, digital platforms and telecommunications.

Consumers who have been impacted by a scam are expected to first raise their concerns directly with the relevant regulated entity through Internal Dispute Resolution. The SPF Codes and Rules are not settled; however, the Government has proposed that regulated entities will be required to co-operate at IDR and that consumers will have the right to escalate a complaint to AFCA if they are unsatisfied with the outcome.

The AFCA Scheme Rules will be organised into separate divisions. These comprise the new Rules that will apply specifically to SPF complaints (the Scam Rules) and the existing Rules for financial services complaints, the Financial Firm Rules.

Some complaints may raise issues across the SPF and other laws (including financial services laws and telecommunications codes). AFCA will determine the most appropriate process to manage them, while maintaining the distinct legal responsibilities under each framework.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The Australian Banking Association has published an updated industry guideline of good industry practice for how banks may support and provide extra care for customers experiencing financial abuse.

The guideline says that “financial abuse occurs when another person exerts power and control to exploit, monitor or sabotage someone’s access to, or use of, money, finance or property, business assets and liabilities, without their knowledge or consent. In some situations, a person may feel pressured, coerced or unable to refuse a directive from the person causing harm.”

The guideline applies to customers to whom the Banking Code applies. It includes individuals, small businesses and guarantors.

Part B2 of the Banking Code includes a commitment that member banks will take extra care with customers who are experiencing vulnerability, including financial abuse and the abuse of older people.

The guideline explains what financial abuse is, how a bank may recognise that a customer is experiencing financial abuse, and the steps a bank may take to help when they are aware a customer is experiencing financial abuse.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

With Memoranda of Understanding in place between financial services regulators covering information sharing, and in response to increased expectations from the Government, cybersecurity breaches, AI rogue agents attacks and AML/CTF non-compliance by the same organisation can now result in multiple coordinated enforcement actions from ASIC, APRA and Austrac.

It is now accepted that “non-financial risk management” does in fact have significant financial and prudential implications, both for the company itself and its directors and officers.

Your systems need to prevent you from committing a breach but also to identify when a breach occurs so that you can report it to a regulator.

Less than 10 years ago CBA’s Chief Risk Officer told the Banking Royal Commission that “ the state of our systems that recorded and aggregated instances of misconduct … were not particularly advanced. They were not particularly well connected. The difficulty that the bank experienced was that various incidents of misconduct were recorded on different systems in different business units, without necessarily being all encompassed in a single business unit.”

The expectation now is that businesses have systems with high-quality data accessible to identify how, or to what extent, the entity as a whole is failing to comply with the law.

It is not uncommon now for APRA to impose licence conditions and capital requirements on a regulated entity when APRA says the entity “does not have a complete view of its regulatory obligations, material risks and key controls; there are material deficiencies in governance, accountability, compliance management, risk oversight and risk management capability; and key weaknesses have persisted despite several years of remediation activity”.

An Austrac investigation can lead to a penalty action as well as an ASIC action for breach of financial services licence obligations.

And for an APRA-regulated entity, additional APRA licence conditions and capital requirements can be imposed as well as ASIC actions against directors and executives.

Under the Financial Accountability Regime (previously the Banking Executive Accountability Regime) directors and executives are financially accountable for past deficiencies in relation to cybersecurity protection and enforcement of anti-money laundering laws.

Proving that you have addressed alleged deficiencies requires documenting decisions and maintaining records.

Otherwise, the company will face remediation and compliance costs as well as a penalty, and executives will risk losing bonuses and incentives.

And for a listed company, there is the risk of a shareholder class action.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

In a recent speech ASIC Commissioner Simone Constant stated that ASIC is undertaking active surveillances across wholesale and retail funds to check whether all private credit participants are adopting its 10 principles for private credit (pdf) as a practical benchmark for self-assessment and uplift. Background

She discussed the role of fund managers, institutional investors and superannuation trustees, and valuers, auditors and ratings agencies in ensuring that investors can have confidence that the information and the assessments they are relying on are sound.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The Australian Attorney-General has released a Consultation Paper and Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026 to modernise and strengthen Australia’s privacy laws as well as responding to emerging risks from new technologies, including artificial intelligence, wearable surveillance technologies (such as smart glasses and ear buds) and connected vehicles.

It is also intended to provide greater certainty for businesses and other regulated entities.

The paper canvasses a range of proposed reforms, including:
* amending the definition of personal information to cover information that ‘relates to’ an individual who is identified or reasonably identifiable, and a new definition of reasonably identifiable is introduced.
* making it clear that personal information is ‘collected’ when an entity includes it in a record or generally available publication, regardless of the source from which, or how, the information is obtained. The amendments also clarify when entities will be taken to collect sensitive information that is derived from other personal information, regardless of whether the entity makes a separate record of that sensitive information.
* introducing a definition of disclosure based on whether an entity makes personal information accessible to another person or body, including where personal information is transmitted or stored overseas.
* strengthening and clarifying requirements for data security and minimisation, and responses to data breaches
* introducing a right for individuals to request the erasure of personal information held by large digital platforms, and an exception where compliance is technically impossible or infeasible and
* supporting research and innovation by simplifying research exceptions and facilitating the handling of personal information for ethically approved human research.

Existing APPs 3, 4 and 6 would be replaced with a new framework for the collection, use and disclosure of personal information. This framework is centred around a new test which permits the handling of personal information only where it is fair and reasonable in the circumstances, with reference to a non-exhaustive list of factors. There are exceptions where a permitted general or health situation applies or the information handling is required or authorised by law.

Data breach notification
The proposed amendments provide that an entity must, within 72 hours of becoming aware of reasonable grounds to believe that an eligible data breach has occurred, give the Information Commissioner a statement that notifies the Commissioner of the eligible data breach and sets out required content.

The introduction of the 72-hour notification requirement would not alter the obligation for assessment of suspected eligible data breaches. An entity that has reasonable grounds to suspect that there may have been an eligible data breach but has not yet established reasonable grounds to believe that an eligible data breach has occurred, must continue to take all reasonable steps to ensure that the assessment is completed within 30 days.

The small business exemption has not been removed.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.

The National Consumer Credit Protection Amendment (Small Business Exemption) Regulations 2026 have been registered to amend the National Consumer Credit Protection Regulations 2010 by extending the existing exemption from responsible lending obligations for small business borrowers for 10 years from 4 October 2026.

The exemption provides that mixed purpose loans to a consumer (for example, where a small business operated by an individual applies for a single loan to be used for both personal and commercial purposes) are exempt from responsible lending requirements so long as there is a ‘genuine’ small business purpose component that is not minor or incidental.

Under the genuine purpose test, the lender need only establish that there is a genuine business purpose that is not minor or incidental to the overall purposes of the related credit provision.

For the purposes of the exemption, a small business meets the test in the Australian Small Business and Family Enterprise Ombudsman Act 2015 by having fewer than 100 employees or revenue of $5 million or less in the previous financial year.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email: djacobson@brightlaw.com.au
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.