Australian AI Governance Briefing: Week Ending 6 September 2026
The Attorney-General released the exposure draft Privacy Amendment (Personal Data Protection) Bill 2026, the second tranche of Privacy Act reform, with submissions closing 18 September 2026.
One development dominated the week. On Monday 31 August the Attorney-General released a consultation paper and exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 — the second tranche of Privacy Act reform. The package contains around 40 measures, including a new “fair and reasonable” test governing collection, use and disclosure, a broadened definition of personal information, two new categories of sensitive information, a right to erasure limited to large digital platforms, a prohibition on trading personal information without consent, a 72-hour data breach notification requirement, and the introduction of controller and processor concepts into Australian privacy law. Submissions close on Friday 18 September 2026, an 18-day window.
The Attorney-General’s media release frames the reforms as responding to risks from new technologies including artificial intelligence and wearable devices such as smart glasses, and to connected vehicles that continuously collect and process personal information. A companion announcement introduced IDLock, a document-blocking service to be delivered through myGov.
In New South Wales, the Education Standards Authority moved on generative AI in senior secondary assessment, capping take-home tasks at one per course and 15% of the school-based assessment mark. Submissions to the Senate inquiry into artificial intelligence and data centres closed on 1 September.
The week in review
Attorney-General releases exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026
On 31 August 2026 the Attorney-General, the Hon Michelle Rowland MP, released a consultation paper and exposure draft legislation for the second tranche of Privacy Act reform. Submissions close on 18 September 2026 and the Attorney-General’s Department has asked for submissions of approximately 1,000 words.
The media release states that the reforms are intended to bolster privacy protections and address emerging risks from new technologies including artificial intelligence and wearable devices such as smart glasses, and identifies AI-powered tools and devices such as those used in connected vehicles, which continuously collect and process personal information, as amplifying those risks. The release cites survey findings that almost four in five Australians report having very little or no control over how their personal information is collected or used.
The package contains approximately 40 proposals: 25 that uplift privacy protections, five that simplify and clarify obligations, four further simplification measures, and seven directed at regulatory efficiency.
The central measure is a new APP 3, which requires that the collection, use and disclosure of personal information be fair and reasonable in the circumstances. The test is objective and applies irrespective of whether consent was obtained. It replaces the existing APPs 3, 4 and 6. Listed factors include the reasonable expectations of an individual, the connection to the entity’s functions and activities, transparency, data minimisation, whether the individual had genuine choice, and the proportionality of any benefit against the risk of harm. Where the individual is a child, their best interests are a primary consideration.
The definition of personal information in section 6FD is expanded from information “about” an individual to information that “relates to” an individual, and codifies individuation — the capacity to recognise or single out a person without knowing their name or legal identity. A new section 6FF addresses when an individual is reasonably identifiable, codifying the mosaic effect. Section 6FE adds two new categories of sensitive information: precise geolocation tracking data, defined by reference to non-static location within a 500 metre radius tracked over time, and genomic information. Section 6AAB adds a fifth element to the definition of consent, requiring that it be unambiguous alongside voluntary, informed, current and specific.
A new APP 14 introduces a right to erasure, limited to large digital platforms. Section 6EB defines a large digital platform by reference to service types under the Online Safety Act 2021 together with either business-group gross revenue of at least $500 million in the previous financial year, at least 2.5 million average monthly end users, or a prescribed criterion. A new APP 4.2 prohibits the trading of personal information without consent, with trade defined as disclosure for money or other consideration, or for direct marketing purposes. APP 7 is overhauled, including an opt-out regime for advertising-supported services with no monetary threshold.
On data breaches, the exposure draft replaces the current 30-day assessment period with notification to the Information Commissioner within 72 hours, permitting incomplete statements where providing full information is impracticable, and imposes mitigation and preparedness obligations in respect of all data breaches rather than only eligible data breaches. A new section 16D introduces controller and processor concepts into Australian privacy law for the first time, with processors subject only to APP 1 and APP 11 and the controller deemed liable. Other measures cover collection notices under APP 5, expanded data security obligations under APP 11, a new access request exception at APP 12.3A, and a human research exception at section 94B.
The small business exemption for entities with annual turnover of $3 million or less is retained, as are the employee records, political and journalism exemptions. The exposure draft does not include a direct right of action.
Alongside the privacy package, the Attorney-General announced IDLock, a service allowing individuals to block, unblock and monitor the use of identity documents such as driver licences and passports through the Document Verification Service, delivered via myGov. IDLock builds on the existing Credential Protection Register, which the Attorney-General states has blocked more than 830,000 fraudulent identity verification attempts since late 2022, averaging around 18,000 a month. Early-access testing is planned for later in 2026, with national rollout in 2027.
Alerts on the exposure draft were published during the week by Allens, MinterEllison, Corrs Chambers Westgarth, Herbert Smith Freehills Kramer, Clayton Utz, Johnson Winter Slattery, Colin Biggers & Paisley and Spruson & Ferguson.
Primary sources: Attorney-General — Modernising Australia’s privacy laws for the digital age | Attorney-General’s Department — Privacy reform consultation | Allens — A new era for privacy: What the proposed Privacy Act reforms mean in practice | MinterEllison — Draft Tranche 2 Privacy Reforms: What they mean for businesses
NSW caps take-home HSC assessment in response to generative AI
On 1 September 2026 the NSW Government announced changes to senior secondary assessment rules following advice from the NSW Education Standards Authority. School-based assessment programs for Preliminary and HSC courses will be limited to no more than one take-home assessment task, carrying a maximum weighting of 15% of the school-based assessment mark — 7.5% of the total HSC mark, since school-based assessment accounts for half of the final result.
The advice followed a request from the Acting Premier and Minister for Education and Early Learning, Prue Car, for NESA to examine measures to protect student learning given the rise in the use of artificial intelligence in schools. Take-home assessments are defined as tasks completed outside a classroom, formal examination setting or teacher-approved monitoring conditions. Schools retain discretion over the number, type and weighting of in-school assessment tasks, including examinations, oral tasks and process diaries.
The limit applies to HSC courses from Term 4 2026 and to Preliminary courses from Term 1 2027. Courses with a major project or an HSC practical exam are excluded, though schools remain required to authenticate student work. NESA is amending the Assessment, Certification and Examination (ACE) Rules and the assessment and reporting requirements in each syllabus before the end of Term 3 2026, and has advised schools to check that their malpractice policies do not rely on AI detection tools. The NESA Board will consider further subject-specific advice and teacher guidance for the 2028 HSC and beyond.
NESA Chief Executive Paul Martin said that generative AI may offer students a short-cut to complex school work but bypasses the opportunity to build knowledge and learning, and described a moral obligation to protect the learning process, the integrity of assessments and confidence in the HSC credential. The NESA Board includes representatives of the public, Catholic and independent school sectors, high school principals and education unions.
Primary sources: NSW Government — New rules for schools on AI in take-home HSC assessments | NESA — New limit on take-home assessment tasks from Term 4 2026
Submissions close on the Senate inquiry into artificial intelligence and data centres
Submissions to the Senate Environment and Communications References Committee inquiry into artificial intelligence and data centres closed on 1 September 2026. The inquiry was referred on 13 May 2026 and is chaired by Senator Sarah Hanson-Young. The committee is due to report by 16 November 2026.
The terms of reference cover the effectiveness of existing regulatory frameworks for data centre growth, energy and water consumption, grid and infrastructure effects, environmental impacts, planning and community consultation, economic benefits, and government arrangements with AI companies. Submissions were lodged by bodies including the Climate Council, the ARC Centre of Excellence for Automated Decision-Making and Society, and the Local Government Association of South Australia.
Primary sources: Parliament of Australia — Artificial intelligence and data centres inquiry
Stories
Attorney-General releases Privacy Act tranche 2 exposure draft with submissions closing 18 September
The Attorney-General released a consultation paper and the exposure draft Privacy Amendment (Personal Data Protection) Bill 2026 on 31 August 2026, containing around 40 measures. Key elements include a new objective “fair and reasonable” test in APP 3 that applies regardless of consent, an expanded definition of personal information covering data that “relates to” an individual and codifying individuation, new sensitive information categories for precise geolocation tracking data and genomic information, a right to erasure limited to large digital platforms, a prohibition on trading personal information without consent, 72-hour data breach notification, and controller and processor concepts. The small business and employee records exemptions are retained and no direct right of action is included. Submissions close on 18 September 2026.
NSW limits take-home HSC assessment tasks over generative AI use
The NSW Government announced on 1 September 2026 that school-based assessment programs for Preliminary and HSC courses will be limited to one take-home assessment task worth no more than 15% of the school-based assessment mark, or 7.5% of the total HSC mark. The change follows advice from the NSW Education Standards Authority requested by Acting Premier and Education Minister Prue Car, and applies to HSC courses from Term 4 2026 and Preliminary courses from Term 1 2027. Courses with a major project or HSC practical exam are excluded. NESA is amending the ACE Rules before the end of Term 3 2026 and has advised schools that malpractice policies should not rely on AI detection tools.
Senate inquiry into artificial intelligence and data centres closes submissions
Submissions to the Senate Environment and Communications References Committee inquiry into artificial intelligence and data centres closed on 1 September 2026. The inquiry, referred on 13 May 2026 and chaired by Senator Sarah Hanson-Young, is examining the effectiveness of existing regulatory frameworks, energy and water consumption, grid and infrastructure effects, environmental impacts, planning and community consultation, and economic benefits. The committee is due to report by 16 November 2026.
Attorney-General announces IDLock identity document blocking service
Alongside the privacy exposure draft on 31 August 2026, the Attorney-General announced IDLock, a service allowing individuals to block, unblock and monitor the use of identity documents such as driver licences and passports through the Document Verification Service, accessed via myGov. IDLock builds on the Credential Protection Register, which the Attorney-General states has blocked more than 830,000 fraudulent identity verification attempts since late 2022, averaging around 18,000 a month. Early-access testing is planned for later in 2026, with national rollout in 2027.
This briefing was researched and written with AI assistance.
Stay across Australian AI governance
Get the briefing delivered to your inbox every week. No spam, unsubscribe any time.