Ë¿¹ÏÊÓƵ

By Andrew Nicholson

Changes to the Privacy Act commence on 10 December 2026, which will require venues to review their use of AI or other automated decision-making (ADM) systems and update their privacy policies, where those systems help make or contribute to decisions which may significantly affect an individual’s rights or interests.

Critically, venues should not treat these changes as just a requirement to update their privacy policy. They require venues to make a proper assessment and to be transparent about their use of AI systems or tools which handle personal information.  As you can’t disclose what you don’t understand, it will be necessary for venues to be clear about and to be able to explain in simple terms:

• What technology is being used to make automated decisions.
• Where it is used and relied on by the venue.
• How those decisions may affect the rights of individuals.

Most venues use more automated decision-making technology than they realise.  From AI tools such as ChatGPT, Copilot and Claude to systems that manage membership, loyalty, gaming, security and marketing, these technologies are increasingly embedded in everyday operations. Operators should understand which technologies they use, what personal information they rely on, which decisions they influence, and what safeguards are in place.

What changes on 10 December 2026?

From 10 December, a privacy policy must explain when the organisation uses a computer program to make, or do something related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests. The policy must describe the personal information used and the decisions involved.

The obligation is directed at, but not limited to, the use of AI. Other programs or systems which are also likely to be caught include:

• Facial recognition, CCTV and ID scanning systems;
• AI used to prepare, summarise or record/summarise meetings;
• AI tools used to review contracts, terms and conditions or similar documents;
• systems that identify unusual activity, fraud or security risks;
• AI-assisted recruitment, rostering and employee performance systems;
• systems that analyse customer or member behaviour including responsible gaming systems;
• automated customer service, booking and enquiry systems;
• loyalty, CRM and marketing platforms that use profiling, recommendations or targeting; and
• AI functionality embedded within venue, gaming, membership, security and point-of-sale platforms.

Facial recognition and ID scanning

Facial recognition and networked ID scanning are increasingly used to identify banned and excluded patrons, and some state liquor and gaming laws require or encourage their use.  A legal requirement to use the technology does not remove the obligation to be transparent about it. The Office of the Australian Information Commissioner (OAIC) has made clear that privacy policies must describe specific uses of facial recognition, not simply refer to CCTV.

reminds us that how the technology is used, explained, and governed matters as much as whether it is used at all.

Why human oversight matters

It does not matter that a staff member makes the final call.  What’s important is whether a system materially influenced the outcome, and whether the venue has real human oversight.

The recent Medicare breach serves as a reminder. In June 2026, an AI agent researching Australian health information accessed non-public files on a Services Australia Medicare statistics portal. Individual Medicare records were not accessed, but the incident showed an AI agent can move beyond its intended task. Venues need controls over not only how staff use AI, but what AI tools connected to patron, member, gaming or security systems can access and do.

A governance issue for boards, owners and licensees

This is not solely an IT issue. For clubs, directors’ duties require visibility into how technology affects members and patrons; for pubs and hotel groups, the same responsibility sits with owners, management and licensees.  Boards should be able to answer:

• Where are automated systems used across our venues, including inside existing software?
• Which of them make or influence decisions about patrons, members or job applicants?
• Are we using facial recognition or other biometric technology, and why?
• What do our supplier agreements say about how they will use AI?  Are suppliers using our data to train their own AI, and is that securely/confidentially maintained?
• Who reviews significant decisions, and who is responsible for monitoring AI use?

What should operators do now?

An AI policy is a good start but will not manage the risk by itself. Before 10 December, venues should:

• Map the technology – identify the platforms in use, where necessary, involve staff and IT providers to identify relevant systems.
• Identify significant decisions – identify which systems influence decisions about patrons, members or applicants.
• Update the privacy policy – describe the information used and the decisions made.
• Update notices and signage – notify patrons where facial recognition or ID scanning is used.
• Review facial recognition and ID scanning – confirm purpose, access to systems/footage and review of matches and retention periods.
• Keep a person in the loop – ensure important decisions such as refusals, exclusions and membership decisions are reviewed by staff who are authorised to override the system.
• Set rules for staff AI use – adopt an AI policy and identify approved tools/use. 
• Review supplier agreements – check retention, security, overseas processing and use of your data to train AI.
• Plan for incidents – maintain a data breach response plan for when a system gets it wrong.

 Privacy risks and enforcement consequences

The OAIC now has expanded enforcement powers, including infringement notices for certain privacy policy failures, and since June 2025, individuals can sue for serious invasions of privacy.

Key questions for every pub and club board, owner and licensee include:

• Are we clear about the AI tools and systems in use and what decisions we are relying on those tools to make so that we can explain how those affect individuals?
• If we receive a privacy complaint from one of our patrons, members or staff, can we show that we have appropriate controls and oversight in place?
• If a breach occurs, are we able to clearly describe what steps we have taken and the plans that we have in place to respond to it?

How Mullins can help

The new ADM requirements highlight the need for venues to understand how AI and other technology systems use personal information, influence decisions and interact with existing privacy obligations.  If you would like assistance reviewing your privacy policy (which is required as a minimum standard), AI policy or governance framework, supplier arrangements or broader compliance obligations, please contact at anicholson@mullinslawyers.com.au.