WA’s privacy law protects data that isn’t even “personal”. And it is watching your AI.

Think de-identified data is out of scope? Think your AI tool sits in a grey area? In WA, from today, neither is true.

Most privacy regimes protect “personal information” and stop there. WA’s new Act goes further in two ways that matter for data-heavy organisations.

First, it extends protection to de-identified information, requiring reasonable steps to guard it against misuse, loss and unauthorised re-identification. For universities running research, data linkage and analytics, information you treated as out of scope may now carry obligations. Second, the Act brings automated decision-making into scope and defines personal information broadly, capturing information that “relates to” a person, including location data and inferences about behaviour or preferences.

For any WA Agency or university deploying AI, a decision an algorithm shapes is now a privacy question, not only a technology one. Map where you rely on de-identified datasets or automated decisions, and assess each against the Act. Tools that keep data onshore and out of model training make that assessment shorter.

This article is part of a short-read series collaboration by Nguma Pty Ltd and Onpoint 365 on Australian Government hiring.

AI interview management and transcription built for Australian Government compliance.