WTF is this?!
This is a summary of Guidance on privacy and developing and training generative AI models, published by the Office of the Australian Information Commissioner, Australian Government, on Monday 21 October 2024.
What
Guidance for Australian entities on how Australia’s privacy laws apply to AI.
Who
Office of the Australian Information Commissioner (OAIC)
When
Published: Monday 21 October 2024
Where
Online: on the OIAC website
Why
To set out OAIC’s expectations in relation to privacy on Australian entities developing or deploying AI.
How
Outlining compliance and best practice for handling privacy in AI systems.
What else
OAIC also published companion guidance for deployers of AI systems.
Summary
Australian developers of AI who are training or fine tuning AI models that include personal information need to be aware of and mindful that they have obligations under the Privacy Act 1988 (Cth) (Privacy Act), including the Australian Privacy Principles (APP). The guidance is for AI developers who are subject to the Privacy Act (i.e. APP entities and foreign organisations with an Australian link). This includes “any organisation who designs, builds, trains, adapts or combines AI models and applications. This includes adapting through fine-tuning, which refers to modifying a trained AI model (developed by them or someone else) with a smaller, targeted fine-tuning dataset to adapt it to suit more specialised use cases” [OAIC, 2024]. Even though it specifically references generative AI, “a number of the risks and issues discussed are also applicable to narrow AI systems or models that are trained using personal information.” The guidance is also useful to organisations that provide personal information to an AI developer so they can develop or fine-tune a generative AI model.
AI is data hungry – “... the data-driven nature of AI technologies, which rely on large datasets that often include personal information, can also create new specific privacy risks, amplify existing risks and lead to serious harms” [OAIC, 2024]. It is important that AI developers work to protect privacy.
The guidance is also focused on APPs 1, 3, 4, 6 and 10 as they relate to planning and designing generative AI and compiling the training data for it, or fine-tuning an AI model. Other privacy obligations may also exist in relation to other APPs.