Changes to the Privacy Act commence on 10 December 2026, which will require retirement village operators and aged care providers to review their use of AI or other automated decision-making (ADM) systems. and update their privacy policies, where those systems help make or contribute to decisions which may significantly affect an individual’s rights or interests.
Critically, operators and providers should not treat these changes as just a requirement to update their privacy policy. They require a proper assessment and transparency about the use of AI systems or tools that handle personal information. As you can’t disclose what you don’t understand, it will be necessary for operators and providers to be clear about and able to explain in simple terms:
- What technology is being used to make automated decisions.
- Where it is used and relied on by the organisation.
- How those decisions may affect the rights of residents, clients, their families and staff.
Most retirement villages and aged care providers use more automated decision-making technology than they realise. From AI tools such as ChatGPT, Copilot and Claude to systems that manage applications and admissions, care and services, rostering, security and resident monitoring, these technologies are increasingly embedded in everyday operations. Operators and providers should understand which technologies they use, what personal information they rely on, which decisions they influence, and what safeguards are in place.
This is particularly important for retirement villages and aged care providers because decisions involving residents often involve sensitive health information under the Privacy Act.
What changes in 10 December 2026?
From 10 December, a privacy policy must explain when the organisation uses a computer program to make, or do something related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests. The policy must describe the personal information used and the decisions involved.
The obligation is directed at, but not limited to, the use of AI.
Many retirement villages and aged care providers already use automated decision-making technologies without realising they may be captured by the new privacy rules, including:
- AI tools used to prepare or summarise board papers or to record/summarise meetings;
- software used to assess or prioritise prospective residents or clients;
- systems used to allocate or prioritise services or resources;
- security swipe cards or location data for residents;
- health monitoring or falls identification devices for residents;
- AI-assisted recruitment and employee performance systems;
- facial recognition, CCTV and other security technologies;
- systems that identify unusual activity, fraud or security risks;
- software used to analyse resident or customer information;
- automated customer service and enquiry systems;
- AI tools used by employees to prepare correspondence, reports or other documents; and
- AI functionality incorporated into existing care, administration or management platforms.
Facial recognition, CCTV and security technologies
Facial recognition, CCTV and other security technologies are increasingly used in retirement villages and residential aged care to manage access, monitor common areas and protect residents and staff.
A duty of care or a legitimate safety purpose does not remove the obligation to be transparent about the technology. The Office of the Australian Information Commissioner (OAIC) has made clear that privacy policies must describe specific uses of facial recognition, not simply refer to CCTV.
The Administrative Review Tribunal’s decision on Bunnings’ use of facial recognition (February 2026) reminds us that how the technology is used, explained, and governed matters as much as whether it is used at all.
Health monitoring, falls detection and location data
As technology becomes more integrated into care delivery, operators should ensure residents and their representatives understand how monitoring technologies work, what information is collected, and how that information may be used to support care outcomes and safety.
Health monitoring and falls identification devices, security swipe cards and location tracking can deliver real benefits for residents. They also generate a continuous stream of personal and often sensitive information, and may trigger decisions about a resident’s care, services, independence, or living arrangements. Operators and providers should be able to explain what each device or system collects, who sees it, how alerts are acted on, and whether residents (or their representatives) have been told about it and, where required, have consented.
Why human oversight matters
It does not matter that a staff member makes the final call. What’s important is whether a system materially influenced the outcome, and whether the operator or provider has real human oversight.
A recent incident serves as a reminder. In June 2026, an AI agent researching Australian health information accessed non-public files on a Services Australia Medicare statistics portal. Individual Medicare records were not accessed, but the incident showed an AI agent can move beyond its intended task. Operators and providers need controls over not only how staff use AI, but what AI tools connected to resident, client, care, health or security systems can access and do.
A governance issue for boards, owners and management
This is not solely an IT issue. For not-for-profit and community-based providers, directors’ duties require visibility into how technology affects residents and clients; for private operators and provider groups, the same responsibility sits with boards, owners and management. Boards should be able to answer:
- Where are automated systems used across our villages, facilities and services, including inside existing software?
- Which of them make or influence decisions about residents, clients, prospective residents or job applicants?
- Are we using facial recognition, biometric, location or health monitoring technology, and why?
- What do our supplier agreements say about how they will use AI? Are suppliers using our data to train their own AI, and is that securely/confidentially maintained?
- Who reviews significant decisions, and who is responsible for monitoring AI use?
What should operators and providers do now?
An AI policy is a good start but will not manage the risk by itself. Before 10 December, retirement village operators and aged care providers should:
- Map the technology – identify the platforms in use and, where necessary, involve staff, care teams and IT providers to identify relevant systems.
- Identify significant decisions – identify which systems influence decisions about residents, clients, prospective residents or applicants, including admissions, service allocation and care.
- Update the privacy policy – describe the information used and the decisions made.
- Update notices and signage – notify residents, clients and visitors where facial recognition, CCTV, location tracking or monitoring devices are used.
- Review security and monitoring technology – for facial recognition, CCTV, swipe cards, location data and health or falls monitoring devices, confirm purpose, consent, access to systems/footage, review of alerts and matches, and retention periods.
- Keep a person in the loop – ensure important decisions such as admissions, prioritisation of services, changes to care and refusals are reviewed by staff who are authorised to override the system.
- Set rules for staff AI use – adopt an AI policy and identify approved tools/use, including for preparing correspondence, reports and board papers.
- Review supplier agreements – check retention, security, overseas processing and use of your data to train AI.
- Plan for incidents – maintain a data breach response plan for when a system gets it wrong.
Privacy risks and enforcement consequences
The OAIC now has expanded enforcement powers, including infringement notices for certain privacy policy failures, and since June 2025, individuals can sue for serious invasions of privacy.
Key questions for every retirement village and aged care board, owner and senior manager include:
- Are we clear about the AI tools and systems in use and what decisions we are relying on those tools to make, so that we can explain how those affect individuals?
- If we receive a privacy complaint from a resident, client, family member or staff member, can we show that we have appropriate controls and oversight in place?
- If a breach occurs, are we able to clearly describe what steps we have taken and the plans that we have in place to respond to it?
- Are our governance frameworks sufficient to oversee AI and technology systems that affect resident safety, care outcomes and service delivery?
Preparing for the new privacy rules
The new ADM requirements highlight the need for retirement village operators and aged care providers to understand how AI and other technology systems use personal information, influence decisions, and interact with existing privacy obligations.
The changes are less than two months from implementation.
Operators should be urgently mapping and assessing their use of AI and ADM technologies and governance frameworks so they can be clear and transparent in informing residents, families and other stakeholders how those tools are being used to make, contribute to or influence decisions which may affect their interests.
How Mullins can help
If you would like assistance reviewing your privacy policy (which is required as a minimum standard), AI policy or governance framework, supplier arrangements or broader compliance obligations, please contact Andrew Nicholson at anicholson@mullinslawyers.com.au.
