De-identified data and AI: what the I-MED decision means for privacy compliance

A recent OAIC decision provides useful guidance for businesses on techniques for de-identifying personal information - especially for the purpose of training AI models. Importantly, good governance and planning for privacy is vital when commencing a new initiative involving new technology.

The Office of the Australian Information Commissioner (OAIC) recently concluded its preliminary inquiries into I-MED Radiology Network Limited's (I-MED) disclosure of de-identified patient data to Annalise.ai without taking regulatory action. I-MED had been sharing the de-identified patient data without patient consent or providing notice to train an AI model for diagnostic imaging.

The OAIC found that the data was sufficiently de-identified and no longer constituted 'personal information' under the Privacy Act 1988 (Cth) (Privacy Act).