Record STMT-W8D637DAdvisory

Use of publicly available Generative AI tools in the Victorian public sector

Guidelines State lawOceania · AUin force

This guidance outlines the Office of the Victorian Information Commissioner’s position on the use of publicly available Generative AI tools within Victorian public sector organisations. It mandates that staff and contractors must not enter personal information into these tools, as doing so violates Information Privacy Principles under Victorian law. The document details various privacy, security, and accuracy risks and sets minimum expectations for public sector organisations considering generative AI use.

Summary and content fields are drawn from the document text and are pending editorial review.

Who issued it

Office of the Victorian Information CommissionerRegulator · AU

Lead issuer

Legal forceAdvisory

Under whose authorityState law

Judged fromfull text

Who it governs

Public sector bodiesRegulatorsWorkers

Victorian public sector personnel and organisations who need to understand privacy and security obligations regarding generative AI tools.

Sectors

Public administration · Victorian public sector organisationsEducation · public schools

What the document contains

What's covered

The document addresses the risks and compliance obligations associated with using publicly available generative AI tools in the Victorian public sector, specifically regarding personal information privacy, data security, accuracy, retention, and decision-making fairness.

What's missing

It does not provide technical specifications for AI model development, nor does it cover enterprise-level AI procurement beyond referencing separate guidance.

Key takeaways

Victorian public sector personnel must not enter personal information into publicly available Generative AI tools.
Entering personal information into third-party AI tools can breach Information Privacy Principles and Victorian data protection laws.
Outputs generated by AI that contain personal information are treated as a new collection of personal information and must be handled accordingly.
Public sector information entered into tools should be limited to information already publicly known or approved for release.
Organisations must conduct security risk assessments, review terms and conditions, and train staff before permitting AI use.

Outline

· Personal information and publicly available Generative AI tools
· Public sector information and publicly available Generative AI tools
· Risks of using publicly available Generative AI tools
· OVIC’s minimum expectations
· Scenarios

IssuedJune 2026

Length2,798 words

FormatNot recorded

Scopesubnational

How it scores

Pending review

Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.

Accountability

3/5

Clear responsibility for AI outcomes

VPS organisations should ensure their staff, contracted service providers and other personnel do not enter personal information into publicly available Generative AI tools.

Personal information and publicly available Generative AI tools

screening score · 2026-10-23

Fairness

3/5

Non-discrimination and equitable treatment

Publicly available Generative AI tools should not be used to formulate decisions, undertake assessments, or for other administrative functions that may have consequences for individuals.

Risks of using publicly available Generative AI tools

screening score · 2026-10-23

Human Dignity

1/5

Respect for the inherent worth of persons

may cause significant harm to individuals whose information is used in publicly available Generative AI tools.

Personal information and publicly available Generative AI tools

screening score · 2026-10-23

Human Oversight

3/5

Humans remain in control of consequential decisions

require their staff, contracted service providers and other personnel to check the accuracy of generated content before using it

OVIC’s minimum expectations

screening score · 2026-10-23

Privacy

4/5

Protection of personal data and private life

Doing so will likely be a contravention of the Information Privacy Principles (IPPs) in the Privacy and Data Protection Act 2014

Personal information and publicly available Generative AI tools

screening score · 2026-10-23

Transparency

2/5

Openness about how AI systems work and are used

develop organisational policies on the use of Generative AI tools, and communicate about the policies to staff, contracted service providers and other personnel

OVIC’s minimum expectations

screening score · 2026-10-23

Enforcement

3/5

Consequences and compliance mechanisms with real force

notify OVIC if personal information or public sector information that is not already publicly known or approved for public release has been used with a publicly available Generative AI tool.

OVIC’s minimum expectations

screening score · 2026-10-23

Impact Assessment

4/5

Required assessment of an AI system's risks/impacts before or during use

conduct security risk assessments before use, in accordance with their risk management framework to ensure that any risks are identified, assessed, treated and monitored accordingly

OVIC’s minimum expectations

screening score · 2026-10-23

Topics

generative_ai information_privacy public_sector data_security artificial_intelligence