Andrew Hii

Regulatory signal: APRA is moving from implementation to demonstrable resilience - with deeper supervision of cyber, AI, critical operations, common technology platforms and material service providers.

From 10 December 2026, privacy policies will be required to include additional information about how they use personal information in any automated decision-making tools or processes.

The Competition and Consumer Amendment (Unfair Trading Practices) Act 2026 (Cth) (the Act) passed both Houses of Parliament on 2 July 2026 and received royal assent on 6 July 2026. From 1 July 2027, when the Act comes into effect, the Austr…

On 16 July, the Commonwealth Attorney-General’s Department announced measures the Australian Government is planning to introduce to strengthen Australia’s modern slavery laws.

Australia has become a key destination for data centre developers, investors and operators seeking exposure to long-term digital infrastructure growth.

Australian regulators have substantially increased their rhetoric on how regulated entities and their boards are expected to govern AI-related risk.

This article highlights some mechanisms that can be adopted to mitigate the risks to your business from IT vendor insolvency under Australian law.

The Privacy Commissioner’s IRE decision reshapes data minimisation, dark patterns and fairness obligations for digital platforms collecting data. Visit Gilbert + Tobin for more.

The final report on the independent review into the Security of Critical Infrastructure Act 2018 (SOCI Act), conducted by Dr Jill Slay AM, was delivered on 2 February 2026 and was subsequently made public on 25 March 2026 (the Report). The …

The OAIC’s exposure draft Children’s Online Privacy Code foreshadows more prescriptive, higher-standard obligations for online services handling children’s personal information, signalling a major shift in privacy compliance and potential f…

At Australian Healthcare Week 2026, Andrew Hii joined industry leaders to examine the practical realities of applied AI in healthcare. The focus was on what is already delivering impact and what must be in place for AI to scale safely. Read…

On Monday, the Australian Government published its Expectations of Data Centres and AI Infrastructure Developers. The expectations set out the government's position on what it expects from the sector. They effectively codify the social lice…

ART overturns Privacy Commissioner, holding Bunnings’ facial recognition use was permitted under the Privacy Act, with lessons for business. Read more at Gilbert + Tobin.

Government finds Australian Consumer Law fit for AI – no overhaul needed, only minor updates and guidance to clarify how ACL applies to AI-enabled goods and services. Find out more at Gilbert + Tobin.

On 31 October 2024, we hosted our inaugural Financial Services Forum for clients, showcasing insightful presentations and discussions on current and emerging regulatory issues in financial services.

In early June, the Attorney-General tabled a bill in Parliament to strengthen laws targeting the creation and non-consensual dissemination of sexually explicit material online, including material created or altered using generative AI, incl…

It is a basic rule of contract law that if you sign a contract you are bound by the terms of the contract whether you have read them or not: Toll (FGCT) Pty Ltd v Alphapharm Pty Ltd (2004) 219 CLR 165, [2004] HCA 52.

The recent incident involving fake explicit images of singer Taylor Swift has brought the challenge of ‘deepfakes’ once again into the mainstream. The incident, along with a second, lesser-known “deepfake” debacle fo…

On 30 November 2023, the Modern Slavery Amendment (Australian Anti-Slavery Commissioner) Bill 2023 (the Bill) was introduced (and had its second reading) in the House of Representatives.

At common law, contracting parties generally have freedom to determine which country’s laws apply to a contract, as well as limiting the types of claims which may be brought and forums for disputes.

So asks a recent study by two academics from Stanford Law School, David Freeman Engstrom and Nora Freeman Engstrom, on the potential impact of AI on the civil litigation landscape in the US.

In April 2022, the European Commission (EC) requested the European Union Agency for Cybersecurity (ENISA) to add sovereignty requirements for cloud service providers into the draft Cybersecurity Certification Scheme for Cloud Services (EUCS…

By 2024, it is predicted that 60% of data used to train artificial intelligence systems globally will be synthetic: i.e. artificially-generated data created using generative AI. In a recent article, two legal academics, Michal S Gal and Orl…

We discuss the recent Supporting Responsible AI Discussion Paper on AI Regulation in Australia, what is so unique about AI?, how to approach regulating AI, and key focus areas.

The review of Australia's Modern Slavery Act 2018 reveals varied opinions on its effectiveness. Key recommendations include lowering the reporting threshold to $50m, introducing new criteria, establishing an Anti-Slavery Commissioner, and i…

Readers of the Australian Financial Review may have read with interest James Thomson’s Chanticleer column on May 3.  For those that missed it, the article concerned Chegg Inc, a NYSE-listed company. Chegg provides online services…

We break down the 2023-2024 Federal Budget, outline the Superannuation changes, the answer to the Cost-of-Living, the Tax changes to Business, and more.

From 10 November 2023 Australia’s unfair contract terms (UCT) regime will apply to a much, much larger pool of contracts than it has in the past. Businesses that might previously have been comfortable that the UCT regime did not affec…

You wake up in the morning and think about having bagels for breakfast. As soon as you visualise the bagels in your head, your mobile sends you a notification: ‘craving detected: there’s a local cafe selling your favourite salmo…

When we last wrote about deepfakes in 2019 they had just started to capture the public’s imagination. Jordan Peele’s viral deepfake of Barack Obama, which intended to caution against the inherent political risks of the technolog…

The Pew Research Center recently surveyed 25,000 adults across 19 advanced economies in North America, Europe, the Middle East and the Asia-Pacific region on their views of the impact of social media on democracy in their country.

In this article we look at the Discussion Paper released on Australian Cyber Security Strategy.

Following a period of consultation at the end of 2022, the Security of Critical Infrastructure Rules have now been registered under the Security of Critical Infrastructure Act 2018 (Cth).

In this article we explore the key highlights of the Privacy Act Report.

We outline the Australian Digital Health market overview, transactional issues, legal & regulatory framework, data protection, IP, marketing, payment, coronavirus + more.

Last year, OECD member countries adopted an intergovernmental agreement setting out their shared principles for government access to personal data held by private entities. The OECD Declaration documents principles and safeguards, drawn fro…

In early 2023, computer science student, Edward Tian, from Princeton University developed the GPTZero app to analyse the likelihood that a passage of text is written by AI.

Neurotechnology refers to any technology that provides greater insight into, or control over, the activity of the brain or nervous system. An example of currently available neurotechnology is brain-computer interfaces.

The Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 (Bill) has now passed both Houses of Parliament and will become law imminently, commencing the day after it receives Royal Assent. The Attorney-General tabled…

As science fiction increasingly becomes a reality, outer space is the next frontier in legal and governance policymaking. In this article, we review recent developments in the space industry, the international regulation of space, Australia…

We look at law reforms and harsher penalties surrounding ransomware attacks and explain if outcomes will change for Australian businesses.

Online hate speech is a deeply complex and contentious challenge to effectively respond to. Lawyers, Bryce Craig and Rocky Lagudi, discuss this issue and explore how moving beyond conventional detection and removal approaches may yield prod…

New licence conditions require carriers and CSPs to report cyber incidents and asset information, creating complex compliance duties. Read more at Gilbert + Tobin.

We discuss how the use of artificial intelligence and blockchain technology can be used to decarbonise the energy sector.

After a long and circuitous journey, on 31 March 2022 Parliament passed the Security Legislation Amendment (Critical Infrastructure Protection) Act 2022 (SLACIP Act), which implements the final package of amendments to the existing Security…

The Corporations Amendment (Meetings and Documents) Bill 2021 has permanently allowed electronic and split execution under sections 126 and 127, we explain.

Australia’s critical infrastructure laws expand again with new asset definitions, draft application rules and Bills strengthening cyber and transport security.

We outline the new Security of Critical Infrastructure Act (SOCI) reforms and what your business needs to know.

We outline the draft Trusted Digital Identity Bill 2021 which aims to improve the way Australians are able to verify their identity when accessing online services.

We discuss employers obligation to provide a safe place of work for their staff and visitors and if they should require employees to be vaccinated.

Sweeping changes in modern communication do not warrant relaxing the strictness of the common law regarding the publication of defamatory material. So the High Court has found, in a decision that should make all organisations hosting or fac…

Electronic execution and split execution of documents under section 127 of the Corporations Act 2001 (Cth), will again be permitted. We take you through the latest amendments of the Bill

We outline the definition of Ransomeware and its impacts, discuss whether paying for ransomware should be illegal or not & how companies can protect themselves.

A fundamental function of any government is to provide for the safety and wellbeing of its citizens. While we commonly think of law enforcement, emergency services and public healthcare as the primary tools used by governments to meet this …

Remote witnessing and attestation laws have been updated again. We outline the new regulations facilitating remote witnessing & electronic signature attestation.

This Gilbert + Tobin insight explores how private companies are a step closer to being able to seek accreditation to join the Australian Government’s digital identity scheme, ‘GovPass’.

The Federal Court of Australia recently found in Luppino v Fisher that a mobile phone should not be treated as a “computer” or a “data storage device”.