Tracking pixels have become a standard part of digital marketing, but many organisations don't understand what information they're collecting or where it's going. Here's what the OAIC's latest guidance means for businesses and why privacy should be treated as a business decision, not just a technical one.

Cloud Contact Centre as a Service (CCaaS) has become a core part of how organisations in New Zealand interact with customers, bringing together voice, messaging, and digital channels into a single cloud environment. Increasingly, these platforms are powered by artificial intelligence, which promises efficiency and improved customer experience. At the same time, AI introduces a different class of privacy risk, one that is less about simply holding information, and more about continuously analysing, inferring, and reshaping it in ways that are often invisible to the individual.

AI note-takers arrive as something deceptively simple: tools that listen, transcribe, and organize. They promise clarity, efficiency, a kind of external memory that doesn’t tire or drift. But in doing so, they don’t just capture words, they capture voices. A voice is not just data, it can also be biometric information. That distinction matters more than it first appears.

Australia has introduced new transparency rules for organisations that rely on these Automated Decision Making (ADM) technologies. From 10 December 2026, the Privacy Act will require organisations to explain their use of ADM when those decisions significantly affect the rights and interests of an individual.

It’s common practice for employers to take photos of staff during the course of their employment. These photos may be used for training materials, internal communications, team events, or external promotion such as recruitment campaigns and marketing content.

Employee browsing or the unauthorised access and misuse of personal information is one of the most common privacy breaches according to the Privacy Commissioner. Whether it’s curiosity, misplaced helpfulness, or something more malicious, unauthorised access to personal information continues to crop up in headlines.