Regulating Personal Data in the Age of Artificial Intelligence: A Comparative and Critical Analysis of Privacy, Accountability and Digital Governance in the United Kingdom and Australia

Abstract

Artificial intelligence (AI) systems now make use of personal data to predict, classify and decide things like access to jobs, credit and public services. This article poses the question of whether the data protection legislation of the United Kingdom (UK) and Australia is open to any real challenge to such decisions. It uses doctrinal and functional legislative and case law comparison, regulatory decisions, official reports and scholarship, and states the law as of October 2026. It creates a contestable accountability mechanism to determine if the law connects lawful data usage, advanced risk assessment, notice at the decision-making level, intelligible reasons, effective human oversight, auditable data records and accessible redress. In the UK, since the Data (Use and Access) Act 2025 came into effect in February 2026, it is possible to make important decisions based solely on automated processing of non-special category data, as long as there are safeguards in place to ensure that information is represented, contested and that humans are involved. Australia's privacy laws are principles based. There is no general right to reasons or human review of a particular decision from 10 December 2026, the privacy policy is required to describe certain automated decisions. The new statutory privacy tort does not fill this gap but provides a remedy. Both systems are incomplete with respect to the framework. The UK does not have a clear right to personalised reasons and has lowered its threshold for automation. Australia has no decision level rights or a general obligation to review high-risk processing. The article proposes targeted reforms which are suitable to each legal tradition.