Before you put an AI tool in front of candidates, you need to be able to explain how it handles their personal information. This guide covers the questions to ask about AI interviews and the Privacy Act in Australia.
This article is general information, not legal advice. Laws and guidance change, so confirm your obligations with a privacy lawyer or the Office of the Australian Information Commissioner (OAIC).
Why this matters now
Many Australian employers are covered by the Privacy Act 1988 and the Australian Privacy Principles (APPs). Recruitment collects a lot of personal information: answers, contact details, CVs, sometimes a photo. If the information is held or processed by a vendor, you still need to be able to answer for it.
There is also a change on the horizon. Reforms passed in late 2024 introduced transparency requirements for certain automated decisions that significantly affect individuals, with the relevant provisions due to start in December 2026. Check the current OAIC guidance and your own privacy policy well before then.
Seven questions to ask any AI interview vendor
1. What personal information is collected, exactly?
Ask for a list: answers, transcripts, contact details, CV text, any image, device or timing signals. Collect only what you need.
2. How are candidates told?
Candidates should see, before they start, how the interview is assessed, who reads it, and what is kept. In Critical Hive the welcome screen explains this, asks for consent, and offers a human interview instead.
3. Who makes the decision?
If a person makes every decision and the tool only assists, your risk profile is different from a tool that screens people out automatically. Ours never rejects anyone on its own.
4. Where is the data held, and who are the sub-processors?
Ask which cloud, which AI provider, which email provider. Your privacy policy should name categories of recipients, and overseas disclosure has its own rules (APP 8).
5. How long is data kept, and can you delete it?
Look for configurable retention, a preview of what will be deleted, a legal hold for individual candidates, and deletion on request. These are built into Critical Hive's data retention controls.
6. Is there an audit trail?
You should be able to export who did what and when, including every decision.
7. What happens to sensitive data like images?
If a tool captures a selfie or ID, ask who can see it, how long it is kept, and why it is needed. Treat identity images as sensitive and minimise them.
A short checklist for your own policy
- Update your privacy policy and recruitment notices to describe AI-assisted screening in plain language.
- Document the human decision step.
- Decide a retention period and set it in the tool.
- Record the vendor and its sub-processors in your register.
- Train recruiters to handle access and deletion requests.
What Critical Hive does (and does not) claim
We provide retention controls, an audit log, role-based access, two-step verification, and a compliance pack that helps you evidence human oversight. We do not claim that using the tool makes you compliant, and we do not give legal advice.
FAQ
Do I need candidate consent to use an AI interview?
Consent is one basis among several and the right approach depends on your circumstances. At minimum, be transparent about collection and use, and give candidates a choice such as a human interview. Ask your lawyer.
Can candidates ask for their data to be deleted?
They can ask. You need a process, and the tool should make deletion practical. Retention rules and legal holds still apply.
Is an AI interview an "automated decision"?
It depends on what the tool does and how it is used. If a person reviews the evidence and makes the decision, the analysis is different from a tool that decides alone. Document your process.
Next step
Read how we approach compliance and fairness, or download the presentation for the security and data-handling slides.