{"resourceId":"byron-shire-council-draft-ai-policy-personal-health-data-ban-20261103","versions":[{"version":"external-6d280da9e959e67ab3909a22ce9f04a34a2d55b0ee1963dd4665ec3b9c29840c","resource":{"id":"byron-shire-council-draft-ai-policy-personal-health-data-ban-20261103","title":"Byron Shire Council, NSW puts a draft AI policy on exhibition that bars entering residents' personal and health information into any AI tool without a privacy assessment or consent","organization":"Byron Shire Council, New South Wales","sector":"Local council governance and privacy","geography":"Byron Shire, New South Wales, Australia","publishedAt":"3 November 2026 UTC (The Echo; 4 November local time)","publicationDate":"2026-11-03","eventDate":"2026-10-15","sourceName":"The Echo (Byron Shire)","sourceLabel":"Independent local reporting","sourceUrl":"https://www.echo.net.au/2026/11/byron-proposes-limits-on-putting-residents-personal-information-into-ai/","evidenceClass":"independent-reporting","outcomeClass":"emerging","topics":["governance-procurement","data-security","operating-model"],"finding":"Byron Shire Council, New South Wales, Australia: The Echo (published 3 November 2026 UTC) reports councillors unanimously endorsed an amended draft AI policy for public exhibition at their 15 October meeting, with submissions listed as closing 17 November. A councillor amendment states that personal and health information must not be entered into, or made accessible to, any AI tool, with exceptions only after a use-specific privacy impact assessment (registered and reported to the Audit, Risk and Improvement Committee) or with the individual's consent. The draft says a named person, not an algorithm, remains accountable for every AI-assisted decision or output; requires human review scaled to risk before AI content is relied on, published or acted on; requires bias assessment before AI is used in processes affecting residents; and handles disclosure via website statements and legal notices rather than per-document labels. A separate safety and security plan would govern approved tools and could be updated without a council resolution. The article notes the documents do not identify which AI tools council uses.","sledRelevance":"Why now: reported 3 November with public submissions open until 17 November. International comparator: a council-level default ban on personal and health data in AI tools, with a reported exception register, is stricter than most U.S. municipal policies; transferability is limited by NSW privacy law.","evidence":"Local news report quoting the council resolution and draft policy; the policy document itself was not opened. No implementation or outcome data.","architectureImplications":"A default ban on personal data in any AI tool, including third-party systems incorporating AI, implies data classification and controls on embedded AI features in council systems.","governanceImplications":"Named human accountability for every AI-assisted output; risk-scaled review; pre-deployment bias assessment; privacy-impact-assessment exceptions registered and reported to the audit and risk committee.","securityPrivacyImplications":"Personal and health information barred from AI tools unless a use-specific privacy impact assessment is approved or the person consents; use must match original collection purpose.","caveats":"Draft on exhibition, not adopted; news report rather than the policy text; Australian legal context limits transfer to U.S. local government.","streamIds":["local-government"],"roles":{"sales":"Framing: an Australian council proposes to bar residents' personal and health information from any AI tool unless a privacy assessment or consent applies. Interpretation: privacy-first councils will ask vendors to show where personal data flows in AI features and how it can be excluded. Sellers should position privacy impact assessment support and data-flow mapping, not AI capability claims, and note this is a draft overseas comparator.","engineering":"Framing: the restriction applies to third-party systems incorporating AI, not only chat tools. Interpretation: pre-sales engineers should be ready to show controls that keep personal data out of embedded AI features, data-classification enforcement, and logs that support an exception register. Limited applicability: NSW privacy law differs from U.S. state law, and the article does not name council tools.","delivery":"Framing: every AI-assisted output must have a named accountable person and risk-scaled human review. Interpretation: delivery should design review workflows, a privacy-impact-assessment exception register reported to the audit committee, and pre-deployment bias checks. Acceptance criteria below are proposals; the policy is on exhibition and no operational results exist."},"roleDetails":{"sales":{"customerProblem":"Councils want AI efficiency without exposing residents' personal and health information.","stakeholders":["Councillors","General manager","Audit, Risk and Improvement Committee","Privacy officer","IT"],"discoveryQuestions":["Which current systems include AI features that touch personal data?","Who approves privacy impact assessments for AI uses?","How will the exception register be reported?","How is human review scaled by risk?"],"valueHypothesis":"Bounded: clearer rules may lower privacy incident risk; no measured outcome reported.","potentialEngagement":"Privacy impact assessment template and data-flow mapping for AI features after adoption.","unsupportedClaims":["That the policy is adopted","That residents' data has been misused (the article says it does not establish this)","Any efficiency gains"]},"engineering":{"fit":"Councils handling sensitive resident data in systems acquiring embedded AI.","architectureIntegration":"Data classification and DLP controls applied to AI features; logging to support exception registers.","prerequisites":["Data inventory and classification","Privacy impact assessment process","List of AI-enabled systems"],"constraints":["NSW privacy legislation","Draft subject to public submissions","Technical plan can change without council resolution"],"security":"Default exclusion of personal and health data from AI tools; purpose limitation on any approved exception.","proofOfValue":["Test that personal data fields cannot reach AI features without approved exception","Verify exception register entries match approved assessments"]},"delivery":{"work":"Implement review workflow, exception register and bias assessment step after adoption.","dependencies":["Council adoption","Privacy officer capacity","Vendor disclosure of AI features"],"ownership":"Council executive, with the Audit, Risk and Improvement Committee overseeing exceptions.","skillsAdoption":"Staff need training on what counts as personal or health information and how to request an exception.","governanceCheckpoints":["Close of public submissions","Council adoption vote","Periodic exception register reporting"],"acceptanceCriteria":["Proposed: every AI exception has an approved privacy impact assessment on the register","Proposed: register reported to the audit committee each reporting cycle","Proposed: bias assessment completed before any resident-facing AI deployment"],"risks":["Broad ban may push staff to unsanctioned tools","Embedded vendor AI may process personal data unnoticed","Disclosure via website statements may be missed by residents"]}},"retrievedAt":"2026-11-04T04:13:51.588Z","enrichedAt":"2026-11-04T04:16:31.751Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Use must demonstrably improve services, efficiency or accessibility; responsibility for AI-assisted work stays with named staff.","procurementImplications":"Policy covers contractors, consultants and third-party systems incorporating AI, so vendor products with embedded AI fall under the data restriction.","operatingModelImplications":"Technical controls in a separate safety and security plan can change without a council resolution, separating policy principles from operational rules.","sourceVerification":{"openedUrl":"https://www.echo.net.au/2026/11/byron-proposes-limits-on-putting-residents-personal-information-into-ai/","referenceExcerpt":"Personal and health information must not be entered into, or made accessible to, any AI tool","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}