Can I trust what it tells me, even about real people?

Still personal information, true or not

There is an argument in circulation that a false statement from an AI assistant about a person is about no one, so no duty attaches to it. The OAIC's guidance answers it twice, from two of its pages. Personal information includes inferred, incorrect or artificially generated information produced by AI models, such as hallucinations and deepfakes, where it is about an identified or reasonably identifiable individual. And, on its definition page, information can be personal information whether or not it is true, and this may include false information generated by an AI system, such as hallucinations or deepfakes.

Why an AI assistant gets things wrong is explained in the OAIC's guidance as well. Generative AI systems are known to produce inaccurate or false results, and generative AI models are probabilistic in nature and do not understand the data they handle or generate. Nothing in the definitions carves out the invented part. An invention about an identified or reasonably identifiable person can still be personal information, and the argument that it is about no one does not survive the two pages.

What to do before you rely on an answer

What to do about it comes from two directions, and they meet in the same act. The warning first: the same OAIC guidance records that AI systems are known to produce inaccurate or false results, and that this risk is especially high with generative AI.

The duty, for a business: under APP 10, the OAIC says organisations have an obligation to take reasonable steps to ensure the personal information collected, used and disclosed is accurate.

And the plainest line of the three, from IP Australia: AI tools can produce information that sounds confident but may not be accurate, and it is important to independently verify any information that an AI tool provides you. For a business, APP 10's reasonable steps and IP Australia's independent verification land on the same moment, before the answer is used for anything.

If a made-up thing is about you

Where a business holds a made-up thing about a person, the correction route is APP 13. The OAIC's APP 13 guidelines say the principle requires an entity to take reasonable steps to correct the personal information it holds, to ensure it is accurate, up-to-date, complete, relevant and not misleading, having regard to the purpose for which it is held.

An entity must take those steps if it is satisfied, having regard to a purpose for which the information is held, that the information is inaccurate, out-of-date, incomplete, irrelevant or misleading, which the guidelines call being incorrect. And the duty is triggered the same way when the individual asks: the entity must take reasonable steps to correct the information to ensure it is not incorrect when the individual requests it.

The duty attaches to information an entity holds, which is what makes the first section on this page matter: an AI invention about a real person, once collected and kept, is personal information the entity holds, and its inaccuracy is the thing APP 13 speaks to.

When the image is of a real person

At the far end of this leg is the image. eSafety's deepfakes guidance gives the definition: a deepfake is a digital photo, video or sound file of a real person that has been created with AI to make an extremely realistic but false depiction of them doing or saying something that they did not actually do or say. They are created using AI software that draws on real photos or recordings of the person to model and produce new content. And the OAIC's definition work covers them in the same breath as any other invented thing about a person, because whether the depiction is true is not the test.

eSafety publishes the advice and the reporting route, and this site does not restate them. One line from its spotting guide is worth carrying, because it is a test a reader can run: if in doubt, remember to question the context, and ask yourself if it is what you would expect that person to say or do, in that place, at that time. The page to read next is eSafety's deepfakes guidance.

This guide runs shorter than the others because its last step is a link by design: what to do about a deepfake of you or someone you know is eSafety's material, and its steps are not rewritten here.