Loyalty programs using personal data for automated decision-making (ADM) must disclose this in their privacy policy. ADM has been prioritised for the new privacy legislation (one of 30 issues included with others deferred). Non-compliance will risk fines including administrative breaches with fines up to $330,000 and a mid-tier level of fines at over $3 million.