Service agreements and AI data leakage: what a migration agent’s fee agreement gives away in ChatGPT or Claude.

The service agreement is the first document a registered migration agent signs with a client, and the Code of Conduct says what it must contain: the client’s name, date of birth, email and residential address, the agent’s MARN, the work to be done, how the file is handled and the fees. Staff paste it into ChatGPT or Claude to check the wording or turn it into a fee estimate email. This page marks every item in a routine service agreement that the Code of Conduct and the Privacy Act bear on, including the AI consent clause, and shows how the same agreement is handled on Ermos inside the practice.

The service agreement and fee estimate

Signed before any immigration assistance is given. Section 42 of the Code of Conduct requires a written service agreement signed by the client and the agent, covering the work, with the matters in section 42(3) and Division 3 (fees and disbursements) included. Section 43 allows advice at an initial consultation without one.

An invented service agreement. The MARN is a placeholder and the practice, agent and client do not exist. The fees are the invented practice’s. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

1. 1
   The client’s identity block

   Name, date of birth, email and residential address, the details section 42(3) of the Code requires in every service agreement. Personal information, and the key that ties everything else on the file to one real person. Privacy Act guide.

2. 2
   The agent’s name, MARN and contact details

   The Code requires them in the agreement. They are details a practice shows to attract clients, so this item adds little exposure on its own.

3. 3
   The visa strategy and the expiry date

   What the client is trying to achieve and the date her current visa ends. Her whole risk in one line, and the work the practice is being paid to do. Privacy Act guide.

4. 4
   Fixed fees, by stage

   Section 46 of the Code requires a fixed fee or an hourly rate with an estimate, including GST, and says it must be fair and reasonable. Commercial information about the practice and about what this client agreed to pay.

5. 5
   The AI consent clause and the box ticked

   OMARA’s AI guidance says an agent needs the client’s written consent before entering personal details into an AI platform. The clause records the consent, but it says nothing about where the data goes once it is entered. Privacy Act guide.

6. 6
   Standard terms: disbursements, consumer guide and file handling

   Template wording that sections 38, 42(3)(e), 47 and 54 of the Code require in substance, with no client data in it. The same text appears in every agreement the practice signs.

7. 7
   Signatures and signing dates

   Who signed and when. A signed record the practice must keep on the client file for 7 years under section 56 of the Code.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in migration practices.

Common questions