Optus: When does a data breach lead to a breach of law?

The details of the recent Optus data breach are unfolding by the minute, and any recount of the incident provided here may be quickly overtaken by events.

Safe to say, millions of personal information records were compromised last week by a malicious actor and the facts surrounding the incident and liability of Optus and/or its personnel will be the subject of debate for months to come.

The incident raises the more general question – when does a data breach or hack lead to a breach of the Privacy Act or other laws? Many people would not realise that a company whose database is hacked is not automatically in breach of the law.

Here are some of the factors relevant to whether a data breach may lead to a breach of the law, and with that liability for fines of up to $2.22 million for corporations for serious or repeated interference with privacy.