Share on LinkedInShare on LinkedIn

ARTICLE · 15 NOVEMBER 2025

Penalties Awarded For Breach Of The Privacy Act

Barry Nilsson
Explore more from Barry Nilsson

This case highlights the importance of APP entities being aware of their obligations when it comes to matters of cyber security.

AustraliaTechnology
Michael Chen
Michael Chen
Author LinkedIn connections

The first civil penalty proceeding brought by the Australian Information Commissioner for alleged breaches of the Privacy Act 1988 (Cth) has resulted in the Federal Court determining the aggregate pecuniary penalty of $5.8M fell within the permissible range.

In issue

  • Whether the respondent had contravened s13G(a) of the Privacy Act 1988 (Cth) (the Act) by failing to take reasonable steps to protect personal information from unauthorised access or disclosure.
  • Whether the respondent had contravened s13G(a) by breaching s26WH(2) of the Act by failing to conduct a reasonable and expeditious assessment of whether there were reasonable grounds to believe that the Medlab Cyberattack amounted to an eligible data breach.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

APRA v Bedingo And Adelaide Bank: A Wake-up Call For Directors And Officers

The Australian Prudential and Regulatory Authority has launched unprecedented civil penalty proceedings against Bendigo and Adelaide Bank following a 2023 cybersecurity breach that exposed critical weaknesses in the bank's risk management systems. This landmark case signals a fundamental shift in regulatory enforcement, extending accountability beyond corporate entities to individual directors and officers who fail to ensure adequate cybersecurity controls are functioning as intended.
AustraliaTechnology
Kennedys
Kennedys
Article

ASIC Demands Urgent Cyber Upgrades To Combat Frontier AI Security Threats

In an open letter published on 8 May 2026, ASIC, who are responsible for regulating Australia's corporate, financial services and insurance sectors, urged Australian financial services licence (AFSL) holders to act promptly against the risks posed by advanced AI systems. ASIC warned that malicious actors are increasingly using cutting-edge AI models to identify and exploit vulnerabilities at an unprecedented scale.
AustraliaTechnology
Kennedys
Kennedys
Article

South Australian Royal Commission Into Artificial Intelligence: What Businesses Need To Know Now

South Australia has announced a Royal Commission into Artificial Intelligence, set to commence in October 2026 and deliver findings by July 2027. The inquiry will examine AI's economic and social impacts across policy, education, public services, workforce transformation, and infrastructure. Businesses using or developing AI should prepare for potential regulatory reforms and consider engaging with the inquiry process.
AustraliaTechnology
Piper Alderman
Piper Alderman