#
Well-resourced, increasingly assertive enforcement with escalating penalties, multiple concurrent major proceedings, and new private/collective redress avenues, tempered by acknowledged case-backlog capacity constraints.
Sub-modules (6)
Regulator Powers And PenaltiesGreen
Tiered civil penalty regime: up to $50M (s13G, serious/repeated) and up to $660,000 (s13H, new mid-tier).
Claims (2):
- Since amendments effective December 2022, the maximum civil penalty for a body corporate's serious or repeated interference with privacy under s13G is the greater of $50 million, three times the value of the benefit obtained, or 30% of the entity's adjusted turnover during the breach period.
- The Privacy and Other Legislation Amendment Act 2024 introduced a new mid-tier civil penalty under s13H for interferences with privacy that do not meet the 'serious' threshold, capped at 2,000 penalty units (AUD 660,000).
Enforcement Activity IndexGreen
Record 2025 NDB notifications; first civil penalty (ACL); ongoing Optus/Medibank proceedings; new CIIs into rentaltech, connected cars, tracking pixels.
Claims (3):
- In its first civil-penalty judgment under the Privacy Act, the Federal Court ordered Australian Clinical Labs to pay $5.8 million for privacy breaches connected to its February 2022 Medlab Pathology data breach affecting over 223,000 individuals.
- The OAIC received a record 1,205 data breach notifications in the 2025 calendar year, an 8% increase over 2024's 1,112 notifications and the highest annual total since the NDB scheme commenced in 2018.
- As of early 2026 the OAIC intended to continue civil-penalty proceedings against Optus and Medibank through the year, alongside Commissioner-initiated investigations into rental-technology platforms, connected cars and tracking pixels.
Regulator Funding And CapacityAmber
Dedicated Children's Code funding (AUD3M/3yrs) but acknowledged general complaint-handling backlog in 2026.
Claims (2):
- The OAIC was allocated AUD 3 million in funding over three years to fully develop the Children's Online Privacy Code.
- As at February 2026, the OAIC reported a significant backlog of individual privacy complaints, with new validly lodged complaints unlikely to be substantially progressed for 6 to 12 months absent exceptional circumstances.
Collective Redress And Class ActionsGreen
Representative complaints (s36) and parallel Federal Court class actions both operate as collective redress routes.
Claims (2):
- Representative complaints under s36 of the Privacy Act allow the Information Commissioner to investigate on behalf of a class and, if substantiated, declare that class members are entitled to compensation for loss or damage including injury to feelings or humiliation, as pursued in the Medibank and Optus representative complaints.
- Separate from the OAIC's representative complaint process, affected individuals have pursued parallel Federal Court class actions, such as Zoe Lee McClure v Medibank Private Limited, arising from the same 2022 data breach.
Private Right Of ActionGreen
Statutory tort for serious invasions of privacy in force since 10 June 2025.
Claims (1):
- A statutory tort for serious invasions of privacy, inserted into Schedule 2 of the Privacy Act, commenced on 10 June 2025, giving individuals a direct court-based avenue for redress independent of the OAIC and applicable to entities beyond APP entities.
Recent Developments 180DGreen
Qantas preliminary inquiry report (16 July 2026), Medmate/Monash IVF determination, and ADM consultation closing 15 June 2026 are the most salient developments inside the 180-day window.
Claims (3):
- The OAIC published a report of its preliminary inquiries into the 2025 Qantas Airways data breach, released 16 July 2026.
- The Privacy Commissioner found that providers Medmate Australia Pty Ltd and Monash IVF Pty Ltd interfered with the privacy of individuals, per a determination reported on the OAIC's website in 2026.
- The OAIC opened a consultation (Issues Paper) on guidance for the ADM Transparency Obligation, with submissions closing 15 June 2026 ahead of guidance expected by September 2026.
Key findings (3)
- — source on file
- — source on file
- — source on file
Enforcement & Redress
The OAIC is pursuing an explicitly enforcement-first posture in 2026, visible across several simultaneous strands. On 15 June 2026 the OAIC published a determination ordering American Express Australia Limited to compensate a complainant, having found that American Express failed to adequately mitigate the risk of employees improperly accessing personal information. On 7 October 2026 the OAIC opened a new investigation into the maker of the 'HeyCyan' smart-glasses application, part of a wider pattern of scrutiny of connected and surveillance-capable devices.
This active enforcement posture sits in tension with a separate, structural capacity constraint: as at February 2026, the OAIC stated it is unlikely to substantially progress newly lodged, validly-made individual privacy complaints for around six to twelve months after lodgement, absent exceptional circumstances. The combination is analytically significant — the regulator is simultaneously escalating high-profile, higher-materiality enforcement actions (determinations, new investigations) while acknowledging a multi-month structural delay for ordinary individual complaint handling, indicating a prioritisation of resources toward systemic or higher-impact matters over routine individual redress.
Outlook
Whether the OAIC's complaint-handling backlog narrows over the coming months, even as its enforcement-first posture on higher-profile matters like HeyCyan continues, is the key operational question for this module. The outcome of the HeyCyan investigation will also be a signal of how the OAIC's accessory-liability theory for connected devices develops in practice.
1 earlier distinct update(s)
Enforcement & Redress
Australia's civil-penalty architecture under the Privacy Act 1988 (Cth) remains tiered: serious interferences with privacy carry civil penalties up to the greater of AUD 50 million, three times the benefit obtained, or 30 percent of adjusted turnover, non-serious interferences carry penalties up to AUD 3.3 million, and administrative breaches carry penalties up to AUD 330,000. This penalty structure was carried from the first Privacy Act reform tranche and was not independently re-verified this cycle beyond the APP Guidelines update. Separately, a statutory tort for serious invasions of privacy, which commenced 10 June 2025, continues to permit individuals to bring direct action regardless of whether the OAIC is involved, subject to exemptions for journalism, law enforcement and intelligence activity; no change to the tort was identified this cycle. On the reform horizon, public consultation on the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, comprising around forty proposed reforms including a fair-and-reasonable handling test and a right of erasure for large digital platforms, closed 18 September 2026. The government has signalled an intention to introduce the Bill before the end of 2026, but no introduction to Parliament was confirmed this cycle.
Outlook
Whether the Privacy Amendment (Personal Data Protection) Bill 2026 is introduced to Parliament before the end of 2026, as the government has signalled, is the key marker to watch. If introduced, the Bill's roughly forty proposed reforms, including the fair-and-reasonable test and the large-platform erasure right, would represent the next material escalation in Australia's enforcement and redress architecture beyond the existing tiered civil-penalty regime and statutory tort.
Sources and claims (13)
- ProbableOffice of the Australian Information Commissioner — Since amendments effective December 2022, the maximum civil penalty for a body corporate's serious or repeated interference with privacy under s13G is the greater of $50 million, three times the value of the benefit obtained, or 30% of the entity's adjusted turnover during the breach period.observed
- ProbableOffice of the Australian Information Commissioner — The Privacy and Other Legislation Amendment Act 2024 introduced a new mid-tier civil penalty under s13H for interferences with privacy that do not meet the 'serious' threshold, capped at 2,000 penalty units (AUD 660,000).observed
- ProbableOffice of the Australian Information Commissioner — In its first civil-penalty judgment under the Privacy Act, the Federal Court ordered Australian Clinical Labs to pay $5.8 million for privacy breaches connected to its February 2022 Medlab Pathology data breach affecting over 223,000 individuals.observed
- ProbableOffice of the Australian Information Commissioner — The OAIC received a record 1,205 data breach notifications in the 2025 calendar year, an 8% increase over 2024's 1,112 notifications and the highest annual total since the NDB scheme commenced in 2018.observed
- ProbableOffice of the Australian Information Commissioner — As of early 2026 the OAIC intended to continue civil-penalty proceedings against Optus and Medibank through the year, alongside Commissioner-initiated investigations into rental-technology platforms, connected cars and tracking pixels.observed
- ProbableInternational Association of Privacy Professionals — The OAIC was allocated AUD 3 million in funding over three years to fully develop the Children's Online Privacy Code.observed
- ProbableOffice of the Australian Information Commissioner — As at February 2026, the OAIC reported a significant backlog of individual privacy complaints, with new validly lodged complaints unlikely to be substantially progressed for 6 to 12 months absent exceptional circumstances.observed
- ProbableOffice of the Australian Information Commissioner — Representative complaints under s36 of the Privacy Act allow the Information Commissioner to investigate on behalf of a class and, if substantiated, declare that class members are entitled to compensation for loss or damage including injury to feelings or humiliation, as pursued in the Medibank and Optus representative complaints.observed
- ProbableOffice of the Australian Information Commissioner — Separate from the OAIC's representative complaint process, affected individuals have pursued parallel Federal Court class actions, such as Zoe Lee McClure v Medibank Private Limited, arising from the same 2022 data breach.observed
- ProbableOffice of the Australian Information Commissioner — A statutory tort for serious invasions of privacy, inserted into Schedule 2 of the Privacy Act, commenced on 10 June 2025, giving individuals a direct court-based avenue for redress independent of the OAIC and applicable to entities beyond APP entities.observed
- ProbableOffice of the Australian Information Commissioner — The OAIC published a report of its preliminary inquiries into the 2025 Qantas Airways data breach, released 16 July 2026.observed
- ProbableOffice of the Australian Information Commissioner — The Privacy Commissioner found that providers Medmate Australia Pty Ltd and Monash IVF Pty Ltd interfered with the privacy of individuals, per a determination reported on the OAIC's website in 2026.observed
- ProbableOffice of the Australian Information Commissioner — The OAIC opened a consultation (Issues Paper) on guidance for the ADM Transparency Obligation, with submissions closing 15 June 2026 ahead of guidance expected by September 2026.observed