--- title: "Australia — Enforcement & Redress | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/australia/enforcement-and-redress/ source_html: /jurisdictions/australia/enforcement-and-redress/index.html description: "Australia — Enforcement & Redress: enforcement_and_redress Enforcement & Redress 6 sub-modules 13 claims Green ▾ # Well-resourced, increasingly assertive enforcement with escalating penalties, multiple concurrent ma" generated_at: 2026-10-25T04:46:50Z content_sha256: b5873704ec7f146dd17e7b5f6f925c443ce3e42cdbff5b0ceb4f937855798919 generator: "fe-fleet/md-twin@1.0" --- # Australia — Enforcement & Redress | Data Protection Monitor ### D10Enforcement & Redress6 sub-modules13 claimsGreen▾# Well-resourced, increasingly assertive enforcement with escalating penalties, multiple concurrent major proceedings, and new private/collective redress avenues, tempered by acknowledged case-backlog capacity constraints. Primary framework Privacy Act 1988 (Cth) Part IIIC / ss 13G–13K, 80U–80W; Schedule 2 (statutory tort) Supervisory authority [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/) Traffic-light rationale — Green Well-resourced, increasingly assertive enforcement with escalating penalties, multiple concurrent major proceedings, and new private/collective redress avenues, tempered by acknowledged case-backlog capacity constraints. #### Sub-modules (6) #### Regulator Powers And PenaltiesGreen Tiered civil penalty regime: up to $50M (s13G, serious/repeated) and up to $660,000 (s13H, new mid-tier). Claims (2): - Since amendments effective December 2022, the maximum civil penalty for a body corporate's serious or repeated interference with privacy under s13G is the greater of $50 million, three times the value of the benefit obtained, or 30% of the entity's adjusted turnover during the breach period. - The Privacy and Other Legislation Amendment Act 2024 introduced a new mid-tier civil penalty under s13H for interferences with privacy that do not meet the 'serious' threshold, capped at 2,000 penalty units (AUD 660,000). #### Enforcement Activity IndexGreen Record 2025 NDB notifications; first civil penalty (ACL); ongoing Optus/Medibank proceedings; new CIIs into rentaltech, connected cars, tracking pixels. Claims (3): - In its first civil-penalty judgment under the Privacy Act, the Federal Court ordered Australian Clinical Labs to pay $5.8 million for privacy breaches connected to its February 2022 Medlab Pathology data breach affecting over 223,000 individuals. - The OAIC received a record 1,205 data breach notifications in the 2025 calendar year, an 8% increase over 2024's 1,112 notifications and the highest annual total since the NDB scheme commenced in 2018. - As of early 2026 the OAIC intended to continue civil-penalty proceedings against Optus and Medibank through the year, alongside Commissioner-initiated investigations into rental-technology platforms, connected cars and tracking pixels. #### Regulator Funding And CapacityAmber Dedicated Children's Code funding (AUD3M/3yrs) but acknowledged general complaint-handling backlog in 2026. Claims (2): - The OAIC was allocated AUD 3 million in funding over three years to fully develop the Children's Online Privacy Code. - As at February 2026, the OAIC reported a significant backlog of individual privacy complaints, with new validly lodged complaints unlikely to be substantially progressed for 6 to 12 months absent exceptional circumstances. #### Collective Redress And Class ActionsGreen Representative complaints (s36) and parallel Federal Court class actions both operate as collective redress routes. Claims (2): - Representative complaints under s36 of the Privacy Act allow the Information Commissioner to investigate on behalf of a class and, if substantiated, declare that class members are entitled to compensation for loss or damage including injury to feelings or humiliation, as pursued in the Medibank and Optus representative complaints. - Separate from the OAIC's representative complaint process, affected individuals have pursued parallel Federal Court class actions, such as Zoe Lee McClure v Medibank Private Limited, arising from the same 2022 data breach. #### Private Right Of ActionGreen Statutory tort for serious invasions of privacy in force since 10 June 2025. Claims (1): - A statutory tort for serious invasions of privacy, inserted into Schedule 2 of the Privacy Act, commenced on 10 June 2025, giving individuals a direct court-based avenue for redress independent of the OAIC and applicable to entities beyond APP entities. #### Recent Developments 180DGreen Qantas preliminary inquiry report (16 July 2026), Medmate/Monash IVF determination, and ADM consultation closing 15 June 2026 are the most salient developments inside the 180-day window. Claims (3): - The OAIC published a report of its preliminary inquiries into the 2025 Qantas Airways data breach, released 16 July 2026. - The Privacy Commissioner found that providers Medmate Australia Pty Ltd and Monash IVF Pty Ltd interfered with the privacy of individuals, per a determination reported on the OAIC's website in 2026. - The OAIC opened a consultation (Issues Paper) on guidance for the ADM Transparency Obligation, with submissions closing 15 June 2026 ahead of guidance expected by September 2026. #### Key findings (3) - — source on file - — source on file - — source on file Category narrative 100 words The OAIC's enforcement toolkit was substantially strengthened by the December 2022 penalty increase (up to $50M/3x benefit/30% turnover for serious/repeated interferences) and the POLA Act 2024's new mid-tier civil penalty and infringement/compliance notice powers. 2025 saw record NDB notifications and the OAIC's first-ever court-ordered civil penalty (Australian Clinical Labs, $5.8M), with Optus and Medibank civil-penalty proceedings continuing into 2026 alongside a $50M Meta enforceable undertaking. A statutory tort for serious invasions of privacy (in force since 10 June 2025) and representative-complaint mechanisms provide collective and private redress routes, though the OAIC reported a significant individual-complaint backlog as of February 2026. Periodic update · new data 2026-10-18 #### Enforcement & Redress The OAIC is pursuing an explicitly enforcement-first posture in 2026, visible across several simultaneous strands. On 15 June 2026 the OAIC published a determination ordering American Express Australia Limited to compensate a complainant, having found that American Express failed to adequately mitigate the risk of employees improperly accessing personal information. On 7 October 2026 the OAIC opened a new investigation into the maker of the 'HeyCyan' smart-glasses application, part of a wider pattern of scrutiny of connected and surveillance-capable devices. This active enforcement posture sits in tension with a separate, structural capacity constraint: as at February 2026, the OAIC stated it is unlikely to substantially progress newly lodged, validly-made individual privacy complaints for around six to twelve months after lodgement, absent exceptional circumstances. The combination is analytically significant — the regulator is simultaneously escalating high-profile, higher-materiality enforcement actions (determinations, new investigations) while acknowledging a multi-month structural delay for ordinary individual complaint handling, indicating a prioritisation of resources toward systemic or higher-impact matters over routine individual redress. #### Outlook Whether the OAIC's complaint-handling backlog narrows over the coming months, even as its enforcement-first posture on higher-profile matters like HeyCyan continues, is the key operational question for this module. The outcome of the HeyCyan investigation will also be a signal of how the OAIC's accessory-liability theory for connected devices develops in practice. 1 earlier distinct update(s) Periodic update · new data 2026-10-12 #### Enforcement & Redress Australia's civil-penalty architecture under the Privacy Act 1988 (Cth) remains tiered: serious interferences with privacy carry civil penalties up to the greater of AUD 50 million, three times the benefit obtained, or 30 percent of adjusted turnover, non-serious interferences carry penalties up to AUD 3.3 million, and administrative breaches carry penalties up to AUD 330,000. This penalty structure was carried from the first Privacy Act reform tranche and was not independently re-verified this cycle beyond the APP Guidelines update. Separately, a statutory tort for serious invasions of privacy, which commenced 10 June 2025, continues to permit individuals to bring direct action regardless of whether the OAIC is involved, subject to exemptions for journalism, law enforcement and intelligence activity; no change to the tort was identified this cycle. On the reform horizon, public consultation on the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, comprising around forty proposed reforms including a fair-and-reasonable handling test and a right of erasure for large digital platforms, closed 18 September 2026. The government has signalled an intention to introduce the Bill before the end of 2026, but no introduction to Parliament was confirmed this cycle. #### Outlook Whether the Privacy Amendment (Personal Data Protection) Bill 2026 is introduced to Parliament before the end of 2026, as the government has signalled, is the key marker to watch. If introduced, the Bill's roughly forty proposed reforms, including the fair-and-reasonable test and the large-platform erasure right, would represent the next material escalation in Australia's enforcement and redress architecture beyond the existing tiered civil-penalty regime and statutory tort. Evidence 13 Sources and claims (13) - Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/news/media-centre/australian-clinical-labs-ordered-to-pay-penalties-in-relation-to-medlab-pathology-data-breach-in-first-for-privacy-act) — Since amendments effective December 2022, the maximum civil penalty for a body corporate's serious or repeated interference with privacy under s13G is the greater of $50 million, three times the value of the benefit obtained, or 30% of the entity's adjusted turnover during the breach period.observed 2026-07-29 - Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/news) — The Privacy and Other Legislation Amendment Act 2024 introduced a new mid-tier civil penalty under s13H for interferences with privacy that do not meet the 'serious' threshold, capped at 2,000 penalty units (AUD 660,000).observed 2026-07-29 - Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/news/media-centre/australian-clinical-labs-ordered-to-pay-penalties-in-relation-to-medlab-pathology-data-breach-in-first-for-privacy-act) — In its first civil-penalty judgment under the Privacy Act, the Federal Court ordered Australian Clinical Labs to pay $5.8 million for privacy breaches connected to its February 2022 Medlab Pathology data breach affecting over 223,000 individuals.observed 2026-07-29 - Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/news/media-centre/data-breach-notifications-increase-to-all-time-high-in-2025,-new-ndb-stats-show) — The OAIC received a record 1,205 data breach notifications in the 2025 calendar year, an 8% increase over 2024's 1,112 notifications and the highest annual total since the NDB scheme commenced in 2018.observed 2026-07-29 - Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/news/blog/handling-privacy-complaints-a-new-approach-for-a-new-era) — As of early 2026 the OAIC intended to continue civil-penalty proceedings against Optus and Medibank through the year, alongside Commissioner-initiated investigations into rental-technology platforms, connected cars and tracking pixels.observed 2026-07-29 - Probable[International Association of Privacy Professionals](https://iapp.org/news/a/australia-introduces-initial-privacy-act-reforms) — The OAIC was allocated AUD 3 million in funding over three years to fully develop the Children's Online Privacy Code.observed 2026-07-29 - Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/news/blog/handling-privacy-complaints-a-new-approach-for-a-new-era) — As at February 2026, the OAIC reported a significant backlog of individual privacy complaints, with new validly lodged complaints unlikely to be substantially progressed for 6 to 12 months absent exceptional circumstances.observed 2026-07-29 - Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/newsroom/representative-complaints) — Representative complaints under s36 of the Privacy Act allow the Information Commissioner to investigate on behalf of a class and, if substantiated, declare that class members are entitled to compensation for loss or damage including injury to feelings or humiliation, as pursued in the Medibank and Optus representative complaints.observed 2026-07-29 - Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/privacy/privacy-complaints/medibank-representative-complaint-notice) — Separate from the OAIC's representative complaint process, affected individuals have pursued parallel Federal Court class actions, such as Zoe Lee McClure v Medibank Private Limited, arising from the same 2022 data breach.observed 2026-07-29 - Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/privacy/your-privacy-rights/more-privacy-rights/statutory-tort-for-serious-invasions-of-privacy) — A statutory tort for serious invasions of privacy, inserted into Schedule 2 of the Privacy Act, commenced on 10 June 2025, giving individuals a direct court-based avenue for redress independent of the OAIC and applicable to entities beyond APP entities.observed 2026-07-29 - Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/) — The OAIC published a report of its preliminary inquiries into the 2025 Qantas Airways data breach, released 16 July 2026.observed 2026-07-29 - Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/news) — The Privacy Commissioner found that providers Medmate Australia Pty Ltd and Monash IVF Pty Ltd interfered with the privacy of individuals, per a determination reported on the OAIC's website in 2026.observed 2026-07-29 - Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/engage-with-us/consultations/consultation-on-guidance-for-transparency-in-automated-decision-making) — The OAIC opened a consultation (Issues Paper) on guidance for the ADM Transparency Obligation, with submissions closing 15 June 2026 ahead of guidance expected by September 2026.observed 2026-07-29