#144 The era of enforcement begins - breaking down privacy's first ever civil penalty

This week we analyse the implications of the first ever civil penalties ordered under the Privacy Act.

In October, the Federal Court ordered that Australian Clinical Labs pay $5.8 million in civil penalties in relation to a data breach by its Medlab Pathology business in February 2022 that led tothe exposure of the personal information of over 223,000 people.

We discuss the key insights for cyber, privacy and risk practitioners emerging from the judgement.

Links:

OAIC statement https://www.oaic.gov.au/news/media-centre/australian-clinical-labs-ordered-to-pay-penalties-in-relation-to-medlab-pathology-data-breach-in-first-for-privacy-act

Federal Court judgement https://www.judgments.fedcourt.gov.au/judgments/Judgments/fca/single/2025/2025fca1224

OAIC guidance on APP 11 "reasonable steps" (OAIC) https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information

Credits:

Editing and post-production by Martin Franklin (East Coast Studio) ⁠www.eastcoaststudio.com.au⁠

Music by Bensound.com