Australian privacy penalties and OAIC decisions

A$50m about £25m

Meta Platforms, Inc.

Office of the Australian Information Commissioner, 17 December 2024 Final

To settle civil penalty proceedings over the Cambridge Analytica matter, the Commissioner accepted an enforceable undertaking under which Meta funds an AUD 50 million payment scheme for eligible Australian Facebook users. The Commissioner had alleged that users' data was disclosed to the This is Your Digital Life app in breach of the Privacy Act, and withdrew the Federal Court case.

• No lawful basis for processing
• Selling or brokering personal data

Privacy Act 1988 (Cth)

A$5.8m about £2.84m

Australian Clinical Labs Limited (Medlab Pathology)

Office of the Australian Information Commissioner, 8 October 2025 Final

The Federal Court ordered Australian Clinical Labs to pay AUD 5.8 million, the first civil penalties under the Privacy Act, after a February 2022 cyberattack on its Medlab Pathology systems exposed data of over 223,000 people. The total comprised AUD 4.2 million for failing to protect the data and AUD 800,000 each for a slow breach assessment and late notification to the Commissioner.

• Weak security leading to a breach
• Health data shared or exposed

Privacy Act 1988 (Cth), APP 11.1, s 13G(a), s 26WH(2), s 26WK(2)

Order or finding

American Express Australia Limited

Office of the Australian Information Commissioner, 15 June 2026 Final

The Privacy Commissioner found that American Express Australia did not adequately guard against insider access risk, allowing a complainant's personal information to be accessed without authorisation. Amex must compensate the complainant for economic and non-economic loss and expenses, apologise in writing and add technical controls limiting staff access.

• Weak security leading to a breach

Privacy Act 1988 (Cth), APP 11.1

Order or finding

Optus

Office of the Australian Information Commissioner, 11 June 2026 Final

The Privacy Commissioner found that between 2015 and 2019 Optus failed to act on unlisted number requests from 41,278 customers who ported to it, leaving their details published in the White Pages despite knowing of the risk. She found Optus did not take reasonable steps to protect the information from unauthorised disclosure.

• Weak security leading to a breach
• Governance, DPO or impact assessment

Privacy Act 1988 (Cth), APP 11.1

Order or finding

Monash IVF Pty Ltd

Office of the Australian Information Commissioner, 11 June 2026 Final

In a parallel determination, the Privacy Commissioner found that fertility clinic operator Monash IVF interfered with privacy by collecting sensitive information from website visitors via third-party tracking pixels without consent. The OAIC published a companion report on its inspection of 50 health service websites.

• Advertising pixels sharing visitor data
• Health data shared or exposed
• Trackers or cookies before consent

Privacy Act 1988 (Cth)

Order or finding

Medmate Australia Pty Ltd

Office of the Australian Information Commissioner, 11 June 2026 Final

The Privacy Commissioner found that telehealth provider Medmate interfered with visitors' privacy by collecting sensitive health information through third-party tracking pixels used for social media ad targeting, without consent. The determination sets the position that pixel tracking on health websites is a collection of sensitive information that needs consent.

• Advertising pixels sharing visitor data
• Health data shared or exposed
• Trackers or cookies before consent

Privacy Act 1988 (Cth)

Order or finding

Vinomofo Pty Ltd

Office of the Australian Information Commissioner, 29 October 2025 Final

The Privacy Commissioner found that online wine retailer Vinomofo failed to take reasonable security steps before a 2022 breach during a cloud data migration exposed data of about 928,760 customers and members. She noted the company knew of its security governance gaps at least two years earlier and made declarations against repeating the conduct.

• Weak security leading to a breach
• Governance, DPO or impact assessment

Privacy Act 1988 (Cth), APP 11.1

Order or finding

Kmart Australia Limited

Office of the Australian Information Commissioner, 18 September 2025 Final

The Privacy Commissioner found that Kmart collected biometric data of every shopper entering 28 stores, and everyone at returns counters, through facial recognition aimed at refund fraud between 2020 and 2022, without notice or consent. She found the collection disproportionate and rejected Kmart's reliance on the unlawful activity exemption, noting less intrusive options existed.

• Biometric data and facial recognition
• Missing or unclear privacy information
• Collecting more data than needed

Privacy Act 1988 (Cth)

Order or finding

Master Wealth Control Pty Ltd (DG Institute) and Property Lovers Pty Ltd

Office of the Australian Information Commissioner, 26 November 2024 Final

The Privacy Commissioner found that two companies linked to Dominique Grubisa scraped personal information from court lists and databases into weekly leads lists aimed at vulnerable people, without fair collection, notice or reasonable accuracy checks. A May 2026 follow-up investigation concluded that the later fastproperty.ai service did not handle personal information.

• Selling or brokering personal data
• Missing or unclear privacy information
• No lawful basis for processing

Privacy Act 1988 (Cth)

Order or finding

Bunnings Group Limited

Office of the Australian Information Commissioner, 19 November 2024 Final

The Privacy Commissioner found that Bunnings used facial recognition on CCTV to capture the faces of everyone entering 63 stores in Victoria and New South Wales between 2018 and 2021, without consent, adequate notice or required privacy policy content, and ordered it not to repeat the conduct. On review in February 2026 the Administrative Review Tribunal upheld the notice and governance findings but accepted that Bunnings could rely on an exemption from the consent requirement.

• Biometric data and facial recognition
• Missing or unclear privacy information
• Governance, DPO or impact assessment

Privacy Act 1988 (Cth), APP 1, APP 3.3, APP 5

Law and guidance

New resources on transparency for use of AI and automated decision-making | OAIC

Office of the Australian Information Commissioner, 10 December 2026 Coming up

From 10 December 2026, organisations covered by the Privacy Act must say in their privacy policy when a computer program makes, or substantially helps make, decisions that could significantly affect people, and what personal information it uses. The OAIC released fact sheets, a flowchart and updated APP 1 guidelines on 30 September 2026.

• AI systems and chatbots
• Missing or unclear privacy information

Privacy Act 1988 (Cth) as amended by Privacy and Other Legislation Amendment Act 2024, APP 1.7, APP 1.8, APP 1.9

Law and guidance

OAIC releases Exposure Draft of the Children's Online Privacy Code | OAIC

Office of the Australian Information Commissioner, 31 March 2026 Coming up

The OAIC published an exposure draft of the Children's Online Privacy Code for 60 days of consultation, with the code due to become law in December 2026. Draft rules include putting children's best interests first, consent before using children's data for targeted ads, and a right for children to ask for deletion.

• Children's data

Children's Online Privacy Code (exposure draft), Privacy Act 1988 (Cth)

Law and guidance

Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024), Federal Register of Legislation

Federal Register of Legislation (Australian Government), 10 June 2025 In force

A new statutory tort for serious invasions of privacy, added by Schedule 2 of the 2024 amendment Act, commenced on 10 June 2025. It lets individuals sue in court directly for serious intrusions into seclusion or misuse of their information.

Privacy and Other Legislation Amendment Act 2024 (Cth), Schedule 2, Schedule 2

Law and guidance

Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024), Federal Register of Legislation

Office of the Australian Information Commissioner, 11 December 2024 In force

The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024, and most of its privacy reforms, including new tiers of civil penalties, OAIC infringement notices and new investigation powers, commenced the next day. The Act also mandates a Children's Online Privacy Code and adds automated decision transparency duties that start later.

Privacy and Other Legislation Amendment Act 2024 (Cth), Schedule 1 Parts 1 to 14

Law and guidance

OAIC publishes guidance on tracking pixels and privacy obligations | OAIC

Office of the Australian Information Commissioner, 4 November 2024 In force

The OAIC issued guidance to private sector organisations on meeting Privacy Act obligations when they place third-party tracking pixels on their websites. The guidance later underpinned the 2026 Medmate and Monash IVF determinations on health website pixels.

• Advertising pixels sharing visitor data

Privacy Act 1988 (Cth)