Nearly five years

On 11 June 2026 the Office of the Australian Information Commissioner found against Optus over the White Pages breach of 2015 to 2019, affecting 41,278 customers. The OAIC’s release says its publication ‘brings to an end a long-running investigation, which was first announced in August 2021’ ¹. From announcement to outcome, nearly five years.

This article uses one basis for every matter in it: months from an investigation’s announcement or a civil penalty proceeding’s filing, to its outcome, or to 24 September 2026 if there is none yet. On that basis the five matters on this strip run from about one year to nearly five, and three of these five are still open.

Compensation for the White Pages breach itself was deferred to a later, separate determination on a representative complaint. This article’s clock stops at the finding, not at that later step.

01The clock

Meta’s case ran almost as long as Optus White Pages did. The Commissioner’s civil penalty proceedings against Meta began in March 2020. Court-ordered mediation ran from February 2024, and on 17 December 2024 the OAIC accepted an enforceable undertaking for a $50 million payment program: ‘the Commissioner has withdrawn the civil penalty proceedings in the Federal Court’ ². Filing to withdrawal, about 57 months.

A joint investigation into Latitude Financial’s March 2023 breach opened on 10 May 2023, run together by the OAIC and New Zealand’s Office of the Privacy Commissioner: ‘The Office of the Australian Information Commissioner (OAIC) and the New Zealand Office of the Privacy Commissioner (OPC) today commenced a joint investigation’ ³. New Zealand’s regulator said at the time that ‘As this investigation is now active no further comments will be made on it until it is concluded’ ⁴. We found no published outcome from either regulator, or in the OAIC’s media centre listing, up to 24 September 2026. About 40 months, with no published outcome.

Medibank’s case has run about 27 months. The OAIC filed civil penalty proceedings on 5 June 2024, alleging Medibank ‘seriously interfered with the privacy of 9.7 million Australians by failing to take reasonable steps to protect their personal information’ ⁵. That figure is an allegation, not a finding. We found no OAIC outcome, and no reported court outcome, up to 24 September 2026.

Some of the time on Medibank’s compensation complaint has been taken by litigation Medibank brought. Separately from the penalty case, Medibank went to court to stop the Commissioner deciding a related representative complaint about compensation: ‘Medibank has commenced proceedings to restrain the AIC from investigating the representative complaint and from making a determination and enforcing the determination in respect of the representative complaint on the basis that a determination made by the AIC and/or enforcement of a determination by the AIC poses a real risk of interference with the administration of justice having regard to the Medibank class action’, the OAIC says ⁶. Questions on this will be put to Medibank, and any answer will be added.

The Optus penalty case is the newest of the three still open. Filed on 8 August 2025, it alleges Optus ‘seriously interfered with the privacy of approximately 9.5 million Australians by failing to take reasonable steps to protect their personal information’, over conduct the Commissioner dates from 17 October 2019 to 20 September 2022 ⁷. About 13 months, and open. The Commissioner alleges ‘one contravention for each of the 9.5 million individuals’ in that case ⁷: the Optus and Medibank cases are the two biggest on this record, and both are live, not dropped.

All three penalty cases followed OAIC investigations of their own. The OAIC’s Meta enforceable undertaking says ‘the Civil Penalty Proceedings followed investigations by the OAIC concerning the Cambridge Analytica Incident’, an investigation the Commissioner initiated on 5 April 2018 ⁸. The Medibank release says the proceedings ‘follow an investigation initiated by’ the Information Commissioner ⁵, and the Optus release describes its case as ‘following an investigation in relation to the data breach made public by Optus on 22 September 2022’ ⁷. The filing, not that earlier investigation, is what starts each of these bars.

A trial date exists, but not for the OAIC’s own case. Slater and Gordon’s class action is set down for trial from 7 June 2027, before Justice Beach: ‘On 12 December 2025, the Honourable Justice Beach set down the class action for trial, commencing on 7 June 2027’ ⁹. Justice Beach also hears the Commissioner’s case, and MLex reports he ordered all parties, ‘including the regulators’, to mediation by 12 February 2027 ¹⁰. No court document we found sets a trial date for the OAIC’s own proceeding. MLex also reports the class action’s applicants ‘have been granted leave to intervene in the privacy watchdog’s penalties case’ ¹¹.

On this measure, two matters took nearly five years to end. Three others have no published outcome.

02Who can impose a civil penalty

None of that changes who can impose a civil penalty. Only a court can make a civil penalty order, on the Commissioner’s application: ‘the Australian Information Commissioner may apply to the Federal Court for a civil penalty order where an entity is alleged to have engaged in serious or repeated interferences’ ⁷. A determination the Commissioner makes alone cannot carry a fine.

That is the OAIC’s own stated policy ¹². The factors it weighs include the number of people affected, whether the conduct was isolated or systemic, an entity’s compliance history, the likelihood the conduct recurs, and what remediation has already been done.

03How the rest ended

Two other matters closed without a full investigation, and each on its own stated ground. MediSecure had entered administration on 3 June 2024. The OAIC’s inquiries into its breach had focused on getting affected individuals notified, and the regulator closed them on 13 September 2024 without a comprehensive investigation: ‘the possible remedies that we could obtain for the community will not be proportionate to the resources required for a comprehensive investigation’ ¹³. MediSecure’s administration came first. The OAIC’s decision followed it.

Qantas’s preliminary inquiries closed on a different ground entirely. After almost a year of preliminary inquiries into its 2025 data incident affecting about 5 million Australians, the Privacy Commissioner said in a statement dated 16 July 2026 that the evidence did not support a likely breach: ‘in this instance I do not consider that the evidence supports the likelihood that a breach of privacy law occurred’ ¹⁴.

On that basis the Commissioner said it ‘would not be appropriate for the OAIC- a proportionate and risk-based regulator - to commence a full investigation or take further action at this stage’ ¹⁴. Evidence, not proportionality, is the OAIC’s own stated reason for closing its preliminary inquiries into Qantas.

Clearview AI’s case is different: it had already been found in breach, in a determination dated 14 October 2021. Clearview withdrew from Administrative Appeals Tribunal review of that finding in August 2023. Nearly three years after the original determination, on 21 August 2024, the Commissioner said: ‘I am not satisfied that further action is warranted in the particular case of Clearview AI at this time’ ¹⁵. The OAIC says the 2021 determination, and its declarations, still stand. What did not follow was any further action.

04What a finding looks like

Besides the Optus White Pages finding, whose compensation was deferred, the outcomes on this record are declarations, one order of compensation for a single person, and two determinations against health service providers over tracking. None of them is a penalty, because a determination cannot carry one.

On 29 October 2025 the OAIC found Vinomofo had ‘interfered with the privacy of almost a million individuals by failing to take reasonable steps to protect the personal information it held’, over a 2022 breach affecting about 928,760 people ¹⁶. The remedy was declarations that it not repeat or continue the conduct. No money was ordered.

On 15 June 2026 the OAIC ordered American Express Australia to compensate a single complainant after an insider-access breach of APP 11.1; its release is headed ‘Australian Privacy Commissioner orders American Express Australia Limited to compensate complainant following interference in privacy’ ¹⁷. That is a money remedy, but it runs to one person, not a class.

On 24 June 2026 the OAIC published two determinations, finding that Medmate Australia Pty Ltd and Monash IVF Pty Ltd ‘interfered with the privacy of individuals whose sensitive information was collected via third-party tracking pixels’ ¹⁸. The OAIC’s release does not state the remedies, and this article does not describe them.

05One penalty, and what is still open

Article 1 of this case, ‘One penalty’, sets out the only civil penalty order this outlet has found made under the Act, and how it came about. This article is about the rest of the record: what happens while there is no penalty yet, or none at all.

Three of the five matters on this strip have no published outcome as of 24 September 2026: Latitude’s joint investigation, opened 10 May 2023; Medibank’s penalty case, filed 5 June 2024; and Optus’s penalty case, filed 8 August 2025. Two dates lie ahead in the Optus matters: the mediation Justice Beach ordered by 12 February 2027, as MLex reports, and the separate class action’s trial, from 7 June 2027. Neither is a trial date for the Commissioner’s own case.

THE REPORTING RORT’s ‘Fourteen days’ sets some of the same matters in a wider ledger of reporting duties. Its Australian Clinical Labs figure, $5.8 million by consent, $1.6 million of it for failing to assess and notify, is that record’s evidence the notification duty has been enforced once, in an agreed outcome.

Retail and scraped facial recognition are the subject of the next article in this case, held pending outstanding checks.

Two dates lie ahead, in 2027. Neither is a trial date for the Commissioner’s own case.

If it’s a rort, we cover it.