One penalty

In calendar year 2025 the Office of the Australian Information Commissioner received 1,205 data breach notifications, an 8 per cent increase over the 1,112 notifications received in 2024 and the most since the notifiable data breaches scheme began in 2018 ¹.

Set that count beside the other side of the ledger. Up to 24 September 2026, from the OAIC’s recent media releases and from searches, this outlet has found one civil penalty order a court has ever made under the Privacy Act: $5.8 million against Australian Clinical Labs, ordered by the Federal Court, by consent, on 8 October 2025 ².

This article sets those two figures side by side, then asks what explains the gap between them: who can fine at all, what caps applied to the cases here, and how each of the four Privacy Act penalty cases this outlet could find has ended, or has not ended yet.

01What the law requires

Since 2018 the Privacy Act has required businesses and Commonwealth government agencies it covers to report any data breach that is likely to result in serious harm. Notifications go to the Office of the Australian Information Commissioner, the OAIC, not to the Privacy Commissioner personally.

Health service providers were the sector most often named in those notifications: 225 of them, 19 per cent of the total ¹. That describes the sector of the entity that reported.

The OAIC’s release acknowledges a growing number of entities reporting under the scheme ¹. This article counts notifications, not breaches.

On a different basis, the 2024-25 financial year, the OAIC separately finalised 1,155 notifications under the scheme, 86 per cent of them within 60 days, and finalised 3,123 privacy complaints ³. That count uses a different period and a different basis to the calendar year count above, and this article does not add the two together or compare them.

Elsewhere in this outlet’s reporting, THE REPORTING RORT’s ‘Nobody has to tell’ sets out whom the notification duty binds, and whom it does not.

02Who can fine

Under the Privacy Act, only a court can impose a civil penalty. The Commissioner may apply to a court for one where an entity is alleged to have engaged in serious or repeated interferences with privacy, but a determination the Commissioner makes alone cannot carry a fine ⁴.

Every case in this article falls under the caps that applied before 13 December 2022: $2.22 million for each contravention in the ACL, Medibank and Optus cases, and $1.7 million in the Meta case, according to the OAIC ⁴⁵.

A new regime, in force from 13 December 2022 ², allows the Court to impose much higher penalties on conduct after that date: the greater of $50 million, three times the benefit obtained, or 30 per cent of adjusted turnover, according to a law firm explainer ⁶.

A further amendment in 2024 added two more tiers: a mid-tier civil penalty for interferences with privacy that do not meet the ‘serious’ threshold, and a lower tier of OAIC-issued infringement notices for administrative breaches, without court action, according to law firm explainers ⁶⁷. How many infringement notices or mid-tier proceedings have been used, if any, is not established on this record.

03The ledger

Every Privacy Act civil penalty case this outlet could find is set out in the graphic above, and below, grouped by outcome, not by the order each was filed.

The first order, and the only one we have found up to 24 September 2026, came against Australian Clinical Labs. On 8 October 2025 the Federal Court ordered ACL to pay $5.8 million in civil penalties over the Medlab Pathology data breach, which affected more than 223,000 people; ACL admitted the contraventions, consented to the orders, and the parties made joint submissions to the Court on liability and penalty ².

The $5.8 million breaks into three parts: $4.2 million for the security failure itself, under Australian Privacy Principle 11.1; $800,000 for failing to carry out a reasonable and expeditious assessment of whether an eligible data breach had occurred; and $800,000 for failing to notify the Commissioner as soon as practicable ².

Together the assess and notify penalties come to $1.6 million, about 28 per cent of the $5.8 million total: the notification duty itself, not only the security failure behind it, has been penalised. THE REPORTING RORT’s ‘Fourteen days’ set this same $1.6 million inside a wider ledger of reporting duties across the Commonwealth; this article puts it beside every other Privacy Act penalty case instead.

It is the only order this outlet could find, from the OAIC’s recent media releases, up to 24 September 2026. We say only that we have found no other.

04Two open, one traded

The Commissioner’s case against Meta never reached a judgment. Proceedings began in March 2020 over the Cambridge Analytica incident. After court-ordered mediation that ran from February 2024, the OAIC accepted an enforceable undertaking on 17 December 2024: a $50 million payment program for affected Australians, and the Commissioner withdrew the civil penalty proceedings ⁵.

A civil penalty is paid to the Commonwealth. Meta’s program pays affected people instead.

The resolution meant no court ruled on whether Meta breached the Privacy Act. Separately, in 2024-25 the OAIC also reached an enforceable undertaking with Oxfam Australia over a 2021 data breach ³.

The Commissioner’s case against Medibank has no outcome we have found. The Commissioner filed a civil penalty proceeding on 5 June 2024 alleging Medibank seriously interfered with the privacy of 9.7 million Australians by failing to take reasonable steps to protect their personal information, over conduct alleged between March 2021 and October 2022; the breach was in October 2022 ⁸. Up to 24 September 2026, from OAIC releases and searches, we have found no outcome; the underlying court file has not been checked.

The Commissioner’s case against Optus has no outcome we have found yet either. The Commissioner filed a civil penalty proceeding on 8 August 2025 alleging Optus seriously interfered with the privacy of about 9.5 million Australians, over conduct alleged between 17 October 2019 and 20 September 2022, and the Commissioner alleges one contravention for each of the 9.5 million individuals ⁴. Both the Medibank and Optus figures are allegations, not findings.

We have found no court document that sets a trial date for the Commissioner’s own case against Optus. A separate class action over the same breach, before the same judge, Justice Beach, is set down for trial from 7 June 2027 ⁹. That date belongs to the class action, not to the Commissioner’s case.

05The regulator’s resources

InnovationAus reported in November 2024 that the OAIC had cut dozens of staff after a 23 per cent budget cut ¹⁰. IDM reported that in the 2026-27 Budget the OAIC was allocated $36.576 million, down from $39.753 million in 2025-26 ¹¹, a fall of $3.177 million, or about 8 per cent. These are two different windows, reported by two different outlets, and this article does not combine them. What effect, if any, the reductions have had on how many matters the office can pursue is not established on this record.

06Enforced once

Set the two counts beside each other again. In 2025 businesses and agencies told the OAIC of 1,205 notifications of data breaches likely to cause serious harm. Since 2018, this outlet could find only one court-ordered civil penalty order under the Privacy Act, agreed rather than fought at trial, and two more penalty cases, filed in June 2024 and August 2025, with no outcome we have found. The duty to report has been enforced once.

The duty to report has been enforced once, and that order was made by consent, not after a trial.

It is a narrower finding than it might look. Only a court can impose a civil penalty, the cap on every case here was at most $2.22 million a contravention, and we have found no court test of the far higher maximums in force since December 2022.

This case will keep a public tally on this count: if a second court-ordered civil penalty lands under the Privacy Act, the headline above changes.

Another written duty has no fine yet. THE SURVEILLANCE RORT’s ‘The internet asks for ID’ found that, on the public record to July 2026, no fines had been issued under the under-16 social media law.

What the regulator does without a court is the subject of the next article in this case.

If it’s a rort, we cover it.