Promised in 2019

On 26 July 2019 the Australian Competition and Consumer Commission published its Digital Platforms Inquiry final report. Recommendation 17 called for broader reform of Australian privacy law ¹. In response to the ACCC's recommendations, on 12 December 2019 the government of the day committed to a review of the Privacy Act, with its own roadmap setting the review to commence in 2020 and to be completed in 2021 ²³.

The review began on time: it published an Issues Paper in October 2020 ¹⁶. Its report was released in February 2023, and the government responded on 28 September 2023 ¹⁵. Nearly seven years after the promise, the second round of changes the review led to is still an exposure draft. This outlet found no record that it has been introduced to Parliament ⁴⁵.

This article sets that reform clock beside the law's own teeth: a March 2019 promise to raise penalties, the higher caps that took effect in December 2022, the two lower tiers added from December 2024, and the one court-ordered Privacy Act penalty this outlet has found, which fell under none of the new caps or tiers.

01The 2019 promise

The recommendation and the promise are two different dates, more than four months apart. The ACCC's Digital Platforms Inquiry final report is cover-dated June 2019 and was published on 26 July 2019; Recommendation 17 calls for broader reform of Australian privacy law but names no timetable of its own ¹.

The roadmap set its own deadline. It listed the review under the work planned for 2020 as commencing, and under the work planned for 2021 as completed ².

That is the clock this article measures the rest of this case against: not a standard of ours, but the government's own.

02A penalty promise before the promise

Before the Privacy Act review was promised, a narrower penalty promise had already been made. In March 2019 the government announced it would increase penalties for serious or repeated interference with privacy under the Privacy Act, in line with the penalties available under the Australian Consumer Law ¹.

The higher penalty regime commenced on 13 December 2022, and it looks forward only: it applies only to conduct after that date ⁶⁷. For a body corporate the 2022 Act sets the maximum at the greater of $50 million and either three times the value of the benefit obtained, where the court can determine that value, or 30 per cent of adjusted turnover, where it cannot ⁷. The law firm Corrs describes it the same way ⁸.

Every data breach behind a Privacy Act civil penalty case we found, including Australian Clinical Labs, Optus and Medibank, falls before that line. As this case's first article, ‘One penalty’, set out, the breach behind the only civil penalty this outlet has found ordered under the Privacy Act, against Australian Clinical Labs, happened in February 2022; Optus's alleged conduct ran to 20 September 2022 and Medibank's breach came in October 2022. All three are older than the higher cap.

The $5.8 million ordered against Australian Clinical Labs on 8 October 2025, by consent, is the only civil penalty this outlet has found ever ordered under the Privacy Act ⁶. It fell under the old cap of $2.22 million per contravention. As ‘One penalty’ also set out, this outlet has found no outcome in the Information Commissioner's civil penalty cases against Optus and Medibank; this outlet has found no decision on the allegations in them.

03Three tiers, prospective only

The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. The new penalty provisions, and the tiers built on them, commenced the next day, 11 December 2024 ⁹.

The top tier's maximum was not raised by the 2024 Act. That figure, the $50 million or turnover-based cap described above, was set by the 2022 Act; the 2024 Act instead made seriousness itself an element a court must find before that tier applies ⁹. A penalty unit was worth $330 for conduct between 7 November 2024 and 30 June 2026, rising to $364 from 1 July 2026; the figures below are given at both rates ¹⁰. They are the maximums for a person, as the Act states them; Corrs reports a higher maximum for a body corporate, which this article does not state ⁸.

Neither the mid nor the low tier can reach conduct before 11 December 2024, and the 2024 changes to the top tier apply only to later conduct too ⁹.

The OAIC announced its first compliance sweep on 9 December 2025, to begin in the first week of January 2026: about 60 entities across six sectors, checked against Australian Privacy Principle 1.4, the content of a privacy policy, which is one of the low tier's listed obligations ¹¹.

That figure matches 200 penalty units at the $330 rate that applied until 30 June 2026 ¹⁰.

The OAIC has since said, in general terms, what the sweep found. In her prepared keynote address for 4 May 2026, the Privacy Commissioner, Carly Kind, wrote ¹²:

The OAIC's June 2026 edition of its Information Matters newsletter said the sweep was being finalised, that notices were anticipated and that a report would follow ¹³.

As of 8 October 2026 we found no published sweep report, no result for any named entity, and no public report of an infringement notice or a mid-tier penalty case.

04The second round

The next round of privacy law changes reached exposure draft on 31 August 2026. Consultation closed on 18 September 2026, and as of 8 October 2026 this outlet found no record that the resulting bill, the Privacy Amendment (Personal Data Protection) Bill 2026, has been introduced to Parliament ⁴⁵.

The Attorney-General spoke about timing at a press conference on the exposure draft on 31 August 2026 ¹⁴.

Those words give a year, not a date, and the department's page gives no date either.

The exposure draft keeps the notification duty on the entity that was breached ⁵. THE REPORTING RORT's ‘Nobody has to tell’ sets out whom that duty does not bind.

A further part of the 2024 Act has not yet commenced. Schedule 1, Part 15, ‘Automated decisions and privacy policies’, takes effect on 10 December 2026, twenty-four months after Royal Assent. It inserts Australian Privacy Principles 1.7 to 1.9, which require an entity that has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, using personal information about that individual, to set out in its privacy policy the kinds of personal information such programs use and the kinds of decisions they make or help make, and it adds Australian Privacy Principle 1.7 to the low tier's list of obligations in section 13K ⁹.

The review that led here did go ahead. The Attorney-General's Department has published a page titled ‘Government response to the Privacy Act Review Report’ ¹⁵. It says the department released the Privacy Act Review Report in February 2023 and that the government released its response on 28 September 2023. The department's page on the review says it published an Issues Paper in October 2020 and a Discussion Paper in October 2021 ¹⁶.

This article measures the law's changes against that 2021 target, not the review's own report.

05Right of reply

THE RORT emailed questions to the Office of the Australian Information Commissioner and the Attorney-General's Department on 2 October 2026, and asked for a reply by 5pm AEDT on Thursday 8 October 2026. The questions to the OAIC included how many civil penalty proceedings it has filed since 2018, and how many infringement notices it has issued and mid-tier civil penalty proceedings it has filed since the 2024 Act commenced. The questions to the Department included when the Privacy Amendment (Personal Data Protection) Bill 2026 will be introduced.

No response was received from the Office of the Australian Information Commissioner by the deadline, 5pm AEDT on Thursday 8 October 2026.

No response was received from the Attorney-General's Department by the deadline, 5pm AEDT on Thursday 8 October 2026.

Without a reply from the OAIC, this article cannot say whether any infringement notice has been issued or any mid-tier civil penalty proceeding filed; it says only what this outlet found in public sources. Without a reply from the Department, it cannot say when the Bill will be introduced. Any answer will be added as a dated update.

THE RORT also asked Optus on 2 October 2026 whether it contests the Commissioner's allegations in the civil penalty case this article mentions, and whether it expects that case to be heard with the separate Optus data breach class action. Optus's media team replied by email on 8 October, in an email signed Optus Media Team that carries no request that it be kept off the record. The same email from THE RORT also put questions for THE TRIPLE ZERO RORT, and the reply answers the email as a whole. It says:

The reply does not say whether Optus contests the allegations or whether it expects the Commissioner's case to be heard with the separate Optus data breach class action. Its sentence on the Federal Court names no matter, so this article does not say which matter it refers to. This outlet has found no decision on the allegations in the Commissioner's case. The release the reply links, which Optus dated 21 September 2026, concerns the September 2025 Triple Zero outage.

A Medibank spokesperson replied on 6 October 2026 to a separate question, about Medibank's 2023 application to restrain the Commissioner. That reply is quoted in ‘Nearly five years’.

06Newer than every data breach

Set the clock against the record. From the ACCC's report to 8 October 2026 is more than seven years. From the government's own promise, on 12 December 2019, to 8 October 2026 is nearly seven years. The review was to be completed in 2021 and reported in February 2023; this outlet found no record that the second round of changes it led to has reached Parliament.

From that promise to the penalty tiers commencing, on 11 December 2024, is almost exactly five years. The gap this article measures is that wait, not the fact that new penalties apply to later conduct.

The higher cap of 2022 and the penalty tiers of 2024 are both newer than every data breach behind a Privacy Act civil penalty case we found.

Every data breach behind a Privacy Act civil penalty case we found is older than both penalty changes this article measures: older than the higher cap of December 2022, older than the tiers of December 2024, and penalised, in the one penalty ordered, under the cap that applied before either.

If it’s a rort, we cover it.