Australian Information Commissioner v Australian Clinical Labs Limited (No 2)

[2025] FCA 1224

civil penalty8 Oct 2025Penalty $5.80M

Respondent

Australian Clinical Labs Limited

Facts

A Feb 2022 cyberattack on ACL's Medlab Pathology systems led to data on over 223,000 people being exfiltrated. ACL failed to take reasonable security steps, did not assess the suspected eligible data breach quickly enough and was slow to notify the Commissioner. First civil penalties ordered under the Privacy Act; ACL admitted liability and penalty was jointly proposed.

Outcome

The Federal Court ordered Australian Clinical Labs Limited to pay a civil penalty of $5,800,000 (8 October 2025). Other orders or outcomes: Penalty split: $4.2m (APP 11.1 / s 13G(a)), $800,000 (s 26WH(2)), $800,000 (s 26WK(2)).

What does this action mean for your compliance program?Hand this question to the Rules Mate AI advisor — it is already written for you. Cited answers from the live obligation, regulator and enforcement corpus.Ask the AI advisor

Read the source

https://www.oaic.gov.au/news/media-centre/australian-clinical-labs-ordered-to-pay-penalties-in-relation-to-medlab-pathology-data-breach-in-first-for-privacy-act

Rules Mate links to the regulator's own publication. We do not republish full decision text. Always verify the latest status against the source before acting.