OAIC

Under the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.

From a phased commencement, APP entities using ADM must disclose in Privacy Policy.

CDR Action Initiation lets accredited recipients initiate payments + actions on consumer behalf.

APP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.

Before disclosing personal information overseas, APP 8 requires reasonable steps so the recipient meets the APPs — unless an exception applies. Steps and exceptions.

Individuals can ask to access (APP 12) and correct (APP 13) the personal information you hold — the strict response times, allowable refusals and how to comply.

Credit providers and CRBs must adhere to the CR Code on collection, use, disclosure, hardship and dispute resolution.

Banking, energy and (soon) non-bank lending data sharing — accredited participants must comply with privacy safeguards.

FOI Act 1982 — Commonwealth agencies + ministers must respond to access requests within 30 days.

Banking data holders must share consumer data with accredited recipients on consumer consent.

APP 7 restricts using or disclosing personal information for direct marketing and requires a simple opt-out — when it applies, the exceptions and penalties.

OAIC developing mandatory children's online privacy code (in force December 2026).

Tranche 2 reforms in scoping — information controllers + processors regime.

Every APP entity needs a clearly-expressed Privacy Policy covering APP 1.4 requirements.

APP 5 requires notice of identity, purposes, recipients, consequences of not providing info, and where Privacy Policy lives.

Removing the Privacy Act small business exemption (<$3M turnover) is proposed for a future reform tranche — agreed in principle, not yet law.

Energy retailers + distributors must share data via CDR.

APP entities making decisions about individuals using ADM must disclose this in privacy policy from December 2026.

From June 2025 — serious invasion of privacy actionable in tort.

Where reasonable, individuals must be able to deal with you anonymously or under a pseudonym.

September 2022 Optus breach exposed ~10M customer records. OAIC alleges APP 11 failures + delayed notification.

OAIC investigated multiple SMB-scale breaches in 2024 — including in legal, retail, healthcare. Most resolved without penalty but documented APP 11 reasonable-steps + NDB notification expectations.

Class action + OAIC determination on Medibank Oct 2022 data breach affecting ~9.7M customers + their families.

Class action by ~9.8M Optus customers affected by September 2022 data breach.

Both retailers operated in-store facial recognition systems for loss-prevention. OAIC found inadequate notification and unjustified breach of APP 3.3 (sensitive information).

Bunnings operated facial recognition in stores for loss prevention without proper notice + consent for sensitive (biometric) information.

Kmart operated facial recognition for loss prevention; same proceedings as Bunnings determination 2024.

Following the February 2022 Medlab Pathology breach, OAIC alleges ACL failed to take reasonable steps to protect personal information and failed to properly notify the breach.

March 2023 Latitude breach exposed personal info of ~14M customers including 7.9M driver licences.

Follow-up compliance from 2021 determination + ongoing biometric processing detected.

The October 2022 Medibank breach exposed personal information of approximately 9.7 million current and former customers. OAIC alleges Medibank failed to take reasonable steps to protect personal information.

Health Engine forwarded patient data to insurance brokers without proper consent.

Clearview AI scraped publicly available images from the web and used them to build a facial-recognition tool that was offered to Australian police agencies.

7-Eleven collected facial images and faceprints from customers via in-store tablets as part of a customer feedback program. Consent processes were inadequate.

Uber failed to protect personal information of 1.2M Australian customers/drivers in the 2016 breach, and concealed the breach for over a year by paying the attacker as a 'bug bounty'.

PageUp HR software experienced a security incident potentially exposing recruitment data of major Australian employers (CBA, Telstra, Coles, NAB). Quick public notification.