#144 The era of enforcement begins - breaking down privacy's first ever civil penalty

This week we analyse the implications of the first ever civil penalties ordered under the Privacy Act.In October, the Federal Court ordered that Australian Clinical Labs pay $5.8 million in civil penalties in relation to a data breach by its Medlab Pathology business in February 2022 that led tothe exposure of the personal information of over 223,000 people.We discuss the key insights for cyber, privacy and risk practitioners emerging from the judgement. Links:OAIC statement https://www.oaic.gov.au/news/media-centre/australian-clinical-labs-ordered-to-pay-penalties-in-relation-to-medlab-pathology-data-breach-in-first-for-privacy-actFederal Court judgement https://www.judgments.fedcourt.gov.au/judgments/Judgments/fca/single/2025/2025fca1224OAIC guidance on APP 11 "reasonable steps" (OAIC) https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-informationCredits:Editing and post-production by Martin Franklin (East Coast Studio) ⁠www.eastcoaststudio.com.au⁠Music by Bensound.com