Australian Clinical Labs hit with first civil penalty under Privacy Act for 2022 data breach

Australia’s Federal Court ordered Australian Clinical Labs (ACL) to pay A$5.8 million in civil penalties following a 2022 data breach at its Medlab Pathology division that exposed data of over 223,000 individuals. 

‍

This marks the first civil penalty under Australia’s Privacy Act 1988 (Cth). The court found ACL failed to take reasonable steps to secure personal data, did not promptly investigate or notify the Australian Information Commissioner of the breach, and neglected its obligations under the Act. The ruling is described as a turning point for privacy enforcement in Australia and warns organisations that serious data failures will now incur meaningful penalties.

‍