Australia's First Privacy Act Penalty: Clinical Labs

For the first time, an Australian court ordered a company to pay a penalty under the Privacy Act. The case involved a pathology business and a slow response to a breach.

By Siddharth ShankarUpdated October 11, 2026

A penalty under a privacy law is not just about what a company lost. It signals what regulators and courts expect companies to do to protect people's information, and how fast they should act when it fails.

What happened

The OAIC says Justice Halley of the Federal Court ordered Australian Clinical Labs (ACL) to pay $5.8 million in civil penalties on October 8, 2025, in relation to a February 2022 breach affecting Medlab Pathology. The OAIC announced it on October 9. It was the first civil penalty ordered under the Privacy Act 1988.

The personal information of over 223,000 individuals was accessed and exfiltrated.

How it worked

The release describes a cyber attack on Medlab's IT systems but does not give the method. The legal findings focus on what the company did and did not do. The penalty breaks down as $4.2 million for failing to take reasonable steps to protect personal information, $800,000 for failing to assess the eligible data breach reasonably and expeditiously, and $800,000 for failing to notify the Commissioner as soon as practicable.

In other words, the court examined three questions: whether the company protected the data, whether it assessed the breach quickly and whether it told the regulator promptly.

What was exposed

The release does not list the data types and does not say whether the data was published. What it does say is that the contraventions were "extensive and significant" and that the conduct had potential to cause significant harm, including financial harm, distress and psychological harm. A pathology business holds health information, but we cannot say which records were taken.

How it ended

ACL cooperated, apologized and admitted liability. The penalties are paid to the government. The release does not describe any payment to the people whose information was taken.

A timeline of the case

The breach occurred in February 2022. The Federal Court ordered penalties on October 8, 2025 and the OAIC announced them the next day. That is more than three years between the breach and the outcome.

The delay is a reminder that regulatory enforcement is slow. People affected by a breach cannot wait for a penalty to take protective steps.

Key facts at a glance

• Penalty: $5.8 million, ordered October 8, 2025
• Breakdown: $4.2 million, $800,000 and $800,000
• People affected: over 223,000
• Breach: February 2022
• Judge: Justice Halley, Federal Court
• Significance: first civil penalty under the Privacy Act 1988

Why this case matters

Notification and assessment duties are as important as technical security. A company that discovers a breach and acts slowly leaves people exposed for longer. The court's penalties for assessment and notification show that delay counts as a failure in its own right.

For individuals, the lesson is that a penalty does not protect you. It punishes the company. Your protection is your own habits.

What you can do

What the three penalties teach

The three parts of the penalty correspond to three duties. Protect the data before anything goes wrong. Assess a suspected breach quickly. Tell the regulator as soon as practicable. The court found failures on all three.

It is common to think that security begins and ends with technology. This case shows that process counts: a company that cannot work out quickly what happened will also struggle to tell the people affected.

What the release does not say

The release does not say whether any of the data was misused. For another Australian health data breach with a sanctions outcome, see Medibank.

To turn the lesson into action, our guides explain what each type of breached data means, how to tell a real breach notice from a phishing message and what to do if your phone number was in a breach. You can also try our free email exposure check.