Australian Clinical Labs ordered to pay penalties in relation to Medlab Pathology data
breach in first for Privacy Act
Published: 09 October 2025
The Federal Court yesterday ordered that Australian Clinical Labs (
ACL) pay $5.8 mil ion in
civil penalties in relation to a data breach by its Medlab Pathology business in February
2022. The breach resulted in the unauthorised access and exfiltration of the personal
information of over 223,000 individuals.
These are the first civil penalties ordered under the
Privacy Act 1988 (Cth).
Australian Information Commissioner Elizabeth Tydd welcomed the Court's orders, stating
that they “provide an important reminder to all APP entities that they must remain vigilant in
securing and responsibly managing the personal information they hold.
“These orders also represent a notable deterrent and signal to organisations to ensure they
undertake reasonable and expeditious investigations of potential data breaches and report
them to the Of ice of the Australian Information Commissioner appropriately.
“Entities holding sensitive data need to be responsive to the heightened requirements for
securing this information as future action wil be subject to higher penalty provisions now
available under the Privacy Act".
The Federal Court has made orders imposing the following penalties:
• a penalty of $4.2 mil ion for ACL's failure to take reasonable steps to protect the
personal information held by ACL on Medlab Pathology’s IT systems under Australian
Privacy Principle 11.1, which amounted to more than to 223,000 contraventions of s
13G(a) of the Privacy Act;
• a penalty of $800,000 for ACL’s failure to carry out a reasonable and expeditious
assessment of whether an eligible data breach had occurred following the
cyberattack on the Medlab Pathology IT systems in February 2022, in contravention
of s 26WH(2) of the Privacy Act; and
• a penalty of $800,000 for ACL’s failures to prepare and give to the Australian
Information Commissioner, as soon as practicable, a statement concerning the
eligible data breach, in contravention of s 26WK(2) of the Privacy Act.
Justice Halley said in his judgment that the contraventions were “extensive and significant.”
His Honour also found that:
• ‘ACL’s most senior management were involved in the decision making around the
integration of Medlab’s IT Systems into ACL’s core environment and ACL’s response
to the Medlab Cyberattack, including whether it amounted to an eligible data breach.’
• ‘ACL’s contraventions … resulted from its failure to act with suf icient care and
diligence in managing the risk of a cyberattack on the Medlab IT Systems’
• ‘ACL’s contravening conduct … had at least the potential to cause significant harm to
individuals whose information had been exfiltrated, including financial harm, distress
or psychological harms, and material inconvenience.’
• ‘the contraventions had the potential to have a broader impact on public trust in
entities holding private and sensitive information of individuals.’
His Honour identified several factors that reduced the penalty that was imposed. These
included that that ‘ACL ... cooperated with the investigation undertaken by the office of the
Commissioner', and that it had commenced ‘a program of works to uplift the company’s
cybersecurity capabilities’ which ‘satisfied [his Honour] that these actions demonstrate that
ACL has sought, and continues to seek, to take meaningful steps to develop a satisfactory
culture of compliance.’ His Honour also took into account the apologies made by ACL and
the fact that it had admitted liability.
ACL admit ed the contraventions, consented to orders being made and the parties made
joint submissions on liability and penalty.
The penalties were imposed under the penalty regime which was in force at the time of the
contraventions, with a maximum penalty of $2.22 mil ion per contravention. The new penalty
regime that came into force on 13 December 2022 allows the Court to impose much higher
penalties for serious interferences with privacy. Under the new regime, maximum penalties
per contravention can be as much as $50 mil ion, three times the benefit derived from the
conduct or up to the 30% of a business’s annual turnover per contravention.
Privacy Commissioner Carly Kind said, “This outcome represents an important turning point
in the enforcement of privacy law in Australia. For the first time, a regulated entity has been
subject to civil penalties under the Privacy Act, in line with the expectations of the public and
the powers given to the OAIC by parliament. This should serve as a vivid reminder to
entities, particularly providers operating within Australia’s healthcare system, that there wil
be consequences of serious failures to protect the privacy of those individuals whose
healthcare and information they hold.”
Download
•
Australian Information Commissioner v Australian Clinical Labs Limited (No2) [2025] FCA 1224- external site
Background
The Privacy Act includes 13 legally binding
Australian Privacy Principles (APPs). The APPs
apply to organisations and government agencies covered by the Privacy Act (APP entities).
At the time of the contraventions in issue in this proceeding, under section 13G(a) of the
Privacy Act, an APP entity wil be liable for a civil penalty if it does an act, or engages in a
practice, that is a serious interference with the privacy of an individual.
The Federal Court can impose a civil penalty of up to $2.22 mil ion for each contravention of
section 13G (as per the penalty rate applicable from May 2021 to September 2022).
Whether a civil penalty order is made, and the amount, is up to the Court.
Since this matter was filed, the maximum civil penalties for serious interferences with privacy
for a body incorporate have increased considerably to not more than the greater of:
• $50 mil ion;
• if a Court can determine the value of the benefit that the body corporate (and its
related bodies corporate) directly or indirectly obtained from the contravention – three
times the value of that benefit; and
• if a Court cannot determine the value of that benefit – 30% of the adjusted turnover of
the body corporate during the breach turnover period (minimum 12 months) for the
contravention.
These new penalties were not applicable to the Australian Information Commissioner’s
proceedings against ACL given the conduct in issue occurred before the commencement of
the updated penalty provisions.
The OAIC
commenced a Commissioner-initiated investigation into ACL in relation to its data
breach in December 2022.
