Privacy’s First Big Hit: Australian Clinical Labs Fined $5.8 Million for Data Breach Failures

When 86 gigabytes of patient data — including health, financial and identity information — hit the dark web after a ransomware attack, the fallout was always going to be brutal.

Now, in Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224, the Federal Court has handed down a $5.8 million penalty — marking the first civil penalty judgment under the Privacy Act.

And it’s a warning shot for every business holding personal information in Australia.

---

⚖️ The Case in a Nutshell

Australian Clinical Labs (ACL) — one of the country’s largest private pathology providers — bought Medlab Pathology in late 2021.

What it didn’t buy (or even check properly) were Medlab’s crumbling IT systems: unsupported Windows servers, weak authentication, no encryption, and logs that deleted themselves every hour.

In February 2022, the inevitable happened — a ransomware group calling itself “Quantum” infiltrated Medlab’s servers, exfiltrated 86GB of data, and dumped it online.

ACL’s response was painfully slow. Despite early signs of exfiltration, it:

• Relied almost entirely on an external consultant’s limited review;

• Concluded (wrongly) that no data had been stolen;

• Ignored early warnings from the Australian Cyber Security Centre; and

• Waited over three months before notifying the OAIC.

---

🧩 The Breaches

Justice Halley found ACL had seriously interfered with the privacy of 223,000 individuals through three major contraventions of the Privacy Act 1988 (Cth):

1. Breach of APP 11.1 — Failure to take reasonable steps to protect personal information from unauthorised access or disclosure.

   • The Medlab systems were riddled with vulnerabilities.

   • ACL failed to identify or patch them after acquisition.

   • Overreliance on third-party providers compounded the problem.

2. Breach of s 26WH(2) — Failure to carry out a reasonable and expeditious assessment of whether the incident was an eligible data breach.

   • ACL’s “assessment” was based on incomplete data and unsupported assumptions.

   • The Court called it unreasonable and inadequate.

3. Breach of s 26WK(2) — Failure to notify the Commissioner as soon as practicable after forming the belief that an eligible data breach had occurred.

   • ACL delayed nearly a month after confirmation that personal and financial information was on the dark web.

Each breach amounted to a “serious interference with privacy” under s 13G, attracting civil penalties.

---

💰 The Penalty Breakdown

ACL agreed to pay a total of $5.8 million:

ACL also agreed to pay $400,000 in costs.

While the theoretical maximum exceeded $495 billion, the Court accepted the agreed penalty as being within the permissible range — particularly given ACL’s cooperation, remorse, and post-breach reforms.

---

⚙️ “Reasonable Steps” — The New Legal Standard

This judgment finally gives judicial colour to APP 11.1’s “reasonable steps” requirement.
Justice Halley said reasonableness must be assessed objectively, considering:

• the sensitivity of the information;

• the potential harm from unauthorised disclosure;

• the size and sophistication of the entity;

• the cyber risk landscape; and

• any prior threats or attacks.

Critically, “reasonable steps” cannot be outsourced — delegation to an IT vendor does not discharge responsibility.  ACL’s overreliance on StickmanCyber was no defence.

---

🚨 Why It Matters

This decision rewrites the playbook for privacy compliance in Australia:

• Civil penalties are real — the OAIC now has judicial precedent for enforcement.

• Each affected individual counts — the Court held that each person’s privacy breach is a separate contravention.

• “Serious” breaches will be taken seriously — health and financial data, inadequate security, and systemic failures will all tip the scales.

• M&A due diligence must cover cybersecurity — buying a business means inheriting its data liabilities.

• Notification delays will cost you — the OAIC expects “as soon as practicable,” not weeks or months.

---

💡 IP Mojo Take

Privacy can’t be treated anymore like it is just a paperwork exercise — it’s a governance test you can fail in the Federal Court.

This case cements privacy law as a compliance discipline with teeth.

The OAIC now has a roadmap for future actions — and the Court has made clear that “reasonable steps” means measurable, auditable, and proactive security governance.

For corporate Australia, this is ASIC v RI Advice for the health sector — but under the Privacy Act instead of the Corporations Act.

Expect to see:

• Increased OAIC enforcement in healthcare, finance, and tech sectors;

• Board-level scrutiny of data protection measures; and

• Class actions waiting in the wings, armed with a judicial finding of “serious interference with privacy.”

The privacy bar has just been raised — permanently.