Cybersecurity Policy Report, Medical Lab Provider Fined Over Violations Leading to Australian Data Breach, (Oct 10, 2025)
By Tony Foley
The Australian Federal Court has fined Australian Clinical Labs (ACL) a total of $5.8 million Australian (US$3.8 million) in relation to a February 2022 data breach by its MedLab Pathology business that compromised the personal information of over 223,000 individuals.
The court’s decision was outlined in a news release yesterday from the Office of the Australian Information Commissioner (OAIC), which pointed out that it marked the first civil penalties ordered under the Privacy Act 1988. The court imposed the penalties as follows:
$4.2 million Australian (US$2.75 million) based on ACL’s failure to take reasonable steps to protect the personal information held by the company on MedLab Pathology’s IT systems under Australian Privacy Principle (APP) 11.1;
$800,000 Australian (US$525,000) for ACL’s failure to carry out a reasonable and expeditious assessment of whether an eligible data breach had occurred following a cyber attack on MedLab Pathology’s systems in contravention of Privacy Act section 26WH(2); and
$800,000 Australian (US$525,000) for ACL’s failure to prepare a statement and give to the OIAC, as soon as practicable, a statement concerning the eligible data breach in contravention of Privacy Act section 26WK(2).
OAIC noted that the fines imposed were based on the penalty regime in force at the time of the contraventions in February 2022, adding that, under the current penalty structure that came into effect in December 2022, the court would have been authorized to impose significant higher penalties.
“This outcome represents an important turning point in the enforcement of privacy law in Australia,” said Privacy Commissioner Carly Kind. “For the first time, a regulated entity has been subject to civil penalties under the Privacy Act, in line with the expectations of the public and the powers given to the OAIC by parliament. This should serve as a vivid reminder to entities, particularly providers operating within Australia’s healthcare system, that there will be consequences of serious failures to protect the privacy of those individuals whose healthcare and information they hold.”
News: InternationalLegislation LitigationEnforcement DataSecurity DataBreach