IM BLOG: Strong Penalties, Real Prosecutions
The Office of the Australian Information Commissioner (OAIC) has entered a new era of active enforcement under the Privacy Act 1988. Recent reforms have given the Commissioner the power to seek multi-million-dollar civil penalties for serious or repeated interferences with privacy - and the OAIC is now using that power.
Cases against Medibank Private, Vinomofo, and Australian Clinical Labs (ACL) show that privacy breaches once seen as reputational setbacks now carry genuine financial and legal consequences. They also establish a clear precedent: organisations must take reasonable steps to protect personal information.
These cases, all determined under Australian Privacy Principle 11.1, involved a preventable failure of governance rather than a purely technical error, underscoring that protecting personal information is no longer a compliance checkbox. It is a test of leadership, governance and strategic maturity. Organisations that fail to treat information as a managed business asset face customer backlash alongside enforceable penalties and public prosecution.
Where Businesses Failed?
Medibank Private (2024)
Failures: Outdated network segmentation, insufficient multi-factor authentication and unclear accountability for information risk. Result: Exposure of 9.7 million Australians’ data and reputational damage across global markets.
Vinomofo (2025)
Failures: Poorly planned data migration without formal risk assessment, minimal oversight of cloud environments and limited staff awareness. Result: Nearly one million records exposed during a routine migration, revealing systemic governance gaps.
Australian Clinical Labs - ACL (2025)
Failures: Inherited insecure systems following an acquisition, unencrypted legacy data and slow breach detection and notification. Result: More than 223,000 health records compromised and a $5.8 million court-imposed penalty.
What Should Have Been Done?
- Integrate governance: Build a unified framework linking privacy, cybersecurity and records management (ISO 27001 + 30301).
- Assess information as capital: Conduct lifecycle audits - creation, storage, migration and disposal - to identify exposure points.
- Embed IM into transformation: Use AS 5393:2025 for data migrations and ensure records professionals participate in mergers and acquisition due diligence.
- Demonstrate accountability: Maintain evidence of reasonable steps through documented risk assessments, access reviews and incident reports.
The Business Case for Information Stewardship
Treating information as a valued asset changes decision-making it:
- attracts customer trust and differentiates your brand in competitive markets.
- lowers the cost of compliance, insurance and crisis response.
- transforms information governance from an overhead into a source of operational resilience and reputation equity.
When information protection is framed as an investment it strengthens business performance and reduces exposure to prosecution. In an environment where the OAIC is actively enforcing the law and courts are imposing record-high penalties, being future ready means being accountable, transparent and strategically confident in how information is managed.
Bottom Line
The Privacy Act’s stronger penalty regime has made good governance a commercial necessity. Businesses that see information as a strategic asset - not a compliance cost - will be the ones that thrive in Australia’s new era of privacy accountability.
Meet your blog author:
Peta Sweeney CXRIM FRIM (Life), Information and Content Specialist, RIMPA Global