Landmark civil penalty of AU$5.8 million issued under Australia’s Privacy Act

According to Hogan Lovells, on 9 October 2025 the Federal Court of Australia imposed a civil penalty of AU$5.8 million on Australian Clinical Labs Limited, one of the country’s largest private hospital pathology service providers, for systemic failures that led to the unauthorised access to and exfiltration of the sensitive personal information of more than 223,000 individuals.

The decision marks the first civil penalty ordered under the Privacy Act 1988 (Cth) and signals heightened regulatory scrutiny in Australia regarding data breaches. Australia’s Privacy Commissioner Carly Kind described the outcome as an “important turning point in Australian privacy enforcement,” stating that it serves as a vivid reminder to entities, particularly healthcare providers, of the consequences for serious failures to protect health information. The article notes the breach involved unauthorised access and exfiltration of health data, underlining the seriousness of the incident.