For two decades, Australian privacy law was the polite cousin of global data protection regimes: principles-based, low-penalty, and largely complaint-driven. That era is ending in a Federal Court in Sydney. Australian Information Commissioner v Medibank Private Limited, filed by the Office of the Australian Information Commissioner (OAIC) in June 2024 and continuing into 2026, is the first real test of the upgraded penalty regime Parliament rushed through after the Medibank and Optus breaches of late 2022. Combined with the 10 June 2025 commencement of a new statutory tort for serious invasions of privacy under the Privacy and Other Legislation Amendment Act 2024, Australia has crossed into a recognisably GDPR-style enforcement landscape — and the country's digital economy is about to find out what that costs.
The case in brief
The facts are not in serious dispute. In October 2022, an attacker — later linked by Australian authorities to a Russia-based cybercrime group — exfiltrated personal and sensitive health information belonging to roughly 9.7 million current and former Medibank customers, including claims data, diagnoses and procedures. After Medibank refused to pay a ransom, the attacker dumped data on the dark web in batches over several weeks, including files curated to maximise harm to specific patient cohorts.
The OAIC's claim, filed under section 13G of the Privacy Act 1988, alleges that Medibank engaged in a serious interference with the privacy of those individuals by failing to take reasonable steps to protect their personal information, as required by Australian Privacy Principle 11.1. The pleading runs to a potential exposure that, on the regulator's theory, treats each affected individual as a separate contravention. Under the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022, the maximum civil penalty for a serious or repeated contravention by a body corporate is the greater of A$50 million, three times the benefit obtained, or 30 per cent of adjusted turnover in the relevant period — figures consciously modelled on the European General Data Protection Regulation.
Why this is Australia's GDPR moment
Pre-2022, the largest civil penalty for an Australian Privacy Act breach was effectively theoretical: the old cap of A$2.22 million was rarely sought and never pushed hard. The reform package, fast-tracked after the Optus breach by then-Attorney-General Mark Dreyfus, did three things at once: raised the headline penalty into GDPR territory, expanded the Information Commissioner's investigative powers, and clarified extraterritorial reach over foreign businesses with an "Australian link".
The 2024 amendments went further. They introduced:
- A statutory tort for serious invasions of privacy, allowing individuals to sue directly for intentional or reckless invasions — including misuse of information — that commenced on 10 June 2025.
- A children's online privacy code, with the OAIC required to develop binding rules.
- New transparency obligations around automated decision-making affecting individuals' rights.
- Criminal offences for doxxing.
Taken together, Australia now has a privacy framework whose enforcement architecture, on paper, is no less assertive than the EU's.
The pro-innovation reading
It would be easy — and wrong — to treat this as a cause for alarm about Australia's digital competitiveness. Strong, predictable privacy enforcement is not the enemy of innovation; arbitrary enforcement is. The Medibank breach demonstrably harmed real people, including individuals whose mental health and reproductive health information was weaponised against them. A regime that imposes a meaningful penalty on a A$30 billion ASX-listed insurer for failing to take basic steps — multi-factor authentication on a privileged administrator account was, on the public record, the proximate failure — is a regime that aligns commercial incentives with the duty of care customers already assume exists.
What matters now is how the new regime is operationalised. Three things will determine whether Australia ends up with a GDPR-style success or a GDPR-style drag on the digital economy.
1. Penalty calibration must reflect culpability, not headlines
The temptation, in a first major case, will be to seek a number large enough to validate the new regime. Courts should resist treating each affected individual as a discrete contravention without close analysis — an approach that mechanically produces astronomical figures and converts a deterrence tool into a corporate-death weapon. European supervisory authorities have, over GDPR's lifespan, learned to scale penalties to turnover, harm and remediation. Australian courts now have the chance to start that learning curve from a better place.
2. The statutory tort must not become a class-action lottery
The new tort's "serious" threshold and fault element (intentional or reckless conduct) were carefully drafted to filter out trivial claims. Plaintiff firms will test those limits. If the courts allow the tort to slide into a strict-liability regime by another name, the chilling effect on data-driven products — particularly in health, fintech and AI — will be real, and disproportionate to the harm prevented.
3. Small business and start-ups need a glide path
Australia's longstanding small-business exemption from the Privacy Act is on borrowed time; the government has signalled its removal in a later tranche. Removing it without a calibrated compliance pathway — guidance, safe harbours, simplified codes — will hit exactly the cohort least able to absorb compliance overhead, while doing little to address systemic risk at the top of the market.
Where this lands
OAIC v Medibank will likely be remembered less for its eventual dollar figure than for the doctrinal scaffolding it builds around "reasonable steps", the "serious or repeated" threshold, and the unit of contravention. Done well, it will give Australian businesses a clear, costly, but workable standard — one that rewards firms investing in security and exposes those that don't. Done badly, it will give Australia the regulatory weight of GDPR without GDPR's accumulated jurisprudence to soften the edges.
Either way, the era of polite Australian privacy law is over. What replaces it will shape the country's digital economy for a decade.