Rochina Iannella, Stephens Lawyers & Consultants
In this update, Stephens Lawyers & Consultants provides a review of selected determinations made (and published) by the Office of the Australian Information Commissioner (OAIC) during the period August 2024 to 30 September 2026 in relation to privacy breaches in which compensation was awarded – and the factors that the OAIC takes into account in assessing whether compensation should be awarded to the complainant.
During the period August 2024 to 30 September 2026 there have been only four published determinations by the OAIC where compensation has been awarded, with compensation awards for non-economic loss for privacy breaches ranging from $7,500.00 to $10,000.00, a little higher than for the immediately preceding period of October 2022 to July 2024. Whereas for the period of 2016 to September 2022, the awards for compensation ranged from about $1,000 to $20,000. However, this does not take into account the amount of compensation awarded in the recent determination of ‘BAM’ and American Express Australia Limited in which the amount of damages and compensation awarded have not been disclosed by the Australian Privacy Commissioner[i].
The OAIC has been involved in the determination of many privacy breach complaints since about 2016. The decline in OAIC compensation determinations is reflective of the OAIC new approach to handling complaints and an increase in the number of class actions for data breaches and representative complaints made to the OAIC for investigation and determination of compensation. [READ MORE]
The OAIC privacy breach Determinations indicate the factors that are taken into account by the Australian Information Commissioner in deciding whether to make any compensation award for a privacy breach and the amount to be awarded. Each case is determined on its merits having regard to the documentary evidence submitted to the OAIC which supports the privacy breach and the claim for compensation.
| Factors taken into account by the OAIC in determining privacy breach compensation
· The type and sensitivity of the personal information disclosed. · The number of people to whom the personal information has been disclosed – as well as evidence of the number and type of people who have actually accessed/seen it. · The complainant’s reaction to the privacy breach – including level and duration of the hurt feelings, distress and anxiety resulting directly from the privacy breach – and the evidence supporting that (such as statutory declarations and, where relevant, medical/psychologist reports). · Evidence of the actual costs/expenses incurred as a result of the privacy breach and the reasonableness of same. · Evidence of any financial and other losses incurred as result of the privacy breach. · The security measures in place and other steps taken to protect the personal information held and to reduce the risk of a privacy breach. · For an aggravated damages claim, the respondent’s conduct/behaviour upon being informed or becoming aware of the privacy breach – including any evidence showing if the respondent’s conduct was high handed, malicious, insulting or oppressive. |
A SUMMARY OF SELECTED OAIC DETERMINATIONS MADE & PUBLISHED by OAIC DURING THE PERIOD AUGUST 2024 – SEPTEMBER 2026 in which COMPENSATION WAS AWARDED
| SELECTED DETERMINATIONS Made & Published by OAIC
(August 2024 to September 2026) |
PRIVACY PRINCIPLES BREACHED |
WHERE COMPENSATION WAS AWARDED |
| ‘BAM’ and American Express Australia Limited [2026] [ii]
(15 June 2026) |
Privacy Act 1988 (Cth) s 13(1) – APP 11.1 (AMEX’s complaint handling procedures as against the requirements of APP 1.2 considered) |
SPECIFIED AMOUNTS (not published by OAIC) for:- – Economic loss – Non-economic loss – Reimbursement of expenses and a Written apology |
|
‘AYN’ and Fortrend Securities Pty Ltd (Privacy) [2025] AICmr 167 (15 September 2025) |
Privacy Act 1988 (Cth) s 7B(3)(a) – APP 6.1 |
$10,000 for non-economic loss; $3,500 aggravated damages A Written apology |
|
‘AXF’ and ‘AXG’ (Privacy) [2025] AICmr 121 (27 June, 2025) |
Privacy Act 1988 (Cth) s 40(1) – APP 11.1 |
$7,500 for non-economic loss |
|
‘ATQ’ and CEO of Services Australia (Privacy) [2025] AICmr 19 (23 January 2025) Heard by: Privacy Commissioner, Carly Kind |
Privacy Act 1988 (Cth) s 52 (i) (b) APP 11.1 – APP 10.2 – APP 6.1 |
$10,000 for non-economic loss;
A Written apology |
‘BAM’ and American Express Australia Limited [2026]
Date of Decision: 15 June 2026
Heard by: Australian Privacy Commissioner, Carly Kind (‘Commissioner’)
Type of Personal Information Disclosed/Involved: The complainant, a former AMEX customer, alleged that an AMEX employee (with whom the complainant had formerly had a personal relationship) had accessed their account and personal information held on AMEX’s systems – both during the relationship and after its breakdown – for purposes outside of legitimate business purposes.
Privacy Breach:
Breach of APP 11.1 – which requires organisations to take reasonable steps to protect personal information from misuse and unauthorised access, use or disclosure.
The Commissioner also considered APP 1.2 which requires organisations to take reasonable steps to implement practices, procedures and systems that will enable them to comply with the APPs (APP 1.2(a)) and deal with complaints and enquiries about their APP compliance (APP 1.2(b)) – and provides guidance on how these obligations can be applied in practice.
Damages Award: The Commissioner determined not to publish the amount of damages or compensation awarded in this case.
Damages for specified amounts were awarded to the complainant for:-
- Economic loss;
- Non-economic loss caused by the interference with the complainant’s privacy; and
- Reimbursement of expenses the complainant incurred making the complaint.[iii]
…………………………………………………………………………………………..
‘AYN’ and Fortrend Securities Pty Ltd (Privacy) [2025] AICmr 167
Date of Decision: 15 September 2025
Heard by: Justin Lodge, Acting General Manager, Privacy Case Management
Delegate of the Australian Information Commissioner (‘Commissioner’)
Type of Personal Information Disclosed/Involved: Sensitive health information – contained in a Medical Certificate provided to the respondent by the complainant.
The complainant was a former employee of the respondent. After handing in their resignation, the complainant alleged they suffered hostility and aggression from the respondent’s managing director during the 30 day notice period, causing the complainant to feel anxious and emotionally distressed. As a result, the complainant sought medical advice from a psychiatrist who provided to the complainant a Medical Certificate stating that the complainant was unfit for work (‘Medical Certificate’). The complainant provided a copy of the Medical Certificate to the respondent’s Managing Director by email. The complainant alleged that after leaving that job, the respondent’s Managing Director told the complainant’s clients that the complainant was suffering from a nervous breakdown and was unfit to continue managing client portfolios – and later posted the complainant’s Medical Certificate to one of those clients “to prove it”[iv].
Privacy Breach:
Breach of APP 6.1: The Commissioner found that the respondent had breached APP 6.1 when the respondent’s Managing Director sent the complainant’s Medical Certificate to a third party (who was the complainant’s client) thereby disclosing the complainant’s personal information for an unrelated secondary purpose, in circumstances where the complainant did not consent and the exceptions in APP 6.2 did not apply[v].
The Commissioner found that while the respondent denied having disclosed the Medical Certificate to the Client, the information provided by the respondent was unreliable, with few particulars about the events surrounding the alleged disclosure. On the other hand, the complainant provided a statutory declaration with a detailed account of what occurred, supported by contemporaneous file notes and emails. As a result, the Commissioner found that:-
- on balance, the respondent disclosed the complainant’s Medical Certificate to the Client; and
- as the complainant was no longer employed by the respondent at the time of the disclosure, and there was no apparent employment related purpose for disclosing the Medical Certificate to the Client, the disclosure was not related to the respondent’s employment relationship with the complainant[vi].
Damages Award:
$10,000 for non-economic loss – The Commissioner accepted the evidence submitted by the complainant which included a statutory declaration and a letter from their psychiatrist supporting their claim that they had suffered embarrassment, distress as well as anxiety and depression as a result of the disclosure; and
$3,500 for aggravated damages – In making the determination for aggravated damages, the Commissioner:-
- accepted the complainant’s submission that the respondent disclosed the complainant’s sensitive health information contained in the Medical Certificate to the Client with the intent to harm the complainant; and
- expressly considered and noted “the respondent’s lack of cooperation during the OAIC’s investigation, including that throughout the investigation the respondent has provided the OAIC with unreliable and inaccurate information”[vii].
…………………………………………………………………………………….
‘AXF’ and ‘AXG’ (Privacy) [2025] AICmr 121
Date of Decision: 27 June, 2025
Heard by: Andre Castaldi, Delegate of the Australian Information Commissioner (‘Commissioner’)
Type of Personal Information Disclosed/Involved: The complainant’s sensitive personal information contained in the complainant’s medical records held by the respondent.
Privacy Breach: The respondent was a medical practitioner specialising in psychiatry and the complainant was a patient of the respondent between March 2016 and July 2019, after being referred to the respondent by the complainant’s former psychiatrist (‘former psychiatrist’). Upon referral, the former psychiatrist provided the respondent with the complainant’s medical records in their possession which included handwritten medical file notes going back some 20 years (‘historical medical records’).
During 2021, the complainant made 4 separate requests to the respondent, seeking access to their historical medical records. The respondent failed to provide access, submitting that in approximately June or August 2021, he ‘inadvertently securely destroyed’ the complainant’s historical medical records during the respondent’s renovation process, via a third-party service provider – though during preliminary OAIC enquiries, the OAIC was informed by the respondent’s former representative that an ‘internal error’ resulted in those medical records being inadvertently placed in the wrong filing cabinet and destroyed[viii].
On 21 December, the Commissioner opened their investigation under S40(1) of the Privacy Act into the respondent’s acts and practices – in particular, an APP entity’s obligations under APP 11.1 to take reasonable steps to protect the personal information it holds from misuse, interference and loss, and unauthorised access, modification or disclosure.
Breach of APP 11.1 – The Commissioner found that the respondent had breaches APP 11.1 by failing to take such steps as were reasonable in the circumstances to protect the complainant’s personal information from loss.
In determining the ‘reasonable steps’ required under APP 11.1, an objective test is applied which considers how a reasonable person, who is properly informed, would be expected to act in the circumstances. Circumstances considered relevant include:-
- Nature of the entity – including large and how well resourced it is;
- Type of personal information held – in particular, the more sensitive the information the higher the level of protection required; and
- Possible adverse consequences – including future difficulties faced by the complainant as a result of the loss.
In this case, the Commissioner:-
- considered the steps taken by the respondent and found that there were other reasonable steps that the respondent could have taken to protect the personal information it held from loss – which the Commissioner set out[ix] – but failed to do so; and
- noted that while the respondent had submitted that his current practice was to store all patient records digitally to mitigate the risk of inadvertent loss of patient records, that had not been done in time to protect the complainant’s personal information[x].
Damages Award:
$7,500 for non-economic loss – caused by the interference with the complainant’s privacy.
The Commissioner took into account:-
- the complainant’s complex medical history over more than two decades;
- the complainant’s evidence submitted in support of her claim, including statutory declarations from her former psychiatrist, social worker, friend and mother which described the impact that the respondent’s interference with her privacy had on her;
- the fact that the complainant’s personal information which was destroyed by the respondent was ‘sensitive information’; and
- the inadequacy of the steps that the respondent took to protect the sensitive information from loss.
In deciding not to award any Aggravated Damages, the Commissioner noted that the respondent “appears to have attempted to engage with the complainant in good faith to resolve her complaint and has apologised”[xi] – verbally and in writing.[xii]
The complainant’s claims for other Economic Losses arising from the privacy breach (including medical costs and out of pocket expenses) were also considered but denied, primarily due to the complainant’s failure to provide evidence and details to substantiate those claims.
© Stephens Lawyers & Consultants. 9 October, 2026; Authored by Rochina Iannella (Consultant, Stephens Lawyers & Consultants).
This article is not intended to be a substitute for obtaining legal advice.
For further information contact:
Katarina Klaric
Principal
Stephens Lawyers & Consultants
Melbourne Head Office
Level 40, 140 William Street, Melbourne VIC 3000
Phone: (03) 8636 9100; Fax: (03) 8636 9199
Sydney Office
Level 29, Chifley Tower, 2 Chifley Square, Sydney, N.S.W. 2000
Phone: (02) 9238 8028
Email: [email protected]
Website: www.stephens.com.au
All Correspondence to:
PO Box 16010
Collins Street West
Melbourne VIC 8007
To register for newsletter updates and to send your comments and feedback, please email [email protected]
[i] OAIC, Media Release, “Australian Privacy Commissioner orders American Express Australia Limited to compensate complainant following interference in privacy”, 15 June 2026 – Australian Privacy Commissioner orders American Express Australia Limited to compensate complainant following interference in privacy | OAIC
[ii] See OAIC Privacy Commissioner’s Report of Investigation into AMEX, 15 June 2026 – https://www.oaic.gov.au/__data/assets/pdf_file/0031/264919/Report-of-investigation-into-AMEX.pdf
[iii] OAIC Media Release: ‘Australian Privacy Commissioner orders American Express Australia Limited to compensate complainant following interference in privacy’; 15 June 2026 – Op Cit.
[iv] ‘AYN’ and Fortrend Securities Pty Ltd (Privacy) [2025] AICmr 167 at [10]
[v] Ibid. at [41]
[vi] Ibid. at [32]
[vii] Ibid. at [63]
[viii] ‘AXF’ and ‘AXG’ (Privacy) [2025] AICmr 121 at [14]
[ix] Ibid. at [39]
[x] Ibid. at [40]
[xi] Ibid. at [67]
[xii] Ibid. at [52] [53]