Reflections on Privacy Awareness Week 2026: Building Trust Through Privacy Complaint Resolution
The Office of the Australian Information Commissioner’s theme for Privacy Awareness Week 2026 is: ‘Trust is built here. In every privacy complaint. In every resolution.’ This theme highlights the critical role that privacy complaint handling plays in strengthening public confidence in how organisations manage their personal information. It signals a growing regulatory expectation that organisations […]
ReadmoreFacial recognition technology on trial
On 4 February 2026, the Administrative Review Tribunal (ART) delivered its long-awaited decision in Bunnings Group Limited and Privacy Commissioner (Guidance and Appeals Panel) [2026] ARTA 130.[1] Following an appeal by Bunnings Group Limited (Bunnings) of the Australian Privacy Commissioner’s 2024 determination, the ART has now held that Bunnings’ use of facial recognition technology […]
ReadmoreNo likes before sixteen: Australia’s social media minimum age restriction
On 10 December 2025, Australia became the first country to enforce a minimum age requirement for social media accounts. This landmark reform introduces the Social Media Minimum Age obligation (SMMA) under Part 4A of the Online Safety Act 2021 (Cth) (OSA), requiring platforms to take reasonable steps to prevent users under 16 from creating or […]
ReadmoreFederal Court confirms $5.8m penalty against Australian Clinical Labs over data breach
The Federal Court has confirmed Australian Clinical Labs (ACL) must pay a $5.8m civil penalty along with $400,000 in legal costs to settle proceedings commenced by the Australian Information Commissioner (OAIC).[1] The proceedings arose from the OAIC’s investigation into a cybersecurity attack on Medlab Pathology (Medlab) that exposed personal information relating to approximately 223,000 Australians,[2] […]
ReadmoreDeveloping or procuring AI? Here’s what you need to know
AI tools are bringing paradigm-shifting opportunities that will transform the way we work and interact. In a recent McKinsey survey, 78% of respondents indicated that their organisation uses at least some AI tools – an increase from only 50% prior to the generative AI boom of late 2022, spurred on by the public release of […]
ReadmoreNew mandatory ransomware payment reporting obligations now in force
Introduction Australia has taken a bold step in strengthening its cyber resilience with the introduction of the mandatory ransomware and cyber extortion payment reporting regime under Part 3 of the Cyber Security Act 2024 (Cyber Security Act). Effective from 30 May 2025, this new regime requires certain entities – including businesses with an annual turnover exceeding $3 million and […]
Readmore
