Facial recognition technology on trial
On 4 February 2026, the Administrative Review Tribunal (ART) delivered its long-awaited decision in Bunnings Group Limited and Privacy Commissioner (Guidance and Appeals Panel) [2026] ARTA 130.[1] Following an appeal by Bunnings Group Limited (Bunnings) of the Australian Privacy Commissioner’s 2024 determination, the ART has now held that Bunnings’ use of facial recognition technology […]
ReadmoreNo likes before sixteen: Australia’s social media minimum age restriction
On 10 December 2025, Australia became the first country to enforce a minimum age requirement for social media accounts. This landmark reform introduces the Social Media Minimum Age obligation (SMMA) under Part 4A of the Online Safety Act 2021 (Cth) (OSA), requiring platforms to take reasonable steps to prevent users under 16 from creating or […]
ReadmoreFederal Court confirms $5.8m penalty against Australian Clinical Labs over data breach
The Federal Court has confirmed Australian Clinical Labs (ACL) must pay a $5.8m civil penalty along with $400,000 in legal costs to settle proceedings commenced by the Australian Information Commissioner (OAIC).[1] The proceedings arose from the OAIC’s investigation into a cybersecurity attack on Medlab Pathology (Medlab) that exposed personal information relating to approximately 223,000 Australians,[2] […]
ReadmoreDeveloping or procuring AI? Here’s what you need to know
AI tools are bringing paradigm-shifting opportunities that will transform the way we work and interact. In a recent McKinsey survey, 78% of respondents indicated that their organisation uses at least some AI tools – an increase from only 50% prior to the generative AI boom of late 2022, spurred on by the public release of […]
ReadmoreNew mandatory ransomware payment reporting obligations now in force
Introduction Australia has taken a bold step in strengthening its cyber resilience with the introduction of the mandatory ransomware and cyber extortion payment reporting regime under Part 3 of the Cyber Security Act 2024 (Cyber Security Act). Effective from 30 May 2025, this new regime requires certain entities – including businesses with an annual turnover exceeding $3 million and […]
Readmore
