Cyber

25/02/2026 A recent Administrative Review Tribunal (ART) decision on Bunnings Group Limited’s (Bunnings) use of facial recognition technology (FRT) has overturned some of the Privacy Commissioner’s findings in relation to the contravention of the Australian Privacy Principles (APP).   Departing from the Commissioner’s findings, the ART found that Bunnings lawfully collected the sensitive information of individuals entering its stores via FRT in accordance with APP 3.3 as …
Read more

22/10/2025 The Federal Court recently ordered Australian Clinical Labs (ACL) pay $5.8 million in civil penalties following a mishandled ransomware attack in 2022. As noted by Privacy Commissioner Carly Kind, “for the first time, a regulated entity has been subject to civil penalties under the Privacy Act…” On 25 February 2022, Medlab Pathology, now a …
Read more

24/09/2025 Australian retail giant Kmart’s facial recognition practices have been found to have breached Australia’s Privacy Act.   The Privacy Commissioner, Carly Kind, of the Office of the Australian Information Commissioner (OAIC), handed down her determination on 26 August 2025.  Kmart deployed facial recognition (FR) cameras in 28 of its stores during a pilot program between …
Read more

22/08/2025 In 2022, Optus suffered one of the most notorious data breaches since the Notifiable Data Breaches Scheme began in 2018. The data breach affected approximately 9.5 million Australians, being current and former Optus customers who all had varying amounts of their personal information stolen by hackers. The information stolen included names, dates of birth, …
Read more

You may have used or seen a Quick Response code, more commonly known as a QR code. A QR code is a grided barcode that when scanned with a device’s camera, can take the user to websites, connect to Wi-Fi networks, allow the user to view and order food, download files, authenticate services or even …
Read more

In November 2024, following the infamous Bunnings Determination the Office of the Australian Information Commissioner (OAIC) published a guide for organisations in using facial recognition technology (FRT).  The guide walks organisations through how the Australian Privacy Principles (APPs) should be applied in the context of using facial recognition technology (FRT) in a commercial setting. FRT …
Read more

Amendments to the Privacy Act 1988 (Cth) (Privacy Act) increased the enforcement powers of the Office of the Australian Information Commissioner (OAIC), introducing new civil penalty tiers and giving the OAIC the ability to issue infringement notices for minor breaches. This marks the beginning of a stronger regulatory environment for organisations that do not comply …
Read more