Posted on 20 Mar 2024
Navigating Privacy Data Breaches: Your Legal Rights in Australia
By Slater and Gordon

You might have seen data breaches a lot in the news recently, and as so many vital parts of our society become online including healthcare and banking, our data is more precious and more vulnerable than ever.
Protecting your data is the responsibility of the company that has been entrusted with it. Unfortunately sometimes these companies fail to take reasonable steps to protect information and fall victim to data breaches.
Simply put, a data breach happens when personal information is accessed, disclosed without authorisation, or is lost.
In 2023, cyber crimes continued to be the leading cause of data breaches that impacted a large number of Australians. Of the 26 breaches that affected over 5,000 Australians, 22 were caused by cyber incidents.
Some of the recent notable data breaches in Australia include:
- Optus data breach 2022
- Medibank data breach 2022
- Latitude Financial data breach in 2023
It’s no wonder that three‑quarters of Australians feel that data breaches are one of the biggest privacy risks they face today. Data breaches can be a terrifying experience although if you are impacted by one remember that there are legal services and other support resources available to help you navigate this situation.
The most common causes of data breaches can include:
- Phishing
- Compromised or stolen credentials
- Ransomware
- Hacking
- Malware
- Brute Force
What are your rights if you are impacted by a data breach?
If a company that holds your data has failed to take reasonable steps to protect your personal information, you may be eligible for compensation.
If your data has been breached the company that holds it must notify you under the Notifiable Data Breaches scheme . If you think that a data breach may have affected your personal information and you haven‘t been notified, you must first complain to the organisation or agency that experienced the breach and give them at least 30 days to respond.
If the company does not respond you can contact the Office of Australian Information Commissioner (OAIC), which is an independent agency that functions within the Attorney-General’s portfolio. Their main focus is privacy, freedom of information and government information policy. Their responsibilities when it comes to data breaches include conducting investigations, reviewing decisions, handling complaints and providing guidance and advice.
You may also choose to seek legal guidance on whether you’re eligible to proceed with an individual claim for compensation, or how to join a class action if you’ve been a part of a large scale data breach.
If you’ve been impacted by a data breach you could be eligible to seek compensation for losses from the data breach. This includes time and money spent replacing identity documents, as well as implementing other measures to protect your privacy to prevent the increased likelihood of falling victim to scams and identity theft.
What is the Optus Data Breach Class Action
Slater and Gordon filed a group proceeding (class action) in the Federal Court of Australia against Optus on 21 April 2023. The class action is brought by two lead applicants, a schoolteacher and a government employee, on behalf of Optus customers whose allege that personal information was compromised in the Optus data breach announced on 22 September 2022. It is alleged that current and former Optus customers have both been affected.
Learn more about the Optus Data Breach Class Action and you can also register if you have been impacted by this data breach.
If you’ve have suffered from a data breach please find resources for support.
The contents of this blog post are considered accurate as at the date of publication. However the applicable laws may be subject to change, thereby affecting the accuracy of the article. The information contained in this blog post is of a general nature only and is not specific to anyone’s personal circumstances. Please seek legal advice before acting on any of the information contained in this post.