Nearly five years

On 11 June 2026 the Office of the Australian Information Commissioner found against Optus over the White Pages breach of 2015 to 2019, affecting 41,278 customers. The OAIC’s release says its publication ‘brings to an end a long-running investigation, which was first announced in August 2021’ ¹. From announcement to outcome, nearly five years.

This article uses one basis for every matter in it: months from an investigation’s announcement or a civil penalty proceeding’s filing, to its outcome, or to 24 September 2026 if there is none yet. On that basis the five matters on this strip run from about one year to nearly five, and three of these five are still open.

Compensation for the White Pages breach itself was deferred to a later, separate determination on a representative complaint. This article’s clock stops at the finding, not at that later step.

01The clock

Meta’s case ran almost as long as Optus White Pages did. The Commissioner’s civil penalty proceedings against Meta began in March 2020. Court-ordered mediation ran from February 2024, and on 17 December 2024 the OAIC accepted an enforceable undertaking for a $50 million payment program: ‘the Commissioner has withdrawn the civil penalty proceedings in the Federal Court’ ². Filing to withdrawal, about 57 months.

A joint investigation into Latitude Financial’s March 2023 breach opened on 10 May 2023, run together by the OAIC and New Zealand’s Office of the Privacy Commissioner: ‘The Office of the Australian Information Commissioner (OAIC) and the New Zealand Office of the Privacy Commissioner (OPC) today commenced a joint investigation’ ³. New Zealand’s regulator said at the time that ‘As this investigation is now active no further comments will be made on it until it is concluded’ ⁴. We found no published outcome from either regulator, or in the OAIC’s media centre listing, up to 24 September 2026. About 40 months, with no published outcome.

Update, 30 September 2026. On 25 September 2026 the OAIC published a statement headed ‘OAIC’s action in relation to the 2023 Latitude Data Breach and information to update and assist individuals’ ²⁰. It says: ‘On 10 May 2023, the OAIC commenced an investigation into the personal information handling practices of the Latitude group of companies’, and ‘The OAIC continues to progress its Commissioner-Initiated Investigation’; it ‘will not comment further on the investigation until it has concluded’. Separately, it says: ‘In February 2024, the OAIC accepted a Representative Complaint about Latitude in relation to the 2023 data breach’, and that individual complaints about the breach ‘will usually be put on hold’ until the investigation or related court proceedings are finalised ²⁰. The statement does not mention New Zealand’s Office of the Privacy Commissioner and gives no outcome or timetable, so the position above stands: no published outcome for the investigation as of 30 September 2026.

Medibank’s case has run about 27 months. The OAIC filed civil penalty proceedings on 5 June 2024, alleging Medibank ‘seriously interfered with the privacy of 9.7 million Australians by failing to take reasonable steps to protect their personal information’ ⁵. That figure is an allegation, not a finding. We found no OAIC outcome, and no reported court outcome, up to 24 September 2026.

Some of the time on Medibank’s compensation complaint has been taken by litigation Medibank brought. Separately from the penalty case, Medibank went to court to stop the Commissioner deciding a related representative complaint about compensation: ‘Medibank has commenced proceedings to restrain the AIC from investigating the representative complaint and from making a determination and enforcing the determination in respect of the representative complaint on the basis that a determination made by the AIC and/or enforcement of a determination by the AIC poses a real risk of interference with the administration of justice having regard to the Medibank class action’, the OAIC says ⁶. THE RORT put a question on this to Medibank on 2 October; its reply is in the update below.

Correction, 30 September 2026. The paragraph above did not say that Medibank’s application was dismissed in February 2024, before this article was published. In Medibank Private Limited v Australian Information Commissioner, decided in February 2024, Justice Beach refused the injunction and ordered the application dismissed, with Medibank to pay the Commissioner’s costs; AAP reported it on 22 February 2024 ¹⁹. The OAIC’s own chronology records that the application, made on 15 September 2023, was heard on 5 December 2023 and judgment reserved ⁶. AAP quotes his written judgment: ‘Even if there was some substance to Medibank’s points, in my view it would be premature to grant an injunction,’ and, ‘Generally, there is lacking the immediacy of any risk concerning inconsistent findings’ ¹⁹. Medibank told AAP it would continue to defend the representative complaint and the class action, and a Commissioner’s spokesman told AAP the investigations continue ¹⁹. The OAIC page cited above, as fetched on 30 September, still describes the Commissioner as ‘presently a respondent party’ in that proceeding ⁶. The quotations are AAP’s report of the written judgment; this outlet could not open the judgment itself on 30 September.

Update, 6 October 2026. THE RORT asked Medibank on 2 October why it brought its 2023 application to restrain the Commissioner from investigating and deciding the representative complaint, and whether any other proceeding about the representative complaint is on foot. A Medibank spokesperson said: ‘As the matter is before the Court, it would not be appropriate for Medibank to comment.’ The statement does not say which matter it refers to, and it does not address the February 2024 dismissal reported in the correction above, which stands as reported by AAP ¹⁹. THE RORT’s question remains open until 5pm AEDT on Thursday 8 October, and any further answer will be added here.

The Optus penalty case is the newest of the three still open. Filed on 8 August 2025, it alleges Optus ‘seriously interfered with the privacy of approximately 9.5 million Australians by failing to take reasonable steps to protect their personal information’, over conduct the Commissioner dates from 17 October 2019 to 20 September 2022 ⁷. About 13 months, and open. The Commissioner alleges ‘one contravention for each of the 9.5 million individuals’ in that case ⁷: the Optus and Medibank cases are the two biggest on this record, and both are live, not dropped.

Update, 8 October 2026. THE RORT asked Optus on 2 October whether it contests the Commissioner’s allegations in this case, and whether it expects the Commissioner’s case to be heard with the class action. Optus’s media team replied by email on 8 October. The email is signed Optus Media Team and carries no request that it be kept off the record. It says: ‘Optus’s position on these matters is on the public record, including our submission to the Senate Environment and Communications Committee following the September 2025 Triple Zero outage.’ It also says: ‘Matters currently before the Federal Court will be addressed through the appropriate legal process.’ The reply does not say whether Optus contests the allegations or whether it expects the Commissioner’s case to be heard with the class action, and its Federal Court sentence names no matter, so this article does not say which matter it refers to. The reply links a release that Optus dated 21 September 2026 ²¹, which concerns the September 2025 Triple Zero outage and does not mention the Commissioner’s proceeding or the data breach. The reply does not answer THE RORT’s question, and any further answer will be added here.

All three penalty cases followed OAIC investigations of their own. The OAIC’s Meta enforceable undertaking says ‘the Civil Penalty Proceedings followed investigations by the OAIC concerning the Cambridge Analytica Incident’, an investigation the Commissioner initiated on 5 April 2018 ⁸. The Medibank release says the proceedings ‘follow an investigation initiated by’ the Information Commissioner ⁵, and the Optus release describes its case as ‘following an investigation in relation to the data breach made public by Optus on 22 September 2022’ ⁷. The filing, not that earlier investigation, is what starts each of these bars.

A trial date exists, but not for the OAIC’s own case. Slater and Gordon’s class action is set down for trial from 7 June 2027, before Justice Beach: ‘On 12 December 2025, the Honourable Justice Beach set down the class action for trial, commencing on 7 June 2027’ ⁹. Justice Beach also hears the Commissioner’s case, and MLex reports he ordered all parties, ‘including the regulators’, to mediation by 12 February 2027 ¹⁰. No court document we found sets a trial date for the OAIC’s own proceeding. MLex also reports the class action’s applicants ‘have been granted leave to intervene in the privacy watchdog’s penalties case’ ¹¹.

On this measure, two matters took nearly five years to end. Three others have no published outcome.

Update, 8 October 2026. The deadline for THE RORT’s questions of 2 October passed at 5pm AEDT on Thursday 8 October 2026. Medibank’s reply of 6 October, quoted above, is the only reply received from Medibank. No response was received from the Office of the Australian Information Commissioner by the deadline, 5pm AEDT on Thursday 8 October 2026. No response was received from Latitude Financial Services by the deadline, 5pm AEDT on Thursday 8 October 2026.

02Who can impose a civil penalty

None of that changes who can impose a civil penalty. Only a court can make a civil penalty order, on the Commissioner’s application: ‘the Australian Information Commissioner may apply to the Federal Court for a civil penalty order where an entity is alleged to have engaged in serious or repeated interferences’ ⁷. A determination the Commissioner makes alone cannot carry a fine.

That is the OAIC’s own stated policy ¹². The factors it weighs include the number of people affected, whether the conduct was isolated or systemic, an entity’s compliance history, the likelihood the conduct recurs, and what remediation has already been done.

03How the rest ended

Two other matters closed without a full investigation, and each on its own stated ground. MediSecure had entered administration on 3 June 2024. The OAIC’s inquiries into its breach had focused on getting affected individuals notified, and the regulator closed them on 13 September 2024 without a comprehensive investigation: ‘the possible remedies that we could obtain for the community will not be proportionate to the resources required for a comprehensive investigation’ ¹³. MediSecure’s administration came first. The OAIC’s decision followed it.

Qantas’s preliminary inquiries closed on a different ground entirely. After almost a year of preliminary inquiries into its 2025 data incident affecting about 5 million Australians, the Privacy Commissioner said in a statement dated 16 July 2026 that the evidence did not support a likely breach: ‘in this instance I do not consider that the evidence supports the likelihood that a breach of privacy law occurred’ ¹⁴.

On that basis the Commissioner said it ‘would not be appropriate for the OAIC- a proportionate and risk-based regulator - to commence a full investigation or take further action at this stage’ ¹⁴. Evidence, not proportionality, is the OAIC’s own stated reason for closing its preliminary inquiries into Qantas.

Clearview AI’s case is different: it had already been found in breach, in a determination dated 14 October 2021. Clearview withdrew from Administrative Appeals Tribunal review of that finding in August 2023. Nearly three years after the original determination, on 21 August 2024, the Commissioner said: ‘I am not satisfied that further action is warranted in the particular case of Clearview AI at this time’ ¹⁵. The OAIC says the 2021 determination, and its declarations, still stand. What did not follow was any further action.

04What a finding looks like

Besides the Optus White Pages finding, whose compensation was deferred, the outcomes on this record are declarations, one order of compensation for a single person, and two determinations against health service providers over tracking. None of them is a penalty, because a determination cannot carry one.

On 29 October 2025 the OAIC found Vinomofo had ‘interfered with the privacy of almost a million individuals by failing to take reasonable steps to protect the personal information it held’, over a 2022 breach affecting about 928,760 people ¹⁶. The remedy was declarations that it not repeat or continue the conduct. No money was ordered.

On 15 June 2026 the OAIC ordered American Express Australia to compensate a single complainant after an insider-access breach of APP 11.1; its release is headed ‘Australian Privacy Commissioner orders American Express Australia Limited to compensate complainant following interference in privacy’ ¹⁷. That is a money remedy, but it runs to one person, not a class.

On 24 June 2026 the OAIC published two determinations, finding that Medmate Australia Pty Ltd and Monash IVF Pty Ltd ‘interfered with the privacy of individuals whose sensitive information was collected via third-party tracking pixels’ ¹⁸. The OAIC’s release does not state the remedies, and this article does not describe them.

05One penalty, and what is still open

Article 1 of this case, ‘One penalty’, sets out the only civil penalty order this outlet has found made under the Act, and how it came about. This article is about the rest of the record: what happens while there is no penalty yet, or none at all.

Three of the five matters on this strip have no published outcome as of 24 September 2026: Latitude’s joint investigation, opened 10 May 2023; Medibank’s penalty case, filed 5 June 2024; and Optus’s penalty case, filed 8 August 2025. Two dates lie ahead in the Optus matters: the mediation Justice Beach ordered by 12 February 2027, as MLex reports, and the separate class action’s trial, from 7 June 2027. Neither is a trial date for the Commissioner’s own case.

THE REPORTING RORT’s ‘Fourteen days’ sets some of the same matters in a wider ledger of reporting duties. Its Australian Clinical Labs figure, $5.8 million by consent, $1.6 million of it for failing to assess and notify, is that record’s evidence the notification duty has been enforced once, in an agreed outcome.

Retail and scraped facial recognition are the subject of the next article in this case, held pending outstanding checks.

Two dates lie ahead, in 2027. Neither is a trial date for the Commissioner’s own case.

If it’s a rort, we cover it.