The OAIC

Office of the Australian Information Commissioner

Status Tracked

The regulator administering the Notifiable Data Breaches scheme, which binds whoever holds personal information, not whoever got into it; on THE RORT's reading the scheme was never built to reach a company that accessed someone else's system rather than losing data from its own.

First tracked: 2026
Last on record: 2026-10
Named in: 6 articles
Across: 2 cases

Named in 6 articles across 2 cases 25 connections: companies 9, mechanisms 3, regulators and bodies 4, agencies and departments 5, police 2, people 2

Key figure on file

Proportionality

The ground the OAIC gave for closing its MediSecure inquiries on 13 September 2024, after MediSecure had already entered administration.

Articles naming it

Cases it recurs across

Linked in the graph

Figures on file

Fig. 01 / Where this name appears

The Privacy RortProportionalityThe ground the OAIC gave for closing its MediSecure inquiries on 13 September 2024, after MediSecure had already entered administration.3 articles →The Reporting Rort$5.8 millionAustralian Clinical Labs, ordered 8 October 2025 to pay $5.8 million over a February 2022 breach, of which $1.6 million ($800,000 and $800,000) was…3 articles →

Fig. 01Source: article scan · every article naming itAs of 2026‑10Auto-assembled

Fig. 02 / On the record

ProportionalityThe ground the OAIC gave for closing its MediSecure inquiries on 13 September 2024, after MediSecure had already entered administration.Nearly five years →
Nearly three yearsFrom the Clearview AI determination on 14 October 2021 to the OAIC’s statement on 21 August 2024 that further action was not warranted.Nearly five years →
One personHow many complainants the OAIC’s 15 June 2026 compensation order against American Express Australia covers.Nearly five years →
1,205Notifications the OAIC received in calendar 2025, an 8 per cent rise on the 1,112 received in 2024, and the most since the scheme began in 2018.One penalty →
$5.8 millionAustralian Clinical Labs, ordered 8 October 2025 to pay $5.8 million over a February 2022 breach, of which $1.6 million ($800,000 and $800,000) was for failing to assess the breach promptly and failing to notify the OAIC. ACL admitted the contraventions and consented to the orders. It is the first civil penalty ever ordered under the Privacy Act [14].Source: OAIC, 9 October 2025Fourteen days →

Fig. 02Source: figures on file for this name, each tied to the article it came fromAs of 2026‑10Auto-assembled

Fig. 03 / Named together

The 12 names most often in the same articles as The OAIC. A line's weight, and the number by each name, is how many articles name both. Grey chords join the neighbours most often named together themselves (two articles or more). Circles are people and organisations, squares are mechanisms. Named together is all this shows: it is not a finding about what the relationship is.

Fig. 03Source: article scan · articles naming bothAs of 2026‑10Auto-assembled