The OAIC

Office of the Australian Information Commissioner

Status Tracked

The regulator administering the Notifiable Data Breaches scheme, which binds whoever holds personal information, not whoever got into it; on THE RORT's reading the scheme was never built to reach a company that accessed someone else's system rather than losing data from its own.

First tracked: 2026
Last on record: 2026-10
Named in: 8 articles
Across: 2 cases

Named in 8 articles across 2 cases 28 connections: companies 11, mechanisms 3, regulators and bodies 4, agencies and departments 5, police 2, people 3

Key figure on file

No penalty in the release

The OAIC’s 18 September 2025 release announcing the Kmart finding does not mention a penalty. A determination cannot impose one; only a court can, on…

Articles naming it

Cases it recurs across

Linked in the graph

Figures on file

Fig. 01 / Where this name appears

The Privacy RortNo penalty in the releaseThe OAIC’s 18 September 2025 release announcing the Kmart finding does not mention a penalty. A determination cannot impose one; only a court can, …4 articles →The Reporting Rort$5.8 millionAustralian Clinical Labs, ordered 8 October 2025 to pay $5.8 million over a February 2022 breach, of which $1.6 million ($800,000 and $800,000) was…4 articles →

Fig. 01Source: article scan · every article naming itAs of 2026‑10Auto-assembled

Fig. 02 / On the record

No penalty in the releaseThe OAIC’s 18 September 2025 release announcing the Kmart finding does not mention a penalty. A determination cannot impose one; only a court can, on the Commissioner’s application, for conduct of this period, for a serious or repeated interference.Every person who entered →
No compensation declaredSection 52(1A)(d) of the Privacy Act lets a determination made after a Commissioner-initiated investigation declare compensation. None was declared here. The OAIC says its usual practice is instead to point affected people to make their own complaint.Every person who entered →
2,000 penalty units; 10,000 for a companyThe mid-tier civil penalty added in 2024 is capped at 2,000 penalty units under section 13H(3). For a body corporate, the OAIC’s guide puts the cap at five times that figure, 10,000 penalty units. This article states the cap in penalty units; the case’s fourth article, ‘Promised in 2019’, converts the per-person caps to dollars. The cap in any event reaches only conduct from 11 December 2024, which none of the conduct these three determinations examined includes [3][14].Every person who entered →
ProportionalityThe ground the OAIC gave for closing its MediSecure inquiries on 13 September 2024, after MediSecure had already entered administration.Nearly five years →
Nearly three yearsFrom the Clearview AI determination on 14 October 2021 to the OAIC’s statement on 21 August 2024 that further action was not warranted.Nearly five years →
One personHow many complainants the OAIC’s 15 June 2026 compensation order against American Express Australia covers.Nearly five years →
1,205Notifications the OAIC received in calendar 2025, an 8 per cent rise on the 1,112 received in 2024, and the most since the scheme began in 2018.One penalty →
$5.8 millionAustralian Clinical Labs, ordered 8 October 2025 to pay $5.8 million over a February 2022 breach, of which $1.6 million ($800,000 and $800,000) was for failing to assess the breach promptly and failing to notify the OAIC. ACL admitted the contraventions and consented to the orders. It is the first civil penalty ever ordered under the Privacy Act [14].Source: OAIC, 9 October 2025Fourteen days →

Fig. 02Source: figures on file for this name, each tied to the article it came fromAs of 2026‑10Auto-assembled

How we know

The sources of the 8 articles that name the OAIC, by the tier the desk declared. A source supports its article, not necessarily a claim about the OAIC.

Evidence strength · 264 sources across 8 articles

Primary 136
Official 19
Masthead 30
Trade 29
Aggregator 1
Unusable 3
46 not yet graded

Primary: the document itself: legislation, a court record, a filing, a regulator’s own publication
Official: the organisation’s own statement about itself
Masthead: a news organisation with a corrections policy, reporting the primary document
Trade: specialist or trade press
Aggregator: republishes others’ work
Unusable: its own sourcing cannot be established

How sources are graded

8 of 8 articles are graded on every headline finding. How findings are graded

Fig. 03 / Named together

The 12 names most often in the same articles as The OAIC. A line's weight, and the number by each name, is how many articles name both. Grey chords join the neighbours most often named together themselves (two articles or more). Circles are people and organisations, squares are mechanisms. Named together is all this shows: it is not a finding about what the relationship is.

Fig. 03Source: article scan · articles naming bothAs of 2026‑10Auto-assembled