Data Protection - Tougher Penalties for Serious Data Breaches

Published

Oct 28 2022

Written By

Special Counsel
Australia

I am a Special Counsel in our Sydney office and I specialise in media and technology disputes and advice with a particular focus on privacy and data protection matters.

Emma Croft

Senior Associate
Australia

I am a senior associate in our Dispute Resolution Group in Sydney, specialising in media and technology disputes, commercial litigation and privacy and cybersecurity advisory work.

Practices

On 22 October 2022, the Australian Government announced that it will introduce legislation next week to significantly increase penalties for repeated or serious privacy breaches.

The Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 (Bill) will increase maximum penalties for serious or repeated privacy breaches under the Privacy Act 1988 (Cth) (Act) from the current $2.22 million penalty to whichever is the greater of:

$50 million;
three times the value of any benefit obtained through the misuse of information; or
30% of a company’s adjusted turnover, during the breach turnover period if the court cannot determine the value of the benefit under (b).

The “breach turnover period” will be the longer of either: