Medibank data breach Federal Court class action – how does this change things (the short version)?

Articles Written by Helen Clarke (Partner), Frances Dreyer (Partner), Felicity Karageorge (Partner)

A class action has been filed in the Federal Court in respect of the Medibank data breach, funded by large domestic litigation funder Omni Bridgeway. The claim reportedly includes causes of action based on breaches of contract, Australian Consumer Law and equitable obligations of confidence. The claim has been filed in the context of a separate class action style claim being commenced via the Office of the Australian Information Commissioner (which is being pursued collectively by three other law firms).

The Federal Court Claim is a significant development as it sees the first major class action for privacy breach related loss commenced directly in the Federal Court. To date, collective actions for data breaches have been commenced via the Office of the Australian Information Commissioner, and this has meant they have needed to wait out the Privacy Commissioner’s investigation (which can be very lengthy process, and potentially lead to a Federal Court claim in any event) and has meant the claims are in the relatively untested world of compensation for breaches of the Privacy Act. The Federal Court action sees a direct Federal Court claim avoiding this process. It also frames the claim for compensation around accepted causes of action and compensatory provisions (such as obligations under the Australian Consumer Law), rather than relying upon the development of jurisprudence specifically on the right to privacy (something not yet developed in Australia) or the level of monetary compensation under the Privacy Act. It has the potential to break new ground in respect of how these conventional causes of action interplay with the context of a data breach, how loss emerging from such breaches can be valued (including non-economic losses, and non-immediate losses) and what duties are imposed on the holders of data. 

Key points for health care clients:

  • The Medibank Federal Court claim is significant because it sets an example for how a direct class action claim can be made in the Federal Court in respect of a data breach.
  • If successful (either on a settlement basis or on judgment) it has the potential to be a roadmap for litigation funders and plaintiff lawyers as to how class action style claims can be made following data breaches. This is likely to lead to an increased appetite for funding and running class actions in respect of data breaches.
  • The Medibank claim may be an archetypal vehicle to test these points because of the uniquely sensitive nature of the health data in the relevant set (including data related to medical procedures and mental health treatment). It is possible that the precedent which emerges from the case is focused specifically on health data, and is relevant to duties under consumer contracts and the ACL and assessment of loss that accrues in respect of those breaches.
  • The Federal Court Claim is backed by a litigation funder, and so it can be assumed that an assessment of significant claim value has been made.
Important Disclaimer: The material contained in this article is comment of a general nature only and is not and nor is it intended to be advice on any specific professional matter. In that the effectiveness or accuracy of any professional advice depends upon the particular circumstances of each case, neither the firm nor any individual author accepts any responsibility whatsoever for any acts or omissions resulting from reliance upon the content of any articles. Before acting on the basis of any material contained in this publication, we recommend that you consult your professional adviser. Liability limited by a scheme approved under Professional Standards Legislation (Australia-wide except in Tasmania).

Related insights Read more insight

Climate-related shareholder activism: legal claim against Shell directors falls at first hurdle

On 12 May, the UK High Court refused permission for environmental group ClientEarth to continue its claim against the directors of Shell plc (Directors) for their alleged failure to manage climate...

The Class Actions Law Review - Seventh Edition

Partners Robert Johnston, Felicity Karageorge, Rena Solomonidis, Special Counsel Nicholas Briggs and Senior Associate Sara Gaertner have written the Australian chapter in The Law Reviews 7th...

Western Australia’s new class action regime commences

On 24 March 2023, the Civil Procedure (Representative Proceedings) Act 2022 (WA Act) commenced. The WA Act introduces an updated and more cohesive mechanism for bringing class actions in WA.