Digital Bytes – privacy, cyber, AI & data update

Broad definitions of personal and sensitive information adopted in tracking pixel determinations

Before the announcement of the proposed Tranche 2 reforms to the Privacy Act, following a scan of 50 healthcare providers earlier this year, the Privacy Commissioner found that Monash IVF Pty Ltd and Medmate Australia Pty Ltd breached the APPs by using tracking pixels to retarget ads to website visitors on other platforms without adequate notice or consent. 

Effectively expediting some of the proposed privacy reforms, the determinations most notably found that:

• ‘personal information’ includes information where the organisation cannot determine the identity of a person, provided the information is ‘individualised’ (and distinguishes one person from another) and the individuation affects the person’s rights and interests; and
• a website visitor’s browsing behaviour may infer health information about a person (even if it is also possible that the website visitor is browsing for other reasons), and where an inference arises, that information must be treated as ‘sensitive information’.

While these determinations have the potential to significantly impact compliance obligations for information collected by businesses via tracking technologies, they also have wider implications for datasets of individualised but non-identifiable individuals, and other information (such as location information) from which sensitive information may be inferred. 

Compensation ordered for inadequate controls to mitigate insider security risk 

On 15 June 2026, the Office of the Australian Information Commissioner (OAIC) published a summary report of its investigation into American Express Australia Ltd (AMEX) after a former customer alleged that an employee had accessed personal and financial information of their former partner without a legitimate business purpose. 

The report serves as a warning to all organisations to address and mitigate risks associated with employees accessing personal information for improper purposes, such as financial fraud, domestic and family violence, or corporate espionage.

The OAIC found that AMEX had failed to meet its obligation under Australian Privacy Principle (APP) 11.1 to take reasonable steps to protect the information it held from unauthorised access, such as by failing to:

• implement uniform account-level access logging;
• restrict access to certain customer records through technical controls or security measures;
• implement ‘Just in Time’ access to prevent customer support agents from accessing customer records without a specific, time-bound trigger, such as active authentication from the customer; and
• prohibit employee access to the customer accounts of their friends and family.

The OAIC also noted that where an organisation receives a complaint alleging unauthorised access by an employee, the complaint handling process should require the prompt restriction of that employee’s access to information.

AMEX was ordered to issue a written apology to the complainant and pay compensation (reportedly over A$20,000) for economic loss, non-economic loss and reimburse the expenses the complainant incurred in making the complaint. AMEX was also required to, within six months, implement various technical controls.

White Pages investigation focusses on who ‘holds’ personal information

A recent investigation by the OAIC confirms that ‘holding’ personal information is a question of control, not physical possession. Where an organisation retains the ability to add, remove, or alter information held by a third party, that organisation ‘holds’ the information and must handle it in compliance with privacy obligations, including taking reasonable steps to prevent unauthorised disclosure. 

The OAIC’s determination, published 11 July 2026, found that Optus failed to take reasonable steps to prevent the unauthorised disclosure of 41,278 individuals’ personal information, when that information was published in the White Pages directory contrary to their expressed preference for an unlisted number. 

Central to the determination were the following findings:

• Optus incorrectly assumed that White Pages entries would be removed when a customer ported from a third-party provider to Optus (inbound customers), without validating that assumption.
• Optus ‘held’ the personal information of inbound customers, even though their information was originally submitted to the White Pages by their former provider – following the port, Optus was the only entity with the practical ability to request that the listing be amended or removed on the customer's behalf, and this ‘control’ meant that Optus ‘held’ that information both in its own systems and in the third-party White Pages system.
• Optus was aware of issues of unlisted numbers appearing in the White Pages but had not done enough to investigate and remediate the issues.

This is underscored by the new “know your information” obligation proposed in the Tranche 2 privacy reforms, which would require organisations to take steps needed to ensure that they can identify personal information which is subject to their information security and destruction/de-identification obligations. 

New and updated APP guidelines for collection of personal information

In the meantime, and before any new ‘fair and reasonable’ framework commences under the proposed Tranche 2 Privacy Act reforms, the OAIC has published updated guidelines on collecting personal information under APP 3, incorporating learnings from recent determinations on collection that is ‘reasonably necessary’ for an organisation’s ‘functions and activities’ and by ‘fair means’. 

The guidance sets out that determining whether a particular collection of personal information is permitted involves a two-step process: 

1. identifying the organisation’s functions or activities; and 
2. determining whether the particular collection of personal information is reasonably necessary for one of those functions or activities.

An organisation’s functions or activities are determined objectively, such as by reference to its constitution, previous activities, public statements, representations and website content (including its privacy policy). An organisation’s functions and activities are those in ‘practical reality’, not what the organisation asserts. 

Similarly, whether collection is ‘reasonably necessary’ is an objective test, from the view of a reasonable person who is properly informed. It is not enough that collection is helpful, desirable or convenient.

Guidance on ‘fair’ collection has also been expanded to confirm that, beyond deception, misrepresentation and unreasonable intrusion, factors influencing fairness include:

• the individual’s awareness of the collection and reasonable expectations;
• whether the individual’s choice is distorted or undermined, for example, through ‘online choice architecture’; and
• the risk of harm resulting from collection – including arising from the individual’s actual or perceived vulnerability. 

Other key changes to the APP 3 guidelines relate to:

• applying the APP 3 principles to contemporary examples of technology use cases, such as AI and facial recognition technology, and current practices like data scraping, tracking pixels and data broking;
• a new flow chart to assist organisations to navigate the requirements for collecting personal information under APP 3;
• clarifications to reflect that proportionality is implicit in the APP 3 requirements, requiring entities to take a data minimisation approach;
• expanded guidance on exceptions to the requirement to seek consent for collection of sensitive information; and
• clarifications on liability where an entity engages a third party to collect personal information.

This guidance on ‘fairness’ will be of particular interest to organisations considering the impact of the Tranche 2 privacy reforms’ proposal that all collection, use and disclosure of personal information must be ‘fair and reasonable’. 

Guidance for upcoming automated decision-making transparency requirements 

Earlier this year, the OAIC consulted on guidance for the upcoming new transparency requirements relating to automated decision-making (ADM), which will come into effect on 10 December 2026. 

Our earlier article explains the ADM transparency requirements and the potential challenges in implementing these requirements. 

The OAIC then published updated APP 1 Guidelines, together with additional resources, on 30 September 2026. The guidance clarifies the OAIC’s expectations around some of the more complex elements, including the following:

• Providing examples of what it generally means to ‘arrange for’ a computer program to make a decision, including:
  • procuring a third party AI solution to screen and rank job applications resulting in a decision about who to employ;
  • using a case management system to automatically escalate particular types of complaints;
  • an employer permitting or directing employees to use an AI chat tool to draft performance assessments that determine promotion decisions; and
  • an entity contracting a third-party software provider to automatically approve or decline refunds on its behalf.
• Establishing relevant factors (and examples) for determining whether a computer program is ‘substantially and directly related to making a decision’. Importantly, the transparency requirements may apply even where the output does not replace the decision-making process entirely or is subject to human review – for example, where the human decision maker relies on or is significantly influenced by the computer program’s output.
• Providing additional guidance on the kinds of decisions that could reasonably be expected to ‘significantly affect the rights or interests of an individual’ and confirming that organisations will need to consider that a decision may have a more significant effect on vulnerable groups.

The OAIC’s guidance and fact sheet provide more detailed examples, including an example of the extent of disclosure required in a hypothetical agency’s privacy policy.

Many organisations have already begun identifying and mapping where ADM occurs in their business, to position themselves for timely privacy policy updates before December 2026.

Even where ADM is not used in obvious customer-facing ways (e.g. pre-screening), the OAIC’s guidance makes clear that it can arise in less visible parts of a business such as in recruitment and HR processes, risk scoring, internal allocation tools and other operational systems. Organisations in a broad range of sectors will need to carefully consider any processes or tools that impact an individual’s right to receive services or support. The OAIC has clarified that computer program decisions relating to individuals’ access to essential food and nutrition, healthcare, emergency or aged care services (including ‘in home’ services), physical assistance or support, financial assistance, educational services, essential banking and credit services, telecommunications, essential utilities, employment opportunities and housing will generally be considered ‘significant’.

In addition to reviewing the use of ADM within your organisation’s operations, if your organisation provides services to others, you should also consider whether you enable or facilitate ADM for your customers.

Latest published data breach statistics

The most recently published data shows that the OAIC has continued to receive a steady stream of data breach notifications: 1,205 data breaches were notified to the OAIC in 2025.

Malicious or criminal attacks have been the primary reported cause of notifiable data breaches in Australia for a number of years, and accounted for over 59% of the reported data breaches in 2025. Health service providers remain the most commonly affected, followed by financial service providers. 

To assist those reporting under the notifiable data breach scheme, the OAIC has published a new quick reference guide, including a checklist to assess whether the breach is notifiable. 

Results from the Australian Community Attitudes to Privacy Survey 

The latest Australian Community Attitudes to Privacy Survey provides a snapshot of how the public’s perception has changed since the previous survey in August 2023. Privacy-consciousness is on the rise; 87% of respondents say that they are more concerned about privacy than they were 5 years ago. 

Many of the responses support the general trend that individuals feel less empowered and more concerned about privacy than ever. Overall, there are low levels of trust when it comes to privacy, especially in social media and AI companies.

Some of the findings of interest include that:

• There has been rising concern about all privacy risks since 2023. Top privacy concerns are data breaches and information security, followed by offshore disclosure and AI systems. Other key concerns include location tracking, facial recognition, surveillance, ID scanning and workplace privacy.
• 73% of respondents experienced a privacy concern in the past 12 months, and the most common concern was being unable to unsubscribe from marketing (41%). Of the concerns experienced in the past year, 52% of respondents did not raise them, so they did not become privacy complaints.
• The most common form of reported harm resulting from Australians whose information was subject to a data breach continues to be increased exposure to scams and spam (62%). Financial or credit fraud, email account hijacking, replacing key identity documents and emotional/psychological harm were each reported by 10-16% of respondents.
• There is broad opposition to using personal information for the secondary purposes of selling personal information, targeted advertising to children or other vulnerable individuals, unnecessary location tracking, differential pricing or targeted advertising based on sensitive data and AI training.
• There is broad support for stronger rights and broader coverage of privacy laws.

The OAIC summarises that there is a “sustained ‘trust gap’ for sectors that rely heavily on data-driven business models, particularly where collection feels excessive, benefits appear one-sided, or there is no realistic alternative to participation.” To build trust, the OAIC recommends:

• “clearly limiting collection and retention to what is reasonably necessary and proportionate 
• constraining secondary uses (especially high-impact uses and uses involving sensitive information) 
• giving people practical choices that do not require trading away access to essential services in exchange for the secondary use or disclosures of their personal information 
• providing complaint, access and correction pathways that are easy to find, easy to access, predictable and effective.”

For organisations for whom trust is as or more important than compliance, a deeper analysis of the survey can identify priorities for increasing public and individual confidence. 

OAIC’s Corporate Plan includes focus on new technology 

The OAIC’s 2026-27 Corporate Plan sets out its Strategic Plan for 2026-29, centred around:

• addressing power and information asymmetries;
• promoting information integrity; and
• embedding fairness, accountability and transparency in new technology.

The Plan reinforces the OAIC’s regulatory approach, focusing its enforcement powers on circumstances where:

• there is substantial harm to individuals and the community (especially vulnerable people or groups);
• there are systemic harms or contraventions;
• enforcement action is likely to change practices in a sector or market;
• there is significant public interest; or
• action clarifies policy or law, especially newer provisions of laws.

The latest action under the statutory tort of privacy concerns the tension between employee privacy and employer access to business data where platforms are used for mixed personal and professional use.

In Nehme v The Art Scene Pty Ltd [2026] NSWDC 315, interim injunctive relief was granted to a former employee in a dispute concerning access to a personal Canva account used for both personal and work purposes. 

The applicant alleged:

• she established a Canva Pro account using her personal email address which she paid for personally, except for a period where the employer paid for it;
• personal information was stored in the account, including family medical records and financial information;
• the account was used for both personal and work purposes;
• during her employment, she granted a colleague access to a single shared folder for work purposes but did not grant broader access to the account; and
• when she left the company (which is subject to a separate dispute), her access to the account was revoked, apparently at the instigation of her former employer, such that she was unable to access documents that remain stored in the account.

The Court was satisfied that, for the purposes of awarding the interim injunction, there was a serious question to be tried under the statutory tort of privacy in Schedule 2 to the Privacy Act as:

• the applicant had a reasonable expectation of privacy in the circumstances, having regard to the history of access to the account, the limited access granted to others and the fact that she paid for the account before and after the period during which her employer paid for it;
• the changes to access arrangements appeared to be intentional;
• given the nature of information involved, including health, family and financial information, the alleged invasion of privacy was serious; and
• there was no obvious countervailing public interest.

This case is a timely reminder for employers to consider the risks associated with employees using personal accounts for work purposes, including where those accounts are funded by the employer for a period of time. While the merits of the claim remain to be determined, the decision shows that a reasonable expectation of privacy may arise in relation to platforms used for both personal and work purposes, particularly where access is limited and the account remains closely associated with the employee.

As the new statutory tort of privacy begins to be tested, employers should ensure that business records are maintained in employer-controlled systems and that ownership, access rights and the storage of business information is clearly documented. This may help reduce the risk of disputes and privacy claims following the termination of employment.

Australian Government looking to Horizon 2 of the 2023-2030 Australian Cyber Security Strategy

On 11 June 2026, the Australian Government has announced several cyber security measures under ‘Horizon 2’ of the 2023–2030 Australian Cyber Security Strategy (Strategy), as set out in the Horizon 2 Action Plan. 

The Strategy was released in November 2023 and established a framework to uplift Australia’s cyber security resilience and maturity to be delivered in three ‘horizons’. In Horizon 2 (from 2026 to 2028), the Australian Government is seeking to “strengthen cyber maturity across the Australian economy, society and digital infrastructure” by “making the further investments required across the cyber ecosystem”.

The new measures include:

• securing critical infrastructure and government systems that support essential services, including through: 
  • an expanded national exercise program to test cross-sector coordination and response with a focus on cyber supply chains; and
  • a whole-of-government security policy to prevent, investigate and penalise drone misuse – for example, earlier in 2026, the Department of Home Affairs consulted on drone security risks;
• developing new secure-by-design standards and requirements under the Cyber Security Act 2024 (Cth) for connected technologies used across homes and business, including routers, operational technology, consumer energy resources, smart devices and connected vehicles, similar to the secure technology standards established for smart devices in Horizon 1;
• developing a voluntary smart device labelling scheme to provide clearer security information – the Australian Government has since launched a pilot cyber security labelling scheme with Connected Technology Alliance; and
• establishing a single cyber regulatory reporting platform to support businesses and align cyber regulation – this has not yet been established, but the single reporting portal remains available to help organisations to meet cyber reporting requirements;
• strengthening the Australian Government’s procurement arrangements by embedding minimum cyber security standards and requirements for information and technology goods and services;
• establishing a cyber security standard framework for small and medium business through the new CyberSmart Program, which offers scalable and affordable support and certification – the CyberSmart Program is still being co-designed with industry and there are opportunities for stakeholders to have their say;
• building on the ‘Act Now. Stay Secure’ public awareness campaign and resources to ensure individuals develop cyber secure habits that keep pace with emerging threats, including AI-enabled cyber attacks; and
• working with telecommunications and cloud service providers to enable upstream blocking of cyber threats.

"Essentials’: series to replace the Essential Eight framework 

The Australian Signals Directorate (ASD) has commenced consultation on replacing the on-premises-focussed Essential Eight framework with a new ‘Essentials’ series to address a broader range of IT service models. The ‘Essentials’ series is intended to give organisations greater flexibility by focussing on outcomes and intent rather than prescriptive requirements.

Consultation has concluded, and the Essential Eight is intended to be deprecated and retired in the next 12-24 months.

Separately, for organisations which have adopted the NIST Cybersecurity Framework, NIST has released a concept paper which would inform development of human-centred cybersecurity guidelines and resources. 

Updated Information Security Manual includes AI focus

The ASD has also updated the Information Security Manual, including significant uplifts to address AI-related risks. 

Updated AI-related controls include disabling external AI public data source access, ‘human in the loop’ interventions and other controls such as broader software development guidelines for AI, using AI to augment security and securely deleting all prompts and outputs. 

The updated controls also address:

• personnel security – preventing personnel from posting information about their security clearance or work-related duties, skills or experience on unauthorised online services, and reporting where this occurs;
• software development – requiring software developers to have sufficient cyber security knowledge and skills;
• security assurance – incorporating cyber threat intelligence services to detect and identify cyber security events; 
• cryptography – broadening controls to require ASD-approved cryptography to encrypt sensitive or classified data communicated over public network infrastructure, using cryptographic algorithms to encrypt data at rest and cryptographic protocols to encrypt data in transit; and
• system hardening – using ASD and vendor hardening guidance for all user applications, restricting server applications to an organisation-approved set, and implementing risk-based lockout mechanisms.

AI as a cyber threat and cyber defence

More broadly, the ASD’s Australian Cyber Security Centre has developed guidance on: 

• Defending against AI-enabled cyber attacks: Guidance for government, critical infrastructure and large enterprises, providing recommended immediate, short, medium and long term actions to mitigate these threats; and
• Frontier AI cyber threat considerations for boards of directors, including threshold questions and key actions for board directors and senior leaders to keep on top of emerging cyber risks. 

Separately, leaders of the Five Eyes cyber security agencies have issued a ‘call to action’ acknowledging that AI is rapidly transforming cyber risk and urging organisations and governments to review their cyber resilience. 

Five Eyes – a partnership consisting of the heads of the Australian Security Intelligence Organisation and its equivalents in Canada, the US, the UK and New Zealand – also acknowledge that AI can be used to detect vulnerabilities earlier, improve software quality, monitor unusual behaviour and respond to incidents. To this end, the ASD has published new guidance on Opportunities for AI in cyber defence.

Learnings from litigation in the wake of financial redirection fraud

The latest case on financial redirection fraud is a strong reminder to implement appropriate processes to detect fraudulent changes to bank account details.

Pandora was due to make payment to a franchisee under an asset sale agreement, when it received an email from the franchisee’s account at 2 am nominating a different bank account, with a letter purporting to be from the franchisee’s bank even though it had no email, contact details or ABN/ACN/AFSL or Australian Credit Licence details.

Pandora made payment of over A$450,000. The franchisee followed up about the payment approximately 6 days later, at which time the financial redirection fraud was discovered and approximately A$3,000 was later able to be recovered.

The Court found that Pandora failed to make reasonable enquiries to verify the bank account change in the 2 am email. The Court carefully considered Pandora’s argument that the franchisee had failed to mitigate its loss by not raising the mis-payment earlier after Pandora had confirmed it had made payment, but ultimately found that the franchisee had not acted unreasonably.

The judgment’s careful and detailed consideration of the facts means that there is no ‘safe harbour’ or ‘golden rule’ that can be extracted to protect an organisation from claims in the wake of financial redirection fraud incidents. All organisations should take great care to ensure that they are alert to the risks arising from these incidents, and raise payment and receipt issues at the earliest opportunity. 

Proposed $8 million penalty against Bendigo Bank for security failures contributing to data breach

APRA has brought an action against Bendigo Bank alleging that it failed to conduct the acquired Alliance Bank with due skill, care and diligence because it did not have:

• adequate customer authentication controls or a systematic testing program for those controls; or
• appropriate governance and risk management for the information security of the systems that were subject to a 2023 cyberattack.

APRA also alleges that Bendigo Bank failed to ensure that the Alliance Bank IT operations were the responsibility of an accountable person.

The agreed statement of facts includes details about the passwords that were permitted to be used by Alliance Bank customers, such as almost 1,600 accounts protected by the password “123456”. Of those, 211 accounts were accessed by hackers through that password, and an additional 18 accounts were accessed with the password “12345678”. This attack resulted in financial loss to customers, which was refunded and remediated by Bendigo Bank.

The parties’ agreed pecuniary penalty of A$8 million is subject to court approval.

APRA has since separately imposed licence conditions on Bendigo Bank for failing to adequately address weaknesses in its non-financial risk management program despite years of remediation activity.

Prime Minister announces that Australia will develop a holistic Australian AI framework 

Recently, the Australian Prime Minister, Anthony Albanese, confirmed in a press conference that an OpenAI agent had gained unauthorised access to the online Medicare Statistics Reporting Portal in June 2026. In response, the Australian Government announced a review of the incident and foreshadowed that the review will inform the AI standards announced earlier this year. 

In July 2026, the Australian Prime Minister made a speech with a number of commitments in relation to AI. Notably, he committed to:

• (AustralianAI standards) introducing a “single, national framework” of “Australian Standards” that address all aspects of AI, including data centres, copyright and artist protections, productivity, workplace impacts, education and defence and national security, and is expected to impose strong safeguards following the OpenAI breach. Development of the standards will be coordinated by a new Office of AI (within the Department of Prime Minister and Cabinet) which will coordinate with other government departments and agencies;
• (data centres) as part of the “clear rules for large data centres”, introducing obligations to underwrite new power supply, be net-generators, build renewable generation, minimise water use, maximise energy efficiency and pay for additional water infrastructure;
• (IP protections) ensuring that laws confirm that creators of original works (such as writers, musicians, artists and journalists) retain ownership and control of their work, so that it is not used to build or train AI without their consent.

The development of a cohesive Australian AI framework will be of interest to both domestic and global businesses. 

Subsequently, and in addition to releasing draft legislation for the second tranche of privacy reforms (see above) and a digital duty of care (see below), the Attorney-General Department announced it will pursue:

• AI safety in the workplace as a priority area for the Artificial Intelligence Workplace and Employment Forum;
• options in Australian consumer law to address consumer risks, including retail surveillance pricing and agentic commerce; and
• development of a framework to better regulate how federal agencies use automated decision-making.

The priorities build on the pillars of the National AI Plan announced late last year.

South Australia announces conduct royal commission into AI 

The State of South Australia (SA) is conducting a royal commission into AI, set to investigate economic and social opportunities and challenges. In particular, it will look at policy and regulatory settings, education, the public service (including health), skills and workforce, and opportunities related to AI-related infrastructure.

Businesses, industry bodies and technology developers are among those invited to provide evidence to the royal commission, which commenced on 1 October 2026, with the final report due on 1 July 2027.

Following the independent review of the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act) released in February 2026:

Proposed amendments to streamline and modernise the SOCI Act

The review found that the SOCI Act laid a strong foundation for safeguarding infrastructure assets, but that the legislative framework requires ongoing refinement to remain adaptable and to continue to meet its objectives effectively.

In response, the Department of Home Affairs is progressing a second tranche of reforms to reduce complexity and regulatory overlap and strengthen governance, assurance and accountability. Key proposals include:

• a consolidated exemptions framework for organisations already subject to another Australian law or recognised enforceable framework imposing substantially equivalent or stronger requirements;
• updates to the critical electricity asset framework to better address distributed energy resources;
• new obligations for service providers that are "relevant operators" with material practical control over a critical infrastructure asset or critical function;
• enhanced supply chain cyber security assurance, including clarifying how responsible entities should assess and manage cyber security risks arising from major suppliers and service providers;
• new obligations for related entities to cooperate with a responsible entity's critical infrastructure risk management program (CIRMP) compliance;
• changes to CIRMP governance and assurance requirements, and a proposal to permit CIRMP annual compliance reports to be used as evidence in civil penalty proceedings; and
• updates to the “critical worker” and “critical component” concepts to directly focus on personnel with privileged access to, or authority over, critical infrastructure assets and systems.

While the consultation is intended to simplify and modernise the framework, a number of the proposals could broaden the range of entities, assets and arrangements that are subject to SOCI Act obligations. Particular consideration should be given to the potential impact on outsourcing arrangements, corporate group structures and supply chain dependencies.

Enhanced CIRMP obligations commence 

For certain organisations with CIRMP obligations under the SOCI Act, the Enhanced CIRMP Rules have now commenced. A number of the enhanced obligations commence after a 12 month grace period (from June 2027), with a further 24 month grace period (until June 2028) for more complex obligations. 

Responsible entities for the following kinds of critical infrastructure assets will need to ensure they comply with both the enhanced and ‘baseline’ CIRMP requirements after the applicable grace period:

• critical energy market operator assets; 
• critical electricity assets; 
• critical gas assets; 
• critical liquid fuel assets; 
• critical water assets; 
• critical broadcasting assets; 
• critical domain name systems; 
• critical freight service assets; and
• critical freight infrastructure assets. 

The Enhanced CIRMP Rules are intended to uplift critical infrastructure providers’ existing risk management programs and ensure providers identify and minimise, mitigate and eliminate risks across their assets. This includes ‘additional material risks’, such as risks relating to Australia’s social stability, economic stability, national security or defence, foreign ownership, control or influence, and offshore or remote access to critical components and business critical data. 

Other specific enhanced obligations are intended to address cyber and information security, personnel, supply chain and physical security hazards.

Responsible entities for these kinds of critical infrastructure assets should review their existing CIRMPs and start planning for these uplifted obligations. 

In addition to the significant proposed Privacy Act reforms, the Australian Government has also released exposure draft legislation proposing significant changes to the Online Safety Act 2021 (Cth). One of the key proposed reforms – a new “digital duty of care” – would require online services to, so far as is reasonably practicable, maintain a safe online environment in which:

• Australians are protected from seriously harmful material and conduct; 
• children are protected from material harmful to children; and
• for social media services, design features with negative behavioural impacts do not operate for children under 16.

You can read more about the impact of this and the other proposed changes in our team’s recent article. 

Other key updates relating to online safety include the following:

• Despite the introduction of the social media ban for under 16s in December 2025, eSafety has reported a ‘modest’ decline in under 16s’ use of social media platforms and the Australian Government has noted that platforms ‘are not doing enough to keep under 16s off social media’. The Australian Government has increased the maximum penalty for a company’s systematic breaches of this law from A$49.5 million to A$99 million (now up to A$109.2 million, following the 1 July 2026 increase to the penalty unit value). 
• X Corp was successful in Federal Court proceedings which found that it is not required to comply with the online safety standard for ‘relevant electronic services’ (such as messaging services) in addition to the standard for social media services. Following the Court’s judgment, eSafety has published updated regulatory guidance for industry on the online safety codes and standards. 
• eSafety has continued to actively exercise its enforcement powers:
  • obtaining orders (by consent) that X Corp pay a A$650,000 civil penalty for failing to fully comply with a transparency notice seeking information about the steps Twitter, Inc. (prior to its merger with X Corp) had taken to comply with the Australian Basic Online Safety Expectations;
  • commencing civil penalty proceedings against Telegram for its alleged failure to detect and remove pro-terror material from the messaging service platforms; and
  • obtaining a court-enforceable undertaking from Roblox, committing to implementing a range of additional measures to ensure Roblox meets its online safety obligations. 

In general news, the Digital Platform Regulators Forum (DP-REG) has signed a memorandum of understanding, permitting the Australian Competition and Consumer Commission, the OAIC, the Australian Communications and Media Authority (ACMA) and eSafety to share information and coordinate activities relating to regulation of digital platforms. 

In the privacy space:

• The OAIC announced a focus on surveillance wearables, such as ‘smart glasses’, and subsequently announced that it has commenced an investigation into one of the makers of a smart glasses phone app. Companies that store personal information collected by surveillance wearables are required to handle that information in compliance with the APPs. Where footage is collected by individuals, the APPs would not apply, however the statutory tort of privacy may. The OAIC has foreshadowed that other legal protections may be needed to protect individuals from harm, but a ban or specific rules did not form part of the proposed Tranche 2 Privacy Act reforms – the Attorney-General has noted that the proposed reforms seek to address emerging technologies through a principles-based technology neutral approach.
• The OAIC’s preliminary inquiries into a malicious social engineering attack on Qantas’ overseas third-party contact centre provider demonstrate that data incidents are not inherently breaches of APP 11.1 information security obligations (or APP 1.2, 8.1 or 11.2). An organisation may comply with its information security obligations but despite these efforts, data incidents may still occur. 
• Following the Administrative Review Tribunal’s findings in the Bunnings facial recognition case (which we reported on in our previous edition of Digital Bytes), the OAIC has published updated guidance on facial recognition in retail spaces. The guidance emphasises that collection of biometric information for the purposes of automated identity verification generally requires consent, unless an exception applies, and indicates that implied consent should generally not be relied on when collecting sensitive information (so in the case of facial recognition, it is generally impractical to obtain valid consent). In relation to the exceptions, the OAIC recommends that:
  • entities relying on the ‘serious threat’ exception should clearly identify and articulate the threat being addressed and why it is serious; and
  • entities relying on the ‘unlawful activity or serious misconduct’ exception should consider whether a more constrained use of facial recognition could be implemented to achieve the purpose. Entities should consider suitability, alternatives and proportionality.
• Privacy legislation regulating public sector entities in Western Australia took effect on 1 July 2026. The Privacy and Responsible Information Sharing Act 2024 (WA) is currently considered the most advanced privacy law framework in Australia, including a broader definition of “personal information”, a “fair and reasonable test” for the collection, use and disclosure personal information (regardless of whether the individual has given consent), and requirements for handling de-identified information and managing automated decision-making risks. 
• The OAIC has released a template collection notice for entities bound by the expanded AML/CTF legislation. It is also a useful resource for other entities to review the OAIC’s drafting and consider refreshing their collection notices. 
• The OAIC has also provided an update on its action in response to the 2023 Latitude data breach – the OAIC is continuing to prioritise its Commissioner-initiated investigation and the associated represented complaint.

In the telecommunications and spam space:

• The ACMA has commenced proceedings against Optus Mobile in relation to the September 2025 outage, alleging that Optus breached its emergency call service obligations. A Senate inquiry into triple zero service outages, which was prompted following the Optus Mobile September 2025 outage, has concluded and recommended establishing a statutory authority to be responsible for the triple zero function (for which Telstra is currently responsible), among other recommendations.
• TAB has paid a A$2.7 million penalty and provided a court-enforceable undertaking in relation to telemarketing calls that were made to its VIP customers on the Do Not Call Register, out of permitted hours, or without proper identification of the caller and purpose. TAB also self-reported more than 217,000 marketing emails and SMS sent without unsubscribe facilities. This serves as the latest reminder to organisations to ensure that any telemarketing or electronic marketing comply with the rules and obligations under Australia’s spam and telemarketing laws. 
• Some text messages look a little different after the new SMS Sender ID Register commenced on 1 July 2026. Under the new rules, messages sent using an unregistered branded sender ID, such as a business or organisation name, will appear on mobile phones labelled as ‘Unverified’. Messages sent using a registered sender ID will continue to appear with their registered name. If your organisation uses SMS to contact individuals or your customers and has not already registered your sender ID, there are a range of resources published by the ACMA to guide you through this process. 
• Telecommunications providers will also be aware of new transparency rules effective 30 June 2026 which require providers to publish standardised information about mobile coverage (which must be updated at least every three months) and network outages (including information about the duration of the outage, the geographic areas and types and estimated number of services affected, and the cause of the outage).

Organisations in the financial, insurance and superannuation sectors should be aware that the Australian Prudential Regulation Authority (APRA) has released its 2026-27 Corporate Plan. Among its broader strategic priorities, APRA’s priorities for 2026-27 relevantly include:

• strengthening operational resilience in response to AI and cyber risks, including ensuring APRA regulated entities strengthen their resilience to AI-enabled cyber threats, with an increased focus on quantum computing risks; and
• assessing entities’ ability to identify, assess and manage risks associated with concentrated reliance on common technology platforms and material service providers – APRA is expected to formalise its data collection for material service providers, which is expected to reduce some aspects of CPS 230 compliance for industry. 

For those interested in data centres, JWS regularly publishes updates as part of its ‘Data centre development in focus’ series. Recent articles explore foreign resident capital gains tax reforms.

You can also sign up to be notified of other JWS publications, including the popular Above Board series, by subscribing.