Australian Information Commissioner v Australian Clinical Labs Limited [2025] FCA 1224 | Case summary | Zoe

CTHFCA

Australian Information Commissioner v Australian Clinical Labs Limited

[2025] FCA 1224

Federal Court of Australia|2025-10-08|Before: Halley J

View original source

General information, not legal advice.

At a glance

Source facts

Court

Federal Court of Australia

Decision date

2025-10-08

Before

Halley J

Source

Original judgment source is linked above.

Judgment (120 paragraphs)

[1]

PRIVACY ACT - Where an APP entity breached Australian Privacy Principle (APP) 11.1 of the Privacy Act 1988 (Cth) (Act) by failing to take reasonable steps to protect personal information from unauthorised access or disclosure - what constitutes "reasonable steps" - where an APP entity interfered with the privacy of 223,000 individuals under s 13(1) of the Act by breaching an APP - where breaches of privacy constituted "serious contravention" under s 13G of the Act - where breach of privacy of each individual constituted a separate contravention of s 13G of the Act - where an APP entity was aware that there were reasonable grounds to suspect that there may have been an eligible data breach - where an APP entity failed to carry out a reasonable and expeditious assessment to determine whether there were reasonable grounds to believe that there was an eligible data breach in contravention of s 26WH of the Act - where contravention of s 26WH of the Act was serious - where an APP entity was aware that there were reasonable grounds to believe that there had been an eligible data breach - where an APP entity failed to prepare a statement in relation to the eligible data breach and provide it to the Commissioner in contravention of of the Act - where contravention of of the Act was serious - where a penalty was agreed between the regulator and the contravener -where a contravener admitted contraventions - where contraventions were extensive and significant - where it is not possible to quantify the loss or damage caused by contravening conduct - where contraventions were not deliberate - where a contravener cooperated with the regulator - where a contravener took meaningful steps to develop a satisfactory culture of compliance - where 223,000 contraventions arose from a single course of conduct - where the Court satisfied that agreed penalty falls within permissible range of penalties sufficient for both specific and general deterrence

[45]

The respondent, Australian Clinical Labs Limited (ACL), is and was during the period from 19 December 2021 to 15 July 2022 (Relevant Period), one of the largest private hospital pathology businesses in Australia. In the course of the conduct of its business as a provider of healthcare services, ACL collects and holds individual patient's personal and sensitive information, including health information, for the purposes of providing test results and issuing invoices.
On 19 December 2021, ACL acquired the assets of Medlab Pathology Pty Ltd. From the date of acquisition, ACL owned and controlled Medlab's computer and communications hardware, computer and information technology systems, equipment, and software (Medlab IT Systems).
On or shortly prior to 25 February 2022, the Quantum Group initiated a cyberattack against the Medlab IT Systems (Medlab Cyberattack).
The Medlab Cyberattack resulted in 86 gigabytes of data, including the personal and sensitive health information of more than 223,000 individuals, being exfiltrated and subsequently published on the dark web.
On 2 November 2023, the applicant, the Australian Information Commissioner (Commissioner), commenced this proceeding seeking declarations that ACL had contravened s 13G(a) of the Privacy Act 1988 (Cth) (Act) by failing to (a) take reasonable steps to protect individuals' personal information that it held over the period from 26 May 2021 to 29 September 2022, in breach of Australian Privacy Principle (APP) 11.1(b), and (b) conduct a reasonable assessment of whether the Medlab Cyberattack constituted an "eligible data breach" (as this concept is defined in the Act) and then failing to notify the Commissioner as soon as practicable, in contravention of s 26WH(2) and s 26WK(2) of the Act.
This is the first civil penalty proceeding brought by the Commissioner in the history of the Act.
Although ACL consents to the making of the declarations and the imposition of the aggregate civil penalty sought by the Commissioner, it is necessary for the Court to determine whether the declarations and pecuniary penalty orders are appropriate and should be made. For the following reasons, I have concluded that having regard to all the relevant circumstances the aggregate agreed penalty of $5,800,000 falls within the permissible range of penalties that would be sufficient for the purposes of both specific and general deterrence given the serious nature of the contraventions by ACL.

[52]

On 1 March 2022, StickmanCyber ceased investigating whether there had been any exfiltration of data as a result of the Medlab Cyberattack, with the last dark web scan being conducted on that day.
On 2 March 2022, StickmanCyber provided ACL with an "Incident Summary Report" (Report) summarising its findings and conclusions resulting from 44.5 hours of investigating the Medlab Cyberattack. In the Report, StickmanCyber stated that the "Root Cause" computer was infected, and "TSsel.exe was executed" by (a) spreading across the network, (b) adding "attribute .quantum" to all readable files, and (c) encrypting all .quantum files.
StickmanCyber conducted a limited investigation of whether the Quantum Group may have established mechanisms to stay connected to the Medlab IT Systems and its network.
On 11 March 2022, StickmanCyber closed its investigation.
On 15 March 2022, StickmanCyber sent an email to ACL's Head of Technical Services concerning the notifiable data breach scheme in the Act and provided a link to the website of the Office of the Commissioner. StickmanCyber concluded the email by stating that at the point they had ended their engagement, they "would have to say" that the Medlab Cyberattack did not cause harm to any individual.
By 18 March 2022, ACL's CIO and Head of Technical Services formed a view that the threat posed by the Medlab Cyberattack had been contained, and that there was no information suggesting that personal information held by the Medlab IT Systems had been exfiltrated.
By 21 March 2022, based on the analysis conducted and the advice provided by StickmanCyber, ACL had determined that the Medlab Cyberattack was not an eligible data breach within the meaning of s 26WE of the Act.
At 5.28 am on 25 March 2022, the Australian Cyber Security Centre (ACSC) notified ACL that it had received intelligence from a trusted third party that Medlab may have been a victim of a ransomware incident and reminded ACL that it may be required to notify the Commissioner and affected individuals (first ACSC notification).
At 3.10 pm on 25 March 2022, ACL's CIO sent an email to the ACSC with details of the Medlab Cyberattack and informed the ACSC that, following monitoring of impacted devices and the dark web, ACL did not believe that any data had been exfiltrated.
On 29 March 2022, ACL's CIO advised the ACL board that:

[72]

I am satisfied that the agreed facts and admissions the subject of the SAFA and summarised at [10] to [39] above establish that ACL did not take "such steps as are reasonable in the circumstances" to protect the personal information held on the Medlab IT Systems from, relevantly, "unauthorised access" and "unauthorised disclosure", in particular having regard to (a) the size and nature of the business of ACL; (b) the volume and sensitivity of the information; (c) the high cybersecurity risks facing ACL during the Relevant Period and the risk of harm to individuals if their health and other personal information held by ACL on the Medlab IT Systems was accessed and disclosed without authorisation, (d) the Medlab IT Systems Deficiencies, (e) ACL's failure to identify the Medlab IT Systems Deficiencies prior to their acquisition, (f) the delay in ACL identifying the Medlab IT Systems Deficiencies, and (g) the overreliance that ACL placed on third party service providers and its failure to have in place adequate procedures to detect and respond by itself to cyber incidents.
As ACL has admitted in the SAFA, its ability to detect and respond by itself to cyber incidents was deficient because (a) the ACL cyber incidents playbooks did not clearly define roles and responsibilities for incident response efforts, contained limited detail on containment processes that should be deployed in the event of a cyber incident or steps that ACL should take to mitigate exfiltration of data in the event of a cyber incident, and recommended steps for technologies that were not used within the Medlab IT Systems, (b) there was inadequate testing of incident management processes in the period between the acquisition of the Medlab IT Systems and the Medlab Cyberattack, (c) Data Loss Prevention was not used on the Medlab IT Systems to detect or prevent the theft of personal information and data held on those systems, (d) adequate tooling/products that could perform behavioural-based analysis of activities in order to determine whether malicious actions might be undetected by an antivirus product were not used, (e) there was no application whitelisting in place to prevent unknown or unauthorised applications from running on Medlab computers, (f) there were only limited communications plans, (g) the Medlab IT Team Leader had not seen, used, or received training on the playbooks provided and had no formal cybersecurity background or incident response training, (h) there was limited security monitoring capability because the firewall logs were only retained for one hour, (i) specific data recovery plans had not been developed, and (j) Medlab staff were not required to use multifactor identification to use the Medlab VPN (together, Medlab Cyberattack Response Deficiencies).
For these reasons, I am satisfied that ACL breached APP 11.1(b) of the Act, and, by reason of s 13(1)(a) of the Act, that breach constituted an interference with the privacy of more than 223,000 individuals whose personal information ACL held on the Medlab IT Systems.
Further, I am satisfied that the breaches of privacy of those 223,000 individuals were serious for the purposes of s 13G(a) of the Act.
There is no definition of "serious" or "serious contravention" in the Act. Nor is "serious contravention" defined in either the Australian Securities and Investments Act 2001 (Cth) (ASIC Act) or the Corporations Act.
For the purposes of the ASIC Act and the Corporations Act, a "serious contravention" has been construed as a contravention that is "grave or significant" or "weighty, important, grave and considerable", and, in every case, it is ultimately a question of fact to be determined by reference to the degree of the departure from the requisite standard of care and diligence and the nature of the conduct, rather than the nature of the provision that has been contravened: Provide Nominees Pty Ltd v Australian Securities and Investments Commission [2024] FCA 303 at [47]- [53] (Rofe J), in which her Honour agreed with the reasoning of both Ipp JA in Vines v Australian Securities and Investments Commission [2007] NSWCA 126; (2007) 63 ACSR 505 at [229] and Lee J in Australian Securities and Investments Commission v GetSwift Ltd (Penalty Hearing) (2023) [2023] FCA 100; 167 ACSR 178 at [54].
I am satisfied that, applying those principles, as jointly submitted by the parties, the "serious" threshold has been met, particularly having regard to the nature and volume of the personal information, including sensitive health information held on the Medlab IT Systems, the extent of the Medlab IT System Deficiencies, and the Medlab Cyberattack Response Deficiencies, and ACL's reliance on a third party cybersecurity services provider, all of which significantly heightened the risk that the personal information would be exposed to unauthorised access.
It is next necessary to determine the number of contraventions arising from the breach of APP 11.1(b).
The parties have agreed, and I am satisfied, that ACL engaged in a separate contravention of s 13G(a) in respect of each of the more than 223,000 individuals, whose personal information was held on the Medlab IT Systems during the Relevant Period.
The objects of the Act, as stated in s 2A, make plain that the Act is directed primarily at the "protection of the privacy of individuals" - not the acts or practices that might breach APPs. That emphasis is also consistent with the following statement in the Explanatory Memorandum to the Privacy Amendment (Enhancing Privacy Protection) Bill 2012 (Cth) on the proposed s 13G to the Act:

[88]

I am persuaded that the facts agreed and the admissions made in the SAFA are sufficient to establish that by 2 March 2022, ACL had subjective knowledge or awareness of circumstances, notwithstanding StickmanCyber's advice to the contrary, that were objectively sufficient to establish in the mind of a reasonable person a suspicion that (a) there may have been unauthorised access to the personal and sensitive information of individual customers and patients held on the Medlab IT Systems over which ACL had control at that time, and (b) that access would be likely to result in serious harm to any of the over 223,000 individuals to whom the information related.
I am satisfied that this knowledge or awareness of ACL was sufficient to give rise to the requisite state of suspicion under s 26WH(1), by reason of s 26WH(2) of the Act, and thereby requires ACL to carry out a reasonable and expeditious assessment to determine whether there were reasonable grounds to believe that the Medlab Cyberattack amounted to an eligible data breach, and to take all reasonable steps to complete that assessment within 30 days of 2 March 2022.
I am also persuaded the facts agreed and the admissions made in the SAFA are sufficient to establish that ACL did not carry out such an assessment and thereby contravened s 26WH(2) of the Act for the following reasons.
First, the assessment undertaken by StickmanCyber that was relied upon by ACL was inadequate because it (a) only monitored 3 of the at least 127 computers subject to ransomware deployed by the Quantum Group, (b) did not conduct any investigation into the Quantum Group and its attack traits to determine whether data was likely to have been exfiltrated, (c) based its review on only one of the firewall logs, which it did not access until approximately four hours after the ransom demand was first downloaded, and (d) only conducted a limited investigation of whether the Quantum Group may have established a persistence mechanism to stay connected to the Medlab IT Systems and its network.
Second, ACL was aware of the limited assessment undertaken by StickmanCyber and it was therefore unreasonable for ACL to rely solely on that assessment and StickmanCyber's advice to conclude by 2 March 2022 that the threat posed by the Medlab Cyberattack had been contained and that there was no information which suggested that personal information held by the Medlab IT Systems had been exfiltrated.
Further, I am persuaded that the contravention by ACL of s 26WH(2) was serious, in particular because of (a) the sensitivity and volume of the personal information held on the Medlab IT Systems, (b) the high cybersecurity risks facing ACL during the Relevant Period, and (c) the fact that the failure to conduct the stipulated reasonable and expeditious assessment likely resulted in a delay in ACL ultimately notifying the Commissioner on 10 July 2022 that there were reasonable grounds to believe that there had been an eligible data breach and thereby delayed the ability to the Commissioner to perform her statutory function of monitoring ACL's notification to individuals whose personal information may have been compromised.
I am therefore satisfied that ACL engaged in a single contravention of s 13G(a) of the Act by reason of its contravention of s 26WH(2) of the Act.

[100]

The Court has a wide discretionary power to make declarations under s 21 of the Federal Court of Australia Act 1976 (Cth): Forster v Jododex Australia Pty Ltd [1972] HCA 61; (1972) 127 CLR 421 at 437-8 (Gibbs J); Ainsworth v Criminal Justice Commission [1992] HCA 10; (1992) 175 CLR 564 at 581-2 (Mason CJ, Dawson, Toohey and Gaudron JJ).
Before making a declaration, including a declaration by consent, the Court must be satisfied that (a) the question must be a real and not a hypothetical or theoretical one, (b) the applicant must have a real interest in raising it, and (c) there must be a proper contradictor: Jododex at 437-8 (Gibbs J).
A respondent who has a real interest in opposing a declaration may be a proper contradictor notwithstanding that it consents to the making of the declaration: Australian Competition and Consumer Commission v MSY Technology Pty Ltd (2012) 201 FCR 378; [2012] FCAFC 56 at [30].
The Court should pay close attention to the form of declarations, particularly declarations made "by consent", and should ensure that the declarations outline the "gist" of the Court's findings identifying the contravening conduct: Rural Press Ltd v Australian Competition and Consumer Commission (2003) 216 CLR 53; [2003] HCA 75 at [89]- [90] (Gummow, Hayne and Heydon JJ).
It is well established that declarations of contraventions of legislative provisions are likely to be appropriate where they (a) record the Court's disapproval of the contravening conduct, (b) vindicate a regulator's claim that a respondent contravened the provisions, (c) assist a regulator in performing its duties, and (d) deter other persons from contravening the provisions: Australian Securities and Investments Commission v Macquarie Bank Limited [2024] FCA 416 at [57] (Wigney J).
The Court must be independently satisfied that a contravention has occurred before making a declaration that a civil penalty provision has been contravened, but the material which may produce that satisfaction may include a statement of agreed facts and admissions: Australian Securities and Investments Commission v Rich [2004] NSWSC 836; (2004) 50 ACSR 500 at [15] (White J).

[113]

If the Court is satisfied that there has been a contravention of a civil penalty provision, it then has a discretion to order the contravener to pay a pecuniary penalty.
The following general principles governing the exercise of that discretion can be distilled from the authorities as relevantly applicable to the imposition of a pecuniary penalty for a contravention of s 13G(a) of the Act.
First, "the purpose of a civil penalty is primarily, if not solely, the promotion of the public interest in compliance with the provisions of the [Act] by the deterrence of further contraventions of the [Act]": Australian Building and Construction Commissioner v Pattinson (2022) 274 CLR 450; [2022] HCA 13 at [9].
Second, the power to order a penalty under s 82(3) of the Regulatory Powers Act is a discretionary one which must be exercised judicially, having regard to the subject matter, scope, and purpose of the legislation: Pattinson at [40].
Third, the process of fixing the quantum of a penalty is one of "instinctive synthesis", addressing many conflicting and contrasting considerations: Australian Competition and Consumer Commission v Reckitt Benckiser (Australia) Pty Ltd [2016] FCAFC 181 at [44] (Jagot, Yates and Bromwich JJ).
Fourth, a civil penalty must be fixed with a view to ensuring that the penalty is not such as to be regarded by the contravener (or others) as an acceptable cost of doing business: Australian Competition and Consumer Commission v TPG Internet Pty Ltd (2013) 250 CLR 640; [2013] HCA 54 at [66] (French CJ, Crennan, Bell and Keane JJ), quoting Singtel Optus Pty Ltd v Australian Competition and Consumer Commission [2012] FCAFC 20 at [62] (Keane CJ, Finn and Gilmour JJ).
Fifth, the penalty to be imposed must be proportionate in a sense that it must strike a reasonable balance between deterrence and oppressive severity: Pattinson at [41].
Sixth, the "course of conduct" or "one transaction" principle requiring consideration of whether the subject contraventions arise out of the same course of conduct or the same transaction may inform the Court's determination of an appropriate penalty: Australian Competition and Consumer Commission v Yazaki Corporation (2018) 262 FCR 243, [2018] FCAFC 73 at [234] (Allsop CJ, Middleton and Robertson JJ) .

[117]

As explained above, during the Relevant Period s 13G(a) of the Act attracted a maximum civil penalty of 2,000 penalty units, and s 82(5)(a) of the Regulatory Powers Act provided that the pecuniary penalty for a body corporate must not be more than five times the pecuniary penalty specified for the civil penalty provision. Further, during the Relevant Period, the value of a penalty unit was set at $222.00: s 4AA of the Crimes Act 1914 (Cth).
The parties have agreed a penalty of (a) $4.2 million for the 223,000 contraventions of s 13G(a) by reason of the breaches of APP 11.1 against a maximum penalty of $495,060,000,000, (b) $800,000 for the single contravention of s 13G(a) by reason of the contravention of s 26WH(2) against a maximum penalty of $2.2 million, and (c) $800,000 for the single contravention of s 13G(a) by reason of the contravention of s 26WH(2) against a maximum penalty of $2.2 million.
I am persuaded that in aggregate, the agreed penalty of $5,800,000 is appropriate in all the circumstances. I am satisfied for the following principal reasons that it falls within the range of permissible penalties that the Court could impose in this case for the contraventions by ACL of s 13G(a) in the context of the agreed facts and admissions in the SAFA.
First, the contraventions were extensive and significant. The cybersecurity controls of the Medlab IT Systems were under the control of ACL from the commencement of the Relevant Period and were deficient from at least the time the assets of Medlab were acquired. The Medlab IT Systems Deficiencies, to the knowledge of ACL, exposed the Medlab IT Systems to the risk of a cyberattack during the six-month period in which ACL was integrating them into ACL's core IT network. That risk materialised in the Medlab Cyberattack in which personal and sensitive information of at least 223,000 individuals, including passport numbers, health information and financial information, was compromised and, on or before 16 June 2022, posted on the dark web.
Second, ACL's contraventions of s 13G(a) of the Act resulted from its failure to act with sufficient care and diligence in managing the risk of a cyberattack on the Medlab IT Systems.
Third, although it is not possible to quantify the loss or damage caused by ACL's contravening conduct, I am satisfied that the contraventions, given the nature of the information posted on the dark web, had at least the potential to cause significant harm to individuals whose information had been exfiltrated, including financial harm, distress or psychological harms, and material inconvenience.
Fourth, and relatedly, the contraventions had the potential to have a broader impact on public trust in entities holding private and sensitive information of individuals, including the capability of those entities to identify and report eligible data breaches to the Commissioner in a timely fashion to enable her to perform her statutory functions, including monitoring of steps to be taken to notify affected individuals to enable them to take actions to protect themselves from the harm, loss, and damage associated with the eligible data breaches.
Fifth, relevantly for personal deterrence, ACL is and was during the Relevant Period, one of Australia's largest private hospital pathology businesses, generating (a) revenue of $674.4 million and net profit of $88.7 million in the financial year ending 30 June 2021, (b) revenue of $995.6 million and net profit of $178.2 million in the financial year ending 30 June 2022, and (c) revenue of $697.1 million and net profit of $41.7 million in the financial year ending 30 June 2023.
Sixth, ACL's most senior management were involved in the decision making around the integration of Medlab's IT Systems into ACL's core environment and ACL's response to the Medlab Cyberattack, including whether it amounted to an eligible data breach.
The matters summarised above would suggest that a penalty of $5.8 million was manifestly inadequate or at least outside an acceptable or permissible range to achieve specific and general deterrence. The significance of these matters, however, needs to be weighed against the following ameliorating considerations.
First, ACL did not derive financial gain or benefit from the contraventions.
Second, ACL has not previously been found by a Court to have contravened the Act or otherwise engaged in any similar conduct.
Third, there is no suggestion that any of the contraventions were deliberate or arose from any deliberate misconduct of any of ACL's senior management.
Fourth, ACL had commenced a review of its cybersecurity processes and controls prior to the Medlab Cyberattack, and the ACL board had approved in July 2021 a program of works to uplift the company's cybersecurity capabilities. The program included a requirement since August 2022 that all ACL employees undertake regular cybersecurity awareness training through a specialist third party vendor. Further, in August 2023, ACL appointed an experienced and credentialled full-time Chief Information Security Officer. I am satisfied that these actions demonstrate that ACL has sought, and continues to seek, to take meaningful steps to develop a satisfactory culture of compliance.
Fifth, ACL has cooperated with the investigation undertaken by the office of the Commissioner since around December 2022 into the acts and practices of ACL and Medlab in relation to the Medlab Cyberattack, including producing multiple written responses and some 12,000 documents.
Sixth, following the commencement of this proceeding and prior to the scheduled hearing on liability, ACL has admitted the contraventions the subject of the proceeding by way of the filing of the SAFA.
Seventh, the CEO of ACL apologised that the Medlab Cyberattack had occurred in the terms set out in the 27 October 2022 ASX announcement.
Eighth, although I have concluded that there were approximately 223,000 contraventions of s 13G(a) arising from the breach by ACL of APP 11.1(b), I am satisfied that the contraventions arose from a single course of conduct, being the failure to have in place adequate cybersecurity controls to protect individuals' personal information held on the Medlab IT Systems.
I am persuaded that, having regard to all these matters, the totality principle which operates as a final check and the need to avoid a penalty that is oppressively severe, an aggregate penalty of $5.8 million falls within the range of permissible penalties to achieve both specific and general deterrence. Further, as for specific deterrence, I am satisfied that the penalties could not objectively be characterised as "a cost of doing business" and, as for general deterrence, the penalty is sufficient to send an appropriate deterrent signal to participants in the healthcare system as to their responsibilities in protecting sensitive personal information in the course of conducting their businesses, particularly given this is the first civil penalty proceeding brought by the Commissioner in the history of the Act.