Australia Passes Bill to Fine Companies up to $50 Million for Data Breaches

The Australian government has passed a bill that markedly
increases the penalty for companies suffering from serious or
repeated data breaches.

To that end, the maximum fines have been bumped up from the
current AU$2.22 million to AU$50 million, 30% of an entity’s
adjusted turnover in the relevant period, or three times the value
of any benefit obtained through the misuse of information,
whichever is greater.

The turnover period is the time duration from when the
contravention occurred to the end of the month when the incident is
officially addressed.

“Significant privacy breaches in recent months have shown
existing safeguards are outdated and inadequate,” Attorney-General
Mark Dreyfus said^[1]
in a statement. “These reforms make clear to companies that the
penalty for a major data breach can no longer be regarded as the
cost of doing business.”

The legislation, called the Privacy Legislation Amendment
(Enforcement and Other Measures) Bill 2022, also bestows more
powers to the Australian Information Commissioner to address
security breaches.

The “new information sharing powers will facilitate engagement
with domestic regulators and our international counterparts to help
us perform our regulatory role efficiently and effectively,”
Australian Information Commissioner and Privacy Commissioner
Angelene Falk said^[2].

The bill, which has been tabled as part of wider reforms to the
Privacy Act 1988^[3], now awaits Royal Assent^[4]
to be formally signed into law.

The development comes in the wake of recent major breaches at
Optus^[5]
and Medibank^[6]
that have resulted in the leak of personal information associated
with 2.1 million and 9.7 million customers, respectively.