Australian Clinical Labs Fined for Medlab Pathology Data Breach

A major Australian healthcare provider has been ordered to pay substantial civil penalties following a significant data breach that compromised the personal details of more than 223,000 people. The Federal Court mandated that Australian Clinical Labs (ACL) pay a total of $5.8 million in fines related to a cybersecurity incident affecting its Medlab Pathology business in February 2022. This incident marked the first time civil penalties have been issued under the Privacy Act 1988.

Elizabeth Tydd, the Australian Information Commissioner, expressed approval of the court’s decision, emphasizing its role as a crucial warning. She stated that the ruling reminds all organizations bound by the Privacy Principles of their duty to remain alert in safeguarding and managing personal data responsibly. The orders also serve as a strong deterrent, urging companies to conduct prompt and thorough investigations into potential data breaches and to report them correctly to the Commissioner’s office. Entities handling sensitive information must meet stricter security standards, especially since future violations could face significantly higher penalties under the updated Privacy Act.

The Federal Court imposed three separate penalties on ACL. A fine of $4.2 million was levied for failing to take reasonable steps to protect personal information stored on Medlab Pathology’s IT systems, breaching Australian Privacy Principle 11.1 and constituting over 223,000 violations of section 13G(a) of the Privacy Act. An additional $800,000 penalty was issued for ACL’s failure to conduct a reasonable and timely assessment to determine if an eligible data breach had occurred after the cyberattack, contravening section 26WH(2). Another $800,000 fine was applied for not preparing and submitting a statement about the eligible data breach to the Australian Information Commissioner as soon as practicable, in violation of section 26WK(2).

In his judgment, Justice Halley described the violations as both extensive and significant. He noted that ACL’s most senior management were directly involved in decisions regarding the integration of Medlab’s IT systems into ACL’s core environment and in the company’s response to the cyberattack, including the determination of whether it constituted an eligible data breach. The judge found that ACL’s failures resulted from a lack of sufficient care and diligence in managing the risk of a cyberattack on the Medlab systems. He also highlighted that the conduct had the potential to cause considerable harm to affected individuals, including financial loss, psychological distress, and significant inconvenience. Furthermore, the breaches risked eroding public trust in organizations entrusted with private and sensitive personal information.

Several mitigating factors led to a reduction in the overall penalty. Justice Halley acknowledged that ACL cooperated fully with the Commissioner’s investigation and had initiated a program to enhance the company’s cybersecurity capabilities. These actions demonstrated to the court that ACL is actively working to foster a satisfactory culture of compliance. The judge also considered the company’s apologies and its admission of liability as positive steps.

ACL admitted to the contraventions, consented to the court orders, and joined in joint submissions with the regulator on matters of liability and penalty. The fines were calculated under the penalty regime effective at the time of the breaches, which set a maximum penalty of $2.22 million per contravention. A new penalty regime introduced on December 13, 2022, now permits the court to impose much heavier fines for serious privacy violations. Under these updated rules, maximum penalties can reach $50 million per contravention, three times the value of any benefit obtained from the misconduct, or up to 30 percent of a business’s annual turnover.

Privacy Commissioner Carly Kind remarked that the outcome signifies an important milestone in Australian privacy law enforcement. She noted that for the first time, a regulated entity has faced civil penalties under the Privacy Act, aligning with public expectations and the powers granted to the OAIC by parliament. This case should serve as a clear warning to all entities, particularly those in the healthcare sector, that serious failures in protecting individuals’ privacy will have significant consequences.

(Source: ITWire Australia)