Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America and Asia-Pacific: 1,838 cases from 37 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Office of the Australian Information Commissioner (OAIC) €3.28m 100 % · 4 cases
What for?
by action- Fine €3.28m 100 % · 1 case
- Order – 0 % · 2 cases
- Other – 0 % · 1 case
Who?
by sectorAll sectors
When?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q4 2023 | 0 | – |
| Q1 2024 | 0 | – |
| Q2 2024 | 0 | – |
| Q3 2024 | 0 | – |
| Q4 2024 | 1 | – |
| Q1 2025 | 0 | – |
| Q2 2025 | 0 | – |
| Q3 2025 | 0 | – |
| Q4 2025 | 2 | €3.28m |
| Q1 2026 | 1 | – |
| Q2 2026 | 0 | – |
| Q3 2026 | 0 | – |
| Q4 2026 | 0 | – |
4 cases
20 Mar 2026 Singtel Optus Pty LtdOptus: unlisted numbers of 41,278 customers published in the phone directory Order
Singtel Optus asked customers who ported their number to Optus whether they wanted to appear in the phone directory, but between October 2015 and September 2019 it did not act on requests for an unlisted number, so that 41,278 affected customers remained published in the White Pages. The Privacy Commissioner found a breach of APP 11.1 because Optus did not remove a risk of errors it had been aware of throughout the period with reasonable steps such as regular system reconciliations, and declared that the company must not repeat this conduct. The regulator intends to decide on compensation separately in a representative complaint concerning the same conduct.
Known sources of error in legacy systems and in disclosures to third parties must be eliminated through regular reconciliations rather than tolerated for years.
Reliably implementing customers' privacy choices across systems and service providers
- Authority / court
- Office of the Australian Information Commissioner (OAIC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Privacy Act 1988 (Cth) s 13(1), APP 11.1; Erklärung nach s 52(1A)(a)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Published
- 11 Jun 2026
- Commissioner Initiated Investigation into Singtel Optus Pty Ltd (Privacy) [2026] AICmr 22 (20 March 2026) Decision of an authority
- OAIC: Privacy Commissioner finds against Optus in White Pages breach (11.06.2026) Press release of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
17 Oct 2025 Vinomofo Pty LtdVinomofo: privacy breach after unauthorised data access during a data migration Order
In 2022, during a large data migration project, the online wine retailer suffered unauthorised access to a database holding data on around 928,760 customers and members (identity, contact and financial information). The Privacy Commissioner found that Vinomofo had not taken reasonable steps to protect the data, although it had been aware of deficiencies in its security governance at least two years before the incident, and ordered it not to repeat these practices, together with specified remedial steps.
Data migrations to the cloud need their own security concept, and known weaknesses in security governance must not be put off.
Data security in migration projects and cloud services; privacy culture and training
Missing or inadequate training played a role in the decision.
- Authority / court
- Office of the Australian Information Commissioner (OAIC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- APP 11.1 (Privacy Act 1988 (Cth))
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Published
- 29 Oct 2025
- OAIC: Vinomofo did not protect personal information from security risks, Privacy Commissioner finds (29 October 2025) Press release of an authority
- OAIC: Privacy determinations – Commissioner Initiated Investigation into Vinomofo Pty Ltd (Privacy) [2025] AICmr 175 (17 October 2025) Enforcement database of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
8 Oct 2025 Australian Clinical Labs LimitedAustralian Clinical Labs: 5.8 million AUD civil penalty after Medlab Pathology data breach €3.28m
On the application of the Australian Information Commissioner, the Federal Court of Australia imposed the first civil penalties under the Privacy Act 1988: Australian Clinical Labs (ACL) had failed to adequately protect the personal information held on the IT systems of its Medlab Pathology business; in a cyberattack in February 2022, data of more than 223,000 people was taken from those systems. The penalty of 5.8 million AUD in total comprises 4.2 million AUD for the inadequate security measures (APP 11.1), 800,000 AUD because ACL did not assess reasonably and promptly whether a notifiable data breach had occurred, and 800,000 AUD for the late notification to the Commissioner. ACL admitted the contraventions; liability and the penalty were allegedly based on joint submissions by the parties.
When a business unit's IT systems are integrated into an organisation's own environment, they must be adequately protected from the outset, and attacks must be promptly assessed for a notification duty.
Securing integrated IT systems, assessing and notifying data breaches promptly
- Authority / court
- Office of the Australian Information Commissioner (OAIC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Privacy Act 1988 (Cth) s 13G(a) i. V. m. APP 11.1; s 26WH(2); s 26WK(2)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Healthcare
- Culpability
- negligent
- Mitigating circumstances
- Cooperation with the investigation, an ongoing programme to uplift cyber security, apologies and admission of liability.
- Liability of senior managers
- The court found that the most senior management was involved in the decisions on integrating the Medlab systems and on assessing the attack.
- Published
- 9 Oct 2025
Original amount 5,800,000 AUD, converted at the ECB reference rate of 8 Oct 2025.
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
17 Dec 2024 Meta Platforms, Inc.Meta: 50 million AUD payment programme for Australians affected by Cambridge Analytica Other
To end the civil penalty proceedings pending before the Federal Court since March 2020, the Australian Information Commissioner accepted an enforceable undertaking from Meta Platforms under which Meta sets up a payment programme of 50 million AUD for Australian Facebook users whose data may have been disclosed to the app “This is Your Digital Life”. The regulator said Meta had allegedly committed serious or repeated breaches of APP 6.1 and 11.1; the undertaking was given without any admission of liability, and the proceedings were withdrawn. Unused funds go to the Commonwealth budget; Meta also contributed to the regulator's legal costs.
Platforms must control which data third-party apps can access about users and their contacts.
Controlling third-party app access to data through interfaces
- Authority / court
- Office of the Australian Information Commissioner (OAIC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Regulatory Powers (Standard Provisions) Act 2014 (Cth) s 114; Vorwurf: Privacy Act 1988 (Cth) s 13G i. V. m. APP 6.1 und 11.1
- Action
- Other
- Status of proceedings
- final
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Mitigating circumstances
- According to the undertaking, Meta no longer allows third-party apps to access data of Facebook friends who have not installed and authorised the app themselves, has reduced the data fields available, introduced more granular permissions and regularly checks app developers.
- Published
- 17 Dec 2024
- OAIC: Landmark settlement of $50m from Meta for Australian users impacted by Cambridge Analytica incident (17.12.2024) Press release of an authority
- OAIC: Meta Platforms, Inc.: enforceable undertaking (17 December 2024) Official register or notice
Checked against the official source on 3 Oct 2026 · Direct link