During the December Senate Estimates, I asked Ms Carly Kind, the Privacy Commissioner, what action had been taken regarding the Optus privacy breach in 2022. She explained that the matter is currently before the Federal Court.
I then raised two complaints that have been ongoing for more than two years. Ms Kind advised that those questions would need to be taken on notice, as would my query about the expected timeframe for a response. She was clear and firm on one point: the Commission operates independently.
Finally, I put it to Minister Nita Green that many Australians simply cannot afford access to justice. For them, the only safeguard is government agencies doing their job properly—and that responsibility cannot be understated.
— Senate Estimates | December 2025
Transcript
Senator ROBERTS: Thank you for appearing again tonight. I’ve got some simple questions on the data breach by Optus. Could you please confirm the current status of the Office of the Australian Information
Commissioner’s investigation into the major Optus data breach that occurred in 2022?
Ms Kind: I might speak to that. In August of this year, the Office of the Australian Information Commissioner filed civil penalties proceedings against Optus with respect to contraventions of APP 11 that we allege contributed to that breach in 2022. That matter is now before the Federal Court.
Senator ROBERTS: Can you explain the prolonged administrative inaction including the handling of complaints CP22/02004 and CP23/00456 that’s been going on for two years?
Ms Kind: I’m sorry, I don’t have those complaint numbers before me to cross-reference. Unless you’re able to provide me with more information, I will have to take any question on notice.
Senator ROBERTS: That’s fine. Take it on notice. I hear that you’ve taken the case to court. Could you provide a timeline for expected resolution and publication of the findings of your investigation?
Ms Kind: With respect to those matters that you’ve just referenced?
Senator ROBERTS: Yes.
Ms Kind: I’m happy to take that on notice.
Senator ROBERTS: Thank you. Can you provide an assurance that the OAIC’s regulatory powers will be exercised independently of civil proceedings?
Ms Kind: I’m very confident to provide that assurance with respect to all matters. We operate entirely independently and rigorously in every matter we take on.
Senator ROBERTS: Will the government commit to reviewing and strengthening data protection enforcement mechanisms, Minister? I’m very worried. Many Australians are worried; they’re marching in the
streets about it—the increased digitalisation. It just needs one hack, and there can be devastating consequences for so many people. I mentioned this so many times in the Senate, outside the Senate. We’ve got huge databases linking many, many people. It just needs one hack and it’s gone.
Senator Green: Senator, I’m not sure if you’re aware, but the government has committed to privacy reform. There’s a second stage of that being undertaken now. We’re committed to uplifting privacy laws because we
understand that they’re essential for Australia’s trust and confidence in the digital economy and digital services, as you raise.
Senator ROBERTS: I’m worried about data protection, though—not just privacy but data protection. What is the government doing about it? The consequences now will be devastating. The majority of hacks, I understand, are suffered by big tech platforms and government. Most of the problems are breaches of human oversight, undersight.
Senator Green: I understand what you’re saying, Senator. We passed laws in 2024 as a first tranche of privacy reforms through the Senate. We understand that the Australian Privacy Act is outdated and not fit for purpose for the digital age; that’s why we’re undertaking additional reforms. There will obviously be a process for that legislation to be brought to parliament to be considered and to go through committee processes, in which I’m sure you will participate. We’re undertaking that work at the moment.
Senator ROBERTS: When do you think we will see the first signs of—
Senator Green: The department might be able to give you more advice about that work.
Senator ROBERTS: People are worried about it; they’re terrified of it.
Senator Green: That’s why we’re doing something about it.
Ms Chidgey: I can say we’re working on that second tranche of privacy reform as a priority. Timing will ultimately be a matter for government. I can also say that the privacy reforms do have a data protection aspect to
them, and the Privacy Act contains within it requirements for securing personal information. I would also highlight that the government has a cybersecurity strategy that complements the privacy work.
Senator ROBERTS: Given that, as I understand, the majority of breaches are human error, it’s going to be hard to make a bulletproof performance against that. Is there any sign of increased penalties for deliberate
breaches or negligent breaches?
Ms Chidgey: There were some changes made in the last term of government around penalties for breaches and enforcement, and the Privacy Commissioner might want to say more about that. We’ll obviously look at
education that crosses both the digital and human error aspects.
Senator ROBERTS: Thank you for that. Is there any provision for increased access to justice for the people? At the moment so many people cannot afford to go to court. That’s just a fact.
Ms Chidgey: I think this is where the role of the Privacy Commissioner comes in; Ms Kind might want to say more about her role. But that is the role of the Privacy Commissioner—to assist in addressing data breaches.
Ms Kind: If I might add—and share your concerns and your urgency—one of the really positive reforms that was adopted by parliament last year in the tranche 1 reforms included the ability for the Office of the Australian Information Commissioner to seek orders from the court for compensation for individuals with respect to privacy breaches. We already have the power to issue or order compensation for our own decisions, but we can now also seek them from the Federal Court in civil penalties proceedings. And I think that goes to the concern you have about remedying privacy complaints for individual Australians.
Senator ROBERTS: Thank you.
