By Alex Kotova -
Snapshot
- Recent OAIC reports concerning Qantas and I-MED provide a rare insight into why the Privacy Commissioner may decide not to pursue regulatory action following preliminary inquiries.
- They show how organisations can demonstrate compliance with the Privacy Act through contractual protections and governance, operational and technical controls tailored to specific privacy risks.
- For practitioners, the reports offer a practical blueprint for advising clients on what ‘reasonable steps’ look like in complex data-handling arrangements.
Lawyers, and other professionals, advising on privacy matters will likely have faced challenges with the lack of concrete examples of what is expected of regulated entities to demonstrate compliance with the Privacy Act 1988 (Cth). While regulatory guidance from the Office of the Information Commissioner (‘OAIC’) and determinations issued by the Privacy or Information Commissioners are helpful, regulatory guidance is limited by its need to provide general principles that can broadly be applied across many sectors and scenarios, while determinations are generally limited to what an entity shouldn’t do.
It is in this context that Privacy Commissioner, Carly Kind, seems to have carved out a niche role for reports into preliminary inquiries that did not progress to further regulatory action, creating a new avenue for regulated entities to be informed as to what good practice looks like.
Since her appointment in early 2024, the Privacy Commissioner has been clear about her objective of strategic enforcement to act as a general deterrent, signalling what practices are being monitored by the OAIC, as well as how regulated entities can fall below what the OAIC expects of them. This approach has been evident in the recent determinations on tracking pixels (such as Commissioner Initiated Investigation into Monash IVF Pty Ltd (Privacy) [2026] AICmr 40 and Commissioner Initiated Investigation into Medmate Australia Pty Ltd (Privacy) [2026] AICmr 41) and unfair collection practices (such as Commissioner Initiated Investigation into Property Lovers Pty Ltd (Privacy) [2024] AICmr 249 and Commissioner Initiated Investigation into Master Wealth Control Pty Ltd t/a DG Institute (Privacy) [2024] AICmr 243).
