Published: 13 Dec 2023
The OAIC has received multiple representative complaints following the major data breaches.
As at the date of publication, the Australian Information Commissioner (AIC) has accepted two representative complaints; one against Medibank Private Limited in respect of its October 2022 data breach, the other against Singtel Optus Pty Limited in respect of its September 2022 data breach.
What is a representative complaint?
A representative complaint is a complaint made by an individual under section 36 of the Privacy Act 1988 (Cth) (Privacy Act) on behalf of other individuals who have similar complaints about an act or practice that may be an interference with their privacy. To make a valid representative complaint the requirements of sections 36 and 38 of the Privacy Act must be met.
The AIC has decided to investigate the Medibank and Optus representative complaints concurrently with the Commissioner-initiated investigations (CII) into the same respondent entities. This means that information gathered in the Medibank Commissioner-initiated investigation will be used for the purposes of the Medibank representative complaint. Similarly, information gathered in the Optus CII will be used for the purposes of the Optus representative complaint.
After an investigation into a representative complaint, the AIC may decide to make a determination in relation to the investigation. Through a determination, the AIC may make certain declarations, including that class members are entitled to compensation for any loss or damage (including injury to a person’s feelings or humiliation) suffered by reason of the act or practice the subject of the complaint. Proceedings may be commenced in the Federal Court of Australia, the Federal Circuit and Family Court of Australia to enforce a determination.
Current court proceedings in respect of the representative complaints
The AIC is presently a respondent party in Federal Court proceedings in relation to both the Medibank representative complaint and the Optus representative complaint – but for different reasons.
Medibank has commenced proceedings to restrain the AIC from investigating the representative complaint and from making a determination and enforcing the determination in respect of the representative complaint on the basis that a determination made by the AIC and/or enforcement of a determination by the AIC poses a real risk of interference with the administration of justice having regard to the Medibank class action (McClure and Anor v Medibank Private Limited (VID64/2023)).
The AIC received two representative complaints against Optus. The AIC accepted the representative complaint that was lodged first in time by Johnson Winter Slattery as being validly made. Having regard to ss 36-39 of the Privacy Act 1988 (Cth), the AIC declined to accept the representative complaint that was lodged second in time by Maurice Blackburn Lawyers as being validly made. Maurice Blackburn’s client has sought judicial review of the AIC’s decision (Foley v Australian Information Commissioner (VID735/2023)).
For further information, please see the below chronologies:
| Date | Complaint or action |
|---|---|
18 November 2022 | Maurice Blackburn Lawyers lodge representative complaint against Medibank on behalf of their client. |
7 February 2023 | Class action filed by Baker McKenzie in the Federal Court of Australia against Medibank (FC Proceeding 1) . |
30 March 2023 | Representative complainant and Medibank notified of the acceptance of the representative complaint. Parties also provided with the AIC’s preliminary view to decline to investigate the representative complaint under ss 41(1)(da), (e) and/or (f) of the Privacy Act following commencement of FC Proceeding 1. |
Between 31 March 2023 and 10 May 2023 | Parties make submissions and further submissions in response to the AIC’s preliminary view. |
4 May 2023 | Class action filed by Slater & Gordon in the Federal Court of Australia against Medibank (FC Proceeding 2). |
11 May 2023 | Parties notified of AIC’s decision to proceed with investigation of the representative complaint and to investigate the representative complaint concurrently with the Commissioner-initiated investigation (CII). |
12 May 2023 | Case management hearing for FC Proceeding 1/FC Proceeding 2. FC Proceeding 2 temporarily stayed. |
8 June 2023 | Medibank makes application to the AIC to: (a) determine that the representative complaint should no longer continue as a representative complaint under s 38A of the Privacy Act 1988 (Cth) (Privacy Act); (b) further or in the alternative, consider exercising her power to decide not to investigate, or not to investigate further, the representative complaint under s 41(1) of the Privacy Act in light of comments made by the Honourable Justice Beach in case management hearing in Proceeding 1 on 12 May 2023 – whether the continuation of the representative complaint “would interfere with the exercise of judicial power” in FC Proceeding 1. |
Between 9 June 2023 to 28 July 2023 | Parties make submissions and further submissions in relation to the Medibank application. |
1 August 2023 | Case management hearing in FC Proceeding 1/FC Proceeding 2. |
22 August 2023 | AIC notifies parties of her decision to: (a) dismiss the Medibank application; and (b) proceed with the investigation of the representative complaint concurrently with the CII. |
28 August 2023 | Medibank files interlocutory application in Federal Court proceeding for orders joining the AIC to the Federal Court proceeding and restraining the AIC from investigating or making a determination on the representative complaint on the basis that the continuation of the representative complaint would interfere with the exercise of judicial power in the Federal Court proceeding. |
31 August 2023 | Case management hearing in Federal Court proceeding. Justice Beach accepts that the AIC should not be joined to the Federal Court proceeding and that any application to restrain the AIC should be made by way of originating application in a separate proceeding. |
15 September 2023 | Medibank make application under s 39B of the Judiciary Act 1903 (Cth) for orders restraining the AIC from: (a) making and enforcing a determination in respect of the representative complaint and CII; and (b) from investigating or further investigating the representative complaint. (s 39B application) (VID757/2023). The application is made on the basis that a determination under s 52(1) or 52(1A) of the Privacy Act and/or an enforcement of a determination under s 55A of the Privacy Act in respect of the representative complaint and/or the CII, “poses a real risk of interference with the administration of justice” having regard to the Federal Court proceeding. |
28 September 2023 | Representative complainant joined as a respondent to s 39B application. |
3 October 2023 | OAIC sends Medibank a formal notice under s 43(1) of the Privacy Act notifying them that the representative complaint is to be investigated. |
4 October 2023 | AIC files and serves affidavit material in s 39B application. |
26 October 2023 | OAIC sends Medibank a formal notice under s 40(1) of the Privacy Act notifying them that the investigation of the representative complaint has commenced. |
26 October 2023 | Medibank serves written submissions in s 39B application. |
27 October 2023 | Applicants in Federal Court proceeding serve written submissions in s 39B application. |
8 November 2023 | AIC files and serves written submissions in s 39B application. |
13 November 2023 | Representative complainant serves written submissions in s 39B application. |
20 November 2023 | Medibank serves written submissions in reply in s 39B application. |
1 December 2023 | AIC files and serves further affidavit material in s 39B application. |
5 December 2023 | s 39B application is heard. Justice Beach reserves his judgment. |
| Date | Complaint or action |
|---|---|
4 October 2022 | Johnson Winter Slattery (JWS) lodge representative complaint against Optus on behalf of their client (JWS complaint). |
7 October 2022 | Maurice Blackburn Lawyers (MB) lodge representative complaint against Optus on behalf of their client (MB complaint). |
11 January 2023 | JWS and MB provided with the AIC’s preliminary view to accept the JWS complaint as being validly made and to decline to accept the MB complaint on the basis that s 39 of the Privacy Act precludes MB’s client, as a class member of the JWS complaint, from lodging another representative complaint in respect of the same subject matter. |
16 January 2023 | With JWS’ consent, JWS’ contact details provided to MB for the purpose of discussions between the law firms concerning the conduct of the representative complaints. |
19 April 2023 | JWS and MB notify OAIC that discussions are unsuccessful. MB provides notice of their client’s withdrawal, under s 38B(2) of the Privacy Act, from the JWS complaint. |
20 April 2023 | Class action filed by Slater and Gordon in the Federal Court of Australia against Singtel Optus Pty Ltd (Federal Court proceeding) (VID256/2023). |
24 April 2023 | MB lodge ‘further representative complaint’ against Optus on behalf of their client (MB further complaint) on the basis that their client is no longer precluded from lodging a representative complaint under s 39 of the Privacy Act. |
27 July 2023 | The OAIC requests further information from MB in relation to the MB further complaint, including whether any other class members have also withdrawn from the JWS complaint. |
28 July 2023 | MB submits that s 39 of the Privacy Act allows for more than one representative complaint to be validly made. |
1 August 2023 | Case management hearing in Federal Court proceeding. The Honourable Justice Beach foreshadows making orders requiring the AIC to appear at the next case management hearing and that he may also make orders requiring the AIC to provide copies of the representative complaints. |
3 August 2023 | Justice Beach makes orders requiring the AIC to appear at the case management hearing in the Federal Court proceeding on 14 September 2023. |
25 August 2023 | AIC notifies parties of her decision to accept the JWS complaint. MB also notified that having regard to ss 36-39 of the Privacy Act, the MB further complaint was not validly made and therefore unable to proceed. In the letter to Optus, the AIC also provides formal notice to Optus under s 43(1) of the Privacy Act, notifying them that the representative complaint is to be investigated and that it will be investigated concurrently with the Commissioner-initiated investigation. |
12 September 2023 | MB make application under s 39B of the Judiciary Act 1903 (Cth) in relation to the AIC’s decision not to accept the MB further complaint as being validly made. MB seeks the following relief:
(Judicial Review application) (VID735/2023). |
13 September 2023 | AIC granted leave to file written submissions in the Federal Court proceeding – to provide a brief update on the progress of the representative complaints. |
14 September 2023 | Case management hearing in Federal Court proceeding. Justice Beach satisfied with the content of the written submissions and does not ask any further questions. |
27 September 2023 | OAIC files and serves affidavit material in Judicial Review application. |
12 October 2023 | OAIC files and serves written submissions in Judicial Review application. |
18 October 2023 | Judicial Review application is heard. Justice Beach reserves his judgment. |
| Date | Complaint or action |
|---|---|
March 2023 | The OAIC receives more than one representative complaint against Latitude: Complaint A (lodged first in time) and Complaint B (lodged second in time). |
April 2023 – December 2023 | The OAIC’s consideration of the representative complaints and engagement with the representative complainants continues. |
