Data Bytes AU: Key Australian privacy updates so far in 2026

Your "grab-and-go" briefing on recent determinations, enforcement actions, and legislative reforms shaping the Australian privacy landscape. Keep across Australian privacy law developments on our website.

Welcome to Data Bytes AU

Members of our team travelled to Seattle in October to attend the International Association of Privacy Professionals (IAPP) Privacy, Security, Risk + AI Governance Conference 2026, meeting up with US colleagues and getting a look into global market insights.  

There are strong similarities between regulatory trends we are seeing across the United States and Australia: a focus on AI governance and protection, children's online privacy and safety, pixels and tracking technology, all part of a relentless push to secure safety and privacy in an increasingly complex digital environment.

In the wake of Australia's proposed privacy reforms, it is easy to miss the significant changes that have already occurred over the course of 2026.  With the pace of change and range of updates that we have seen over the course of the year, this new-format update consolidates some of the key "things to know" to get you across important developments.

Read on for bite-sized summaries of law reforms, regulator activity, and key determinations so far in 2026.

Part 1 – Recent updates

Quick reference

Some of the key privacy determinations, reports and decisions of 2026.  See Part 2 for more details, and Part 3 for the future developments you should have on your radar.

1. Cyber security: Report into preliminary inquiries of Qantas (July 2026)

2. What is personal information: Third-party tracking pixel investigations (June 2026)

3. What information you "hold": White Pages determination (June 2026)

4. Security and past practices: Report of investigation into AMEX (June 2026)

5. Regulator cooperation, naming and shaming: Report of Investigation into Property Lovers and fastproperty.ai (May 2026)

6. Fair, reasonable, over-collection and dark patterns: IRE / 2Apply determination (April 2026, under review in ART)

7. Facial recognition: Bunnings Administrative Review Tribunal decision [2026] ARTA 130 (February 2026) and Kmart determination (August 2025, under review in ART)

Note: Most Commissioner determinations have not been reviewed by a court or the Administrative Review Tribunal (ART).

A snapshot of Australia's privacy and digital reforms

The long road to reform of Australia's privacy regime continues. In October 2026, we are at the tail end of the tranche 1 privacy reforms taking effect, after being passed in late 2024. Tranche 2 of the reforms was announced in September 2026, and a number of related law reforms have taken effect or been announced:

Regulator developments and guidance

So far in 2026, the Office of the Australian Information Commissioner (OAIC):

• released its corporate plan 2026–27, highlighting three core priorities of addressing power and information asymmetries; promoting information integrity; and embedding fairness, accountability and transparency in new technology (August 2026).
• updated guidance on facial recognition technology: a guide to assessing the privacy risks (updated July 2026).
• released new guidance for reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act (February 2026, updated August 2026) as well as a template privacy collection notice (April 2026).
• released new guidance on age assurance technologies and privacy obligations (March 2026).
• conducted its first ever compliance sweep in early 2026, focused on privacy policies involving in-person collection of personal information in sectors including rental and property, licensed venues, car dealerships, and chemists and pharmacies.
• released long-awaited guidance on automated decision-making, just in time for go-live of new requirements on 10 December 2026.

Part 2 – Key determinations

1. Cyber security: Report into preliminary inquiries of Qantas (July 2026)

• The OAIC's report on a data breach affecting approximately 5.12 million Australians found no indication Qantas failed to take “reasonable steps” under APPs 1.2 (compliance practices, procedures and systems), 8.1 (reasonable steps for where information is disclosed overseas) or 11.1 (reasonable steps to protect personal information).
• The incident arose from a “vishing” attack (phone-based social engineering) in which a threat actor impersonating Qantas IT support deceived an overseas contact centre agent into connecting the CRM platform to a malicious data extraction tool.
• The Commissioner credited Qantas’s cyclical vendor audits, mandatory cyber-awareness and privacy training, role-based access controls, ISO 27001 compliance requirements in contracts, and incident response framework in deciding that it would not commence an investigation into the incident.
• The Commissioner published the report due to high public interest and the educative value of both the findings and the OAIC's decision-making process.

2. What is personal information:  Third-party tracking pixel investigations (June 2026)

• In two determinations on tracking pixels used by health care providers, the Commissioner sought to expand existing concepts under the Privacy Act. Neither determination has been reviewed by a court or tribunal.
• When is a person “reasonably identifiable”: The Commissioner determined that information is regulated as personal information (being "about an individual who is… reasonably identifiable”) if it enables an individual to be "distinguished from others, in a way that affects their rights or interests." The ability to buy social media ads targeting cohorts who visited health provider websites met this threshold, even if individual visitors could not be directly identified.
• Direct marketing: Because tracking pixel data was personal information, using that personal information to buy social media ads constituted a direct marketing purpose.
• Sensitive information: The Commissioner found that information about visits to a health provider's website reveals or allows inferences about a person's health. Tracking pixel data about website visits was therefore sensitive information, meaning consent is needed for collection and for direct marketing uses.

Note: All these concepts face change under proposed privacy reforms, which will broaden what counts as personal information (using a slightly different "reasonably identifiable" formulation) and tighten consent requirements for direct marketing, data trading, and sensitive information.

3. What information you "hold" – White Pages determination (June 2026)

• In the June 2026 White Pages determination (relating to an investigation that commenced in 2021), Optus was found to have “held” personal information on systems of the operator of the White Pages telephone directory system, because Optus retained practical control over whether telephone details were listed or unlisted.
• Similarly, in the June 2026 tracking pixel determinations discussed above, the Commissioner found health providers “held” and “collected” personal information because they had "control and authority" in deciding what information tracking pixel platforms collected, and had the right or power to deal with the data by buying targeted ads using that data as criteria.
• While neither determination has been reviewed by a court or tribunal, it is clear that organisations are increasingly responsible for the services they use, increasing the scope of privacy compliance and risk assessment activities.

4. Security and past practices: Report of investigation into AMEX (June 2026)

• The Commissioner's June 2026 AMEX determination concerned an employee who accessed personal information of a former partner. The Commissioner found AMEX’s security measures did not satisfy APP 11.1, noting that technical controls had been implemented in some systems but not all, and the Commissioner considered that this indicated that implementing those measures would have been "reasonable".
• The Commissioner also found insider threat incidents within AMEX's broader international group raised the standards expected of its Australian operation.
• The June 2026 White Pages determination applied similar reasoning. Past incidents raised expectations for security measures.

5. Regulator cooperation, naming and shaming: Report on data scraping for fastproperty.ai service (May 2026)

• In a May 2026 report, the OAIC found that the fastproperty.ai service that identified "potentially motivated" property sellers no longer used information scraped from court lists to target people in vulnerable positions (bankruptcy, divorce, deceased estates). The OAIC had previously found collection of that data “unfair” in a November 2024 determination.
• Although the revised platform did not collect personal information or contravene the Privacy Act, the Commissioner made comments critical of the conduct and regulator engagement of associated companies and individuals, and provided information about potential contraventions of other legislation to "the relevant regulator".
• The report is an example of increased cooperation and information sharing between regulators as well as the Commissioner's willingness to use public statements to "name and shame" entities.  The OAIC has information-sharing memoranda of understanding with agencies including ASIC, APRA, the ACMA, the ACCC and the eSafety Commissioner. 

6. Fair, reasonable, over-collection and dark patterns: IRE / 2Apply determination (April 2026)

• The Commissioner's IRE / 2Apply determination pre-empted the proposed "fair and reasonable" test, using "novel" interpretations to find the collection of personal information by IRE on the 2Apply rental property application platform was not "by fair means" (breaching APP 3.5). The Commissioner is not waiting for law reform to advance enforcement action. The determination is under review in the Administrative Review Tribunal.
• Factors contributing to the finding that collection was unfair included:
  • over-collection of personal information was more than "reasonably necessary" for IRE's activities (itself a breach of APP 3.2);
  • dark patterns or "online choice architecture" that unfairly influence choices. In this case, this included confirm shaming language that makes the user feel guilty or embarrassed for their choices, biased framing of choices that emphasise either supposed benefits or downsides, and bundled consent that undermines a user's effective control and can lead to inadvertent consent;
  • market factors, including the rental market's power imbalance (exacerbated by a rental crisis) and a limited choice of service provider; and
  • security risks, including the amount of information collected in the real estate sector and its handling practices.
• The Commissioner acknowledged that considering online choice architecture through the lens of fair collection was "novel". It is also notable that the Commissioner took into account a broad range of sector dynamics, not just IRE's specific data collection activities.

7. Facial recognition: Bunnings and Kmart (2025/2026)

• In a November 2024 Bunnings determination, the Commissioner found Bunnings’ in-store facial recognition technology collected sensitive information (biometrics) without consent, notification or adequate transparency, breaching APPs 1.2, 1.3, 3.1 and 5.5.
• In February 2026, the Administrative Review Tribunal affirmed the Commissioner’s findings on transparency and notification but departed on consent. The Tribunal accepted Bunnings could rely on the “permitted general situation” exception for combatting serious retail crime, given its unique risk environment. The Tribunal took a broader view than the Commissioner of what was “necessary” to address risks, and what evidence could demonstrate Bunnings' reasonable belief.
• In an August 2025 Kmart determination, the Commissioner found Kmart’s use of facial recognition technology across 28 stores to tackle refund fraud was unlawful. The determination predates the Bunnings Tribunal decision and is under review by the Administrative Review Tribunal, with hearings scheduled for early 2027.
• Both the Bunnings Tribunal decision and the Kmart determination emphasise transparency in privacy policies and collection notices, and clarify the narrow circumstances in which a "permitted general situation" may excuse consent for collection of sensitive information. Proposed reforms will tighten consent requirements further, and the factors discussed in the determinations will be relevant to whether data handling satisfies the new “fair and reasonable” test.

Part 3 – What to watch

Commissioner determinations before the ART

Two Commissioner Determinations discussed above are currently before the Administrative Review Tribunal:

• IRE / 2Apply determination
• Kmart determination

Cases before the courts

• Australian Information Commissioner v Singtel Optus Ltd (VID1019/2025), Federal Court proceedings in relation to a September 2022 data breach incident.
• Australian Information Commissioner v Medibank Private Ltd (VID497/2024), Federal Court proceedings in relation to an October 2022 data breach incident.
• Terzini v Nine Entertainment Co & Anor (NSW Supreme Court), alleging a serious invasion of privacy under the new statutory tort.

Other OAIC activities

• Smart glasses: In October 2026, the Commissioner opened an investigation into the maker of the "HeyCyan" smart glasses phone app used in some smart glasses. In a blog, the Commissioner urged retailers to consider privacy risks of selling connected and surveillance devices, noting entities can be liable as accessories under Australian privacy laws.
• Optus: The Privacy Commissioner is still to determine a representative complaint connected to the White Pages determination (discussed above).
• Latitude: The Commissioner-initiated investigation into a 2023 data breach incident continues, as well as an associated representative complaint.
• Connected cars: The OAIC is reportedly investigating vehicle manufacturers in relation to data collected through smart-connected vehicles.
• Instructure / Canvas:  The OAIC has provided guidance to individuals making complaints in relation to the cyber incident affecting Canvas (a learning management system used by universities, vocational providers and some State schools).

Authors: Geoff McGrath, Partner; Andrew Hilton, Counsel; Joanne Lee, Paralegal; Georgina Whittle, Graduate; Ragul Sivaram, Graduate; Noah Steinmann, Graduate and Misha Kasinathan, Graduate.