meta_id 3240105

On June 15, 2026, the Office of the Australian Information Commissioner (OAIC) published its determination in the matter of a complainant and American Express Australia Limited (AMEX). Australian Privacy Commissioner Carly Kind found that AMEX interfered with the complainant's privacy under the Privacy Act 1988 (Cth) by failing to take reasonable steps to protect the complainant's personal information from unauthorised access, in breach of Australian Privacy Principle (APP) 11.1. The investigation explored insider security risk within the financial institution. The OAIC found that AMEX failed to adequately mitigate risks associated with employees seeking unauthorised access to personal information for improper purposes, including financial fraud, domestic and family violence, and corporate espionage. The financial services sector faces heightened risk due to the large volumes of personal information it stores. The OAIC published a summary report rather than the full determination, as both AMEX and the complainant provided sensitive information subject to confidentiality claims. Disclosure could harm individuals, present cyber security risks to AMEX, and undermine investigation processes. Under the determination, AMEX must pay the complainant specified amounts for economic loss, non-economic loss, and reimbursement of expenses incurred making the complaint. AMEX must issue a written apology signed by a senior representative, acknowledging the privacy interference. Additionally, AMEX must implement technical controls to restrict employee access to specific customer information, including protections for vulnerable or high-profile customers. AMEX must implement account-level and action-level access logging across relevant systems to create time-stamped entries when employees access or take action on customer records. The determination emphasises the critical role of information and communication technology access controls in protecting personal information from unauthorised employee access.