pc
nid 94078
no date
pthandapani@vixio.com
Australia
Office of the Australian Information Commissioner
horizon scanning
100% of draft length
draft in Generated
Generated
2047 charsAustralian Privacy Commissioner Orders American Express Australia Limited to Compensate Complainant for Privacy Interference
On June 15, 2026, the Office of the Australian Information Commissioner (OAIC) published its determination in the matter of 'BAM' and American Express Australia Limited. Australian Privacy Commissioner Carly Kind found that American Express Australia Ltd (AMEX) interfered with the complainant's privacy under the Privacy Act 1988 (Cth) by failing to take reasonable steps to protect the complainant's personal information from unauthorised access, in breach of Australian Privacy Principle (APP) 11.1.
The investigation explored insider security risk within a financial institution, confirming that such risks remain a significant yet frequently overlooked threat to organisations and individuals. The OAIC found that AMEX failed to adequately mitigate risks that employees may seek unauthorised access to personal information for improper purposes, including financial fraud, domestic and family violence, or espionage. This risk is heightened in the financial services sector, which stores large volumes of personal information.
Under the determination, AMEX must pay the complainant specified amounts for economic loss, non-economic loss caused by the privacy interference, and reimbursement of complaint-related expenses. AMEX must also issue a written apology signed by a representative with sufficient seniority, acknowledging the privacy interference. Additionally, AMEX must implement technical controls to restrict employee access to specific customer information, including protections for vulnerable or high-profile customers, and establish account-level access logging and action logging to create time-stamped entries when employees access or take action on customer records.
The determination emphasises the critical role that information and communication technology systems' access controls play in protecting personal information from unauthorised employee access. The OAIC published a summary report rather than the full determination, citing confidentiality claims and potential harm to individuals and AMEX's cybersecurity.
Agent draft
Not run yet.
Published
2047 charsAustralian Privacy Commissioner Orders American Express Australia Limited to Compensate Complainant for Privacy Interference
On June 15, 2026, the Office of the Australian Information Commissioner (OAIC) published its determination in the matter of 'BAM' and American Express Australia Limited. Australian Privacy Commissioner Carly Kind found that American Express Australia Ltd (AMEX) interfered with the complainant's privacy under the Privacy Act 1988 (Cth) by failing to take reasonable steps to protect the complainant's personal information from unauthorised access, in breach of Australian Privacy Principle (APP) 11.1.
The investigation explored insider security risk within a financial institution, confirming that such risks remain a significant yet frequently overlooked threat to organisations and individuals. The OAIC found that AMEX failed to adequately mitigate risks that employees may seek unauthorised access to personal information for improper purposes, including financial fraud, domestic and family violence, or espionage. This risk is heightened in the financial services sector, which stores large volumes of personal information.
Under the determination, AMEX must pay the complainant specified amounts for economic loss, non-economic loss caused by the privacy interference, and reimbursement of complaint-related expenses. AMEX must also issue a written apology signed by a representative with sufficient seniority, acknowledging the privacy interference. Additionally, AMEX must implement technical controls to restrict employee access to specific customer information, including protections for vulnerable or high-profile customers, and establish account-level access logging and action logging to create time-stamped entries when employees access or take action on customer records.
The determination emphasises the critical role that information and communication technology systems' access controls play in protecting personal information from unauthorised employee access. The OAIC published a summary report rather than the full determination, citing confidentiality claims and potential harm to individuals and AMEX's cybersecurity.