Cameron Abbott and Jacqueline Patishmanof K&L Gates write:
In 2017, Uber disclosed to the Office of the Australian Information Commissioner (OAIC) a breach of its some 57 million global users and driver’s personal information (including approximately 1.2 million Australians). Last Friday, the OAIC determined that Uber had breached the Australian Privacy Act by failing to take reasonable steps to protect Australian’s personal information from unauthorised access.
Despite the breach and Uber’s decision not to individually notify those affected or report the attack until 2017, no fine has been imposed; whereas, other jurisdictions imposed large fines for the breach – US ($148 million) and UK (£385,000 pounds). Instead of a fine, the OAIC has ordered Uber to put together a data breach response plan, information security program and data retention and destruction policies and procedures. There is an independent supervision of these steps which is popular measure with the OAIC.
Read more on Lexology.