Missing (in) Action: Where Are the Australian Data Breach Class Actions?

Abstract

Data breach class actions have been a feature of the privacy landscape in the US and UK since as early as 2002. While Australia has experienced a surge in regulatory actions brought in respect of data breaches, we have yet to see an uptick in consumer actions in Australia. An action was brought in 2018, however it settled prior to receiving judicial consideration. This article provides some examples of the difficulties of bringing such actions in Australia, both at a substantive and procedural law level. We also highlight some proposed upcoming legislative changes which may have an impact in this space, including the proposed introduction of a tort of privacy and direct right of action in respect of interferences with privacy under the Privacy Act 1988 (Cth) (Privacy Act). Privacy, Data, Breach, Cybersecurity, Australia, Litigation, Court, Class Action, Reform