The same investigation can be used to inform whether victims registered under the representative complaint can get compensation.

The OAIC declined to comment on the progress of its investigation into the Medibank cyber breach.

Loading

In October 2022, criminals accessed basic account details of 9.7 million current and former Medibank customers, as well as the health claim data for about 160,000 Medibank customers, 300,000 customers of its budget arm, ahm, and 20,000 international customers. It was one of the worst cyber breaches ever reported.

Under the Privacy Act, if the commissioner decides that compensation should be awarded, it can specifically compensate people for humiliation and distress.

This would be much harder under a class action, which deals more with economic loss. A claimant who had intensely private medical information released may not be eligible for compensation.

In a recent case, the OAIC published a table with compensation bands for different levels of privacy breaches. At the highest band – extreme loss or damage resulting from the data breach – compensation ranges from $20,000 to $50,000.

Bannister says they have surveyed more than 20,000 people who registered for the representative complaint about the level of impact. More than 80 per cent reported symptoms of low to moderate anxiousness and distress. About 15 per cent reported symptoms of significant anxiety, hurt and fear. This included victims who reported that the privacy breach either exacerbated or led to the development of mental health conditions.

About 1 per cent reported extreme levels of hurt and distress. Bannister says this should be a fair representation of the 10 million Medibank customers affected by the hack. “This cross-section appears accurate to me in terms of severity,” he said.

The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.