“The OAIC’s latest determinations against Medmate and Monash IVF aren’t just another update in Australia’s privacy reform journey. They represent one of the clearest signals yet that the regulator is moving from guidance to enforcement.
At Louder, we’ve been following that direction for some time. When the OAIC released updated guidance on third-party tracking pixels in late 2024, we explored what it meant for advertisers, agencies and organisations using customer data for marketing and measurement. During Privacy Awareness Week earlier this year, we argued that privacy had moved well beyond compliance to become an operational issue spanning consent, measurement, technology and governance.
These latest determinations reinforce that view.
The OAIC has made it clear that organisations remain accountable for the data they collect, where it is shared and whether consumers have genuinely consented. More importantly, it has now demonstrated how those obligations will be enforced.
In this edition, we’ve brought together Andrew Hughes’ latest analysis, our previous articles tracing the evolution of the OAIC’s approach, the regulator’s published determinations, commentary from Privacy Commissioner Carly Kind, and other industry perspectives. Together, they provide a practical view of where privacy, consent and data governance are heading, and what organisations should be doing next.
Our view remains consistent. These determinations reinforce, rather than materially change, the position we’ve taken over the past 18 months. As the regulatory landscape continues to develop, we’ll continue working alongside legal experts, monitoring the market and sharing more nuanced perspectives as they emerge.”
