Medibank hack victims’ compensation in limbo due to unexpected hurdle

Attempts to compensate nearly 10 million victims of the Medibank Private hack have hit an unexpected hurdle after the privacy commissioner flagged that it does not want to pursue compensation on customers’ behalf.

The Office of the Australian Information Commissioner (OAIC) informed law firm Maurice Blackburn just before Easter that its “preliminary view” is that it will not investigate complaints by the firm’s clients against the private health insurer as it believes the class action can provide appropriate remedies.

“The Federal Court can award damages and equitable compensation and grant injunctive relief,” the OAIC said in a letter to the law firm.

However, limitations on the privacy-related damages that can be secured in a class action could significantly affect the compensation for millions of affected customers.

Andrew Watson, head of Maurice Blackburn’s class action practice, said it was bizarre that the agency set up to police cyber breaches is abdicating some of its responsibility for the most serious privacy breach in Australian history on the basis that a case has been lodged in the Federal Court.

“They’re proposing to conduct an investigation as to whether there’s a breach, but not deal with compensation. If they’re not going to do it on this one, what are they there for?” Watson said.

It could be critical for how much compensation Medibank victims could potentially be awarded. Under the Privacy Act, if the commissioner decides that compensation should be awarded, it can specifically compensate people for humiliation and distress.

This would be much harder under a class action, which deals more with economic loss. A claimant who had intensely private medical information released may not be eligible for compensation.

“You may not be able to point to any actual economic loss about the fact that people know you had a termination of pregnancy, or you were in receipt of alcohol and drug treatment … But you undeniably have suffered the hurt and distress of knowing that information, which was intensely private, is now out there on the dark web,” Watson says.