OAIC’s action in relation to the 2023 Latitude Data Breach and information to update and assist individuals

On 10 May 2023, the OAIC commenced an investigation into the personal information handling practices of the Latitude group of companies[1] (Latitude).

The investigation followed preliminary inquiries into Latitude's 2023 data breach, and is focussed on whether Latitude took reasonable steps to protect the personal information they held from misuse, interference, loss, unauthorised access, modification or disclosure, and whether Latitude took reasonable steps to destroy or de-identify personal information that was no longer required.

Separate to the Commissioner Initiated Investigation, the OAIC has accepted a Representative Complaint against Latitude about the 2023 Latitude data breach. Read more about the Commissioner-Initiated Investigation, Representative Complaint, and individual complaints below.

Information about the Commissioner-Initiated Investigation

The OAIC continues to progress its Commissioner-Initiated Investigation, and where a contravention of one of more Australian Privacy Principle (APP) is substantiated, there are a range of enforcement powers available to the OAIC - including but not limited to applying to the court for a civil penalty order for a breach of a civil penalty provision (s80W) or issuing a determination.

In line with the OAIC's Privacy regulatory action policy, the OAIC will not comment further on the investigation until it has concluded.

Information about the Representative Complaint

In February 2024, the OAIC accepted a Representative Complaint about Latitude in relation to the 2023 data breach.

A Representative Complaint is a complaint brought by an individual (the Representative Complainant) on behalf of a group of people (class members) against an entity (in this case Latitude) where the Representative Complainant and class members have the same concerns about the same act or practice of that entity.

Under the Privacy Act, the Representative Complainant does not need the consent of class members to make a Representative Complaint on their behalf.

The Representative Complaint accepted by the OAIC defines class members as current and former Latitude customers. If you have been impacted by the 2023 Latitude data breach, you are likely a class member.

If you are a class member, any decision taken by the OAIC in how to progress the Representative Complaint, including declining to investigate the Representative Complaint or making a determination (which could include declaring that class members are entitled to compensation) after investigation, will apply to you.

Information if you have lodged an individual complaint about the 2023 Latitude Data Breach

As noted by the Privacy Commissioner in her update on the OAIC's new approach to handling privacy complaints, where the OAIC receives individual privacy complaints arising from a data breach event that also forms the basis of an investigation or court proceedings, the individual complaints will usually be put on hold until the investigation or related court proceedings (such as civil penalty proceedings) are finalised.

At this time, the OAIC is continuing to prioritise the progression of the Commissioner-Initiated Investigation into the 2023 Latitude data breach and the associated Representative Complaint.

Further to this, please be aware that section 39 of the Privacy Act prevents an individual from pursuing an individual privacy complaint where they would be captured as a class member of a Representative Complaint. If you have already raised an individual privacy complaint with the OAIC about the Latitude data breach, you will be contacted by the OAIC.

The Latitude group of companies includes:

• Latitude Financial Services Australia Holdings Pty Ltd
• Latitude Finance Australia
• Latitude Personal Finance Pty Ltd
• Latitude Automotive Financial Services Pty Ltd
• Hallmark General Insurance Company Ltd