Australia: Data Protection

In a key decision against an Australian financial services licence (AFSL) holder, the Federal Court of Australia has ordered the AFSL holder to pay AU$2.5 million in penalties for inadequate cybersecurity measures.

Explore the latest regulatory developments across Asia-Pacific financial markets, from Australia's scam prevention framework and ASIC's cybersecurity warnings to Hong Kong's stablecoin regime implementation and Singapore's enhanced market conduct controls. This comprehensive update covers critical changes in banking supervision, digital asset regulation, and investor protection measures that are reshaping the region's financial landscape.

A recent Administrative Review Tribunal decision has clarified the boundaries of facial recognition technology use in Australian retail, examining Bunnings' controversial trial system that scanned customers to identify repeat offenders.

Purchasers should also consider the extent to which data and technology enables (or is integral to) the business.

Where collection of sensitive information represents a serious intrusion of privacy, businesses should conduct a formal, structured and documented risk assessment of the FRT system from the outset.

As technology continues to advance and businesses integrate automation further into every customer interaction, there are likely to be some interesting issues emerging in 2026.

Crisis response needs clear, legal & strategic communication to protect reputation—preparation & message discipline are essential.

The use of cameras mounted on drones, which most people would entirely reasonably think of as being harmfully invasive of privacy, is largely unregulated.

Organisations need to move beyond siloed thinking and adopt a coordinated, whole-of-business approach.