Government flags new cybersecurity laws and increase in fines after Optus breach

The Albanese government will pursue “very substantial” reforms in the wake of the massive Optus data breach, including increasing penalties under the Privacy Act that are currently capped at $2.2m.

As the government flags it will push ahead with legislative changes, hundreds of public servants from the Australian Signals Directorate, the Australian Cyber Security Centre and the Australian federal police were deployed to help manage the fallout from the data breach, with the government also working with banks to prevent further fraud.

The home affairs minister, Clare O’Neil, says she will be looking at new cybersecurity laws to prevent similar breaches. The Optus attack has affected up to 10 million customers including 2.8 million people who had their licence or passport number leaked.

O’Neil told parliament on Monday that in other jurisdictions a data breach of this size would “result in fines amounting to hundreds of millions of dollars”.

“I really hope this reform task is something we can work on collaboratively across the parliament,” she said.

On ABC’s 7.30, O’Neil added that the current level of penalties – a maximum of just over $2m – was “totally inappropriate”.

The minister flagged that the government would look at the cybersecurity requirements currently placed on large telecommunications providers to see if they were fit for purpose.

She also suggested the government was looking at ways to ensure the passport and licence details of the 2.8 million affected customers could be flagged to provide additional protection against identity theft.

O’Neil told ABC Melbourne the data breach was caused by a “very significant error on Optus’ part” as the cyberhack “was not particularly technologically challenging”.

“One of the great disappointments for me as cybersecurity minister is that … a telecommunications company left open a vulnerability of this size.

“The Albanese government is incredibly angry … and we have to do whatever we can to support those Australians to protect themselves.”

O’Neil said “at this stage” the government does not have the capacity to fine Optus, but it would consider legislating such powers in the wake of the incident.

Sign up to Guardian Australia’s Morning Mail

Our Australian morning briefing email breaks down the key national and international stories of the day and why they matter

Privacy Notice: Newsletters may contain info about charities, online ads, and content funded by outside parties. For more information see our Privacy Policy. We use Google reCaptcha to protect our website and the Google Privacy Policy and Terms of Service apply.

She noted she has powers to set “minimum cybersecurity standards for lots of sectors of the economy but not telcos” because they had lobbied to be excluded from the laws – citing their superior defences. The minister said these were “not demonstrated” by the data breach.

The shadow home affairs minister, Karen Andrews, said the opposition was prepared to consider a new regime that imposed hefty fines into the hundreds of millions of dollars.

“I am happy to look at it and see whether or not this is something that is too late to have an impact on Optus which I suspect it is, and also whether or not it is going to have a deterrent effect and what is the impact of that?” Andrews told the ABC.

Consumer group Digital Rights Watch said the breach highlighted the danger of collecting and storing large amounts of personal information and called for changes to the Privacy Act.

“We need privacy laws that will ensure the companies only collect and store the minimum amount of personal information, and that there are harsh penalties when they collect more than they need, given the risk it creates for the individuals involved,” the group said in a statement.