Privacy commissioner gags complainant over American Express data security findings
Privacy commissioner gags complainant over American Express data security findings
Publish Date: 2026-06-11 15:05:00
Source Domain: www.abc.net.au
Australia’s privacy commissioner has threatened a complainant with legal action to prevent the full disclosure of findings of a long-running investigation into American Express’s information security that found widespread technology failures.
The Office of the Australian Information Commissioner (OAIC) will today publish a summary of its final determination into an investigation that began in 2023, but has threatened the complainant with an injunction or legal action to prevent disclosure of the full report.
The privacy commissioner’s long-running investigation began after a man the complainant briefly dated used his position at Amex to spy on his personal banking transactions, which later forced Amex to reveal it was unable to restrict staff access to the majority of its customer accounts.
The Age published the OAIC’s confidential interim decision last year, which found Amex’s technology needed to be overhauled after systemic failures meant the majority of its customers’ data were exposed to privacy breaches from rogue employees, known as “insider threat”.
The summary of the final determination, set to be published on the OAIC’s website on Friday, found the complaint to be substantiated and ordered the company to pay the complainant compensation of more than $23,000.
Do you know more?
- Contact Charlotte Grieve via [email protected]
- If you require more secure communication, please choose an option on the confidential tips page
The ABC has not obtained a copy of the final determination or its summary.
However, ahead of publishing the summary decision, privacy commissioner Carly Kind took what Greens senator David Shoebridge called an “extraordinary step” of ordering the complainant not to disclose the full decision.
In her letter dated June 2, obtained by the ABC, Ms Kind wrote that the full determination was being provided to the complainant on a “strictly confidential basis” after permitting American Express to make submissions about what information should be…
