OAIC Orders American Express to Pay Complainant Over $23,000 After Privacy Breach

The Office of the Australian Information Commissioner ordered American Express to pay a complainant more than $23,000 after substantiating a complaint that a former partner used an Amex position to access the man's personal banking transactions. The OAIC began its investigation in 2023 following the allegation.

An interim decision issued last year found systemic technology failures at Amex that left the majority of customer accounts exposed to insider threats.

The regulator directed the company to overhaul its systems. The Age published that confidential interim decision. The OAIC will publish a summary of its final determination on its website on Friday, June 13, 2026.

Privacy Commissioner Carly Kind sent the complainant a letter dated June 2, 2026, stating the full determination is provided on a strictly confidential basis. In the June 2 letter, Kind wrote that any unauthorised disclosure may constitute a breach of confidence.

She reserved the right to seek urgent injunctive relief and further legal action, adding that further disclosure would undermine the integrity of the OAIC's complaint-handling process, discourage frank participation, and prejudice administration of the Act.

The letter limits use of the determination to informing the complainant of the outcome, obtaining legal advice, and exercising review rights. The complainant wrote to Kind that the investigation had caused extreme mental toll and stated, "I cannot keep doing this. " Kind responded the same day with an apology and attached the gag-order letter and final determination.