Optus cyber-attack: company opposed changes to privacy laws to give customers more rights over their data

Optus began contacting customers whose personal information was compromised in the breach via email and SMS on Friday. It said customers as far back as 2017 may be affected because it is required to keep identity verification records for six years.

The incident has raised questions about how long telcos should be required to keep the data, what obligations they have to protect it and what compensation customers should be entitled to in the case of failures.

Optus argued against both changes.

Optus first argued in its 2020 submission that giving consumers the power to take direct legal action over privacy breaches could lead to frivolous or vexatious claims, and would not give people greater control over their personal information.

Guardian Australia has asked Optus if it stands by the submissions.