In the first penalty to be handed down for breaches of the Privacy Act, pathology services provider Australian Clinical Labs has agreed to cop a $5.8 million fine over a 2022 data breach that compromised the personal information of 223,000 customers of its Medlab business.