In the first-ever civil penalty proceedings for breaches of the Privacy Act, pathology services provider Australian Clinical Labs has been ordered to pay $5.8 million over a 2022 data breach that compromised the sensitive personal information of 223,000 customers of its Medlab business.