Add us as a preferred source
Sally Hall, senior consultant and specialist in data protection at Bellevue Law, considers the lessons from the OpenAI healthcare breach in Australia.
Earlier this year, an OpenAI agent hacked Australia’s universal healthcare scheme, Medicare. It took the organisation weeks to report the breach to the Australian government. The fact that the breach occurred is one thing; the fact that it was not promptly reported is completely another. But what’s interesting is the direct parallel to UK law. The obligation to report promptly in UK law lacks guardrails and clarity.
So, should additional controls be put in place?
The law is black-and-white. It’s simply words. And yet thousands of organisations every day end up in disputes when their actions or responses to those words are at odds with the intention or understanding of others. Data Privacy law in the UK is rich in ambiguity, and leans heavily into the interpretation of the controller. But can this element of discretion be narrowed, and would it help if it was?
Given the circumstances, it is interesting to consider and make comparisons to the US, a jurisdiction which specifically codifies the treatment of health care personal data. Unlike UK GDPR and the DPA 2018, the Health Insurance Portability and Accountability Act 1996 (HIPAA) uses a tiered framework focused primarily on the scale of a breach to dictate associated reporting obligations. No element of uncertainty, no application of an uncodified test and no discretion in the hands of the controller. A controller may well have different priorities and motives when handling a data breach than a regulator or an impacted data subject may have.
Clear threshold
Under HIPAA, there is a clear threshold of over or under 500 impacted individuals to report. If a breach affects over 500 individuals, the controller organisation is mandated to notify affected individuals, the US Department of Health and Human Services, and make a press release to prominent media outlets, all within 60 days. If I were being candid, I would prefer a shorter period of notification to be mandated, but, notwithstanding this, the removal of discretion means reassurance for individuals and a greater deterrent for organisations who lose the comfort level that discretion enables.
The threshold codified in UK law is that of “harm and distress” – in itself an ambiguous term and a measure which varies widely from individual to individual. In this case, despite the headlines, it is reasonable to assume that the breach may well have been under the threshold to report in UK law, as arguably no harm or distress was caused given the nature of the data and that it was contained. And yet OpenAI have received considerable backlash regarding the time it took them to report.
Controllers are not completely without direction. The ICO guidance is helpful. This gives five specific areas as measures, including nature and sensitivity of the data in question, intent and containment, all of which reports indicate may not have triggered the reporting threshold here. The context of the data and whether there were children or vulnerable groups involved may have tipped the scales on the requirement to report, as perhaps would the volume of data, but it’s not impossible to conclude that under UK legislation, a breach of this type may not have met thresholds to self-report. Would individuals within the UK expect to be alerted if their health data was exposed in any way, shape or form? Once again, we find ourselves back to a complete lack of clear direction, and UK legislation feeds this uncertainty.
Here is what is clear. The legislation itself and the guidance are both heavily reliant on controller discretion. A regime that clearly codifies thresholds to report would, in this case, arguably have mandated swifter and more comprehensive reporting by OpenAI, reducing risks to affected individuals, and creating more impactful repercussions for the organisation.
Remains subjective
While data protection law in the UK has progressed significantly since the days of Mr Durant and the narrow application of the definition of personal data, GDPR and its implementation within the UK is still an incredibly subjective area of law. The Data Use and Access Act 2025 offers some clarifications, but does it go far enough? Even where UK legislation enables organisations to act lawfully, it absolutely does not provide the clarity we need to ensure that data is also being processed ethically, and critically, that when something goes wrong, controllers are mandated to do the right thing. The judgement of a controller is still a significant factor when putting the law into practice.
Questions should also be asked as to how this happened in the first place. Do our healthcare providers, including the NHS, have enough support to ensure it’s not vulnerable to such breaches? Are we investing enough into this? Or alternatively, how do we put in place controls in the AI space which are adequate enough to prevent such rogue attacks in the first place, because clearly we are falling short here.
Clarity over the actions a controller should take in the event of a breach and analysis of how this happened in the first place are the key learnings we should take from this, which ideally requires a level of transparency (ironically a key theme of data privacy law) from OpenAI and other organisations that suffer a breach in order for practical and implementable learnings to be beneficial to controllers and data subjects worldwide.
