Australian privacy watchdog fails to deliver findings on Cambridge Analytica scandal after 18 months

Australia’s privacy watchdog is yet to deliver findings on the Cambridge Analytica privacy scandal or seek fines against Facebook more than 18 months after its investigation began.

The office of the Australian information commissioner (OAIC) is leading the local response to revelations that Cambridge Analytica gained unauthorised access to the profiles and data of 87 million Facebook users, including 300,000 in Australia.

The Cambridge Analytica breach, revealed by the Observer, prompted law firm Johnson Winter & Slattery and litigation funders IMF Bentham to lodge a representative complaint on behalf of affected Australian users in April last year. The complaint alleged breaches of Australia’s privacy laws and sought compensation for local users.

Related: Document reveals how Facebook downplayed early Cambridge Analytica concerns

From the outset, the OAIC publicly flagged the possibility of seeking court-mandated fines against Facebook or compelling the company to submit to enforceable undertakings.

But 18 months on, the OAIC’s investigation still hasn’t been finalised. The agency said the investigation was still active and expects a conclusion by the end of the year.

Other comparative agencies in the United Kingdom and United States delivered their findings and fined Facebook long ago.

The UK’s information commissioner released its report almost a year ago, fining Facebook £500,000 ($940,000). The US Federal Trade Commission launched its investigation at roughly the same time as the OAIC and announced a US$5bn ($7.3bn) fine and wide-ranging privacy reforms in July.

IMF Bentham investment manager Nathan Landis said there was a level of concern about the length of time the investigation was taking.

He said the privacy watchdog had assured his team they were treating the case with the highest priority, but were yet to give any indication of their preliminary findings or explain the reason for the delay.

“They haven’t communicated exactly what the problem is at their end, so it’s not clear to us whether it’s a resourcing issue or what it is,” he said. “We’re obviously concerned that it’s taking so long, but the reasons for that, we don’t know what’s happening in their office.”

An OAIC spokesman confirmed the investigation was still active, but did not respond to questions on whether a lack of resources had slowed progress.

“The OAIC is actively continuing its investigation into Facebook’s handling of Australians’ personal information,” he said. “We intend to finalise the investigation this year. We continue to cooperate with our counterparts around the world for the effective regulation of digital platforms.”

The level of resourcing available to the OAIC has been the subject of some concern in recent years. When first established, the agency estimated it would need about 100 staff to properly fulfil its obligations overseeing freedom of information and privacy laws. Its staffing has been consistently below that level, and the office was gutted by the Abbott government, before resourcing was gradually restored.

Last year, the commissioner, Angelene Falk, warned the office’s absorption of a growing workload with a limited workforce was creating “challenges”.

“The workload is increasing, we’ve had increases on freedom of information and privacy year on year, particularly over last three years, and we’ve worked very effectively at identifying efficiencies,” Falk told Senate estimates. “But in terms of our ability to absorb, if you like, the downstream effects of new proposals that occur, that is becoming more challenging.”

The Observer revealed last year that Cambridge University academic Aleksandr Kogan built a Facebook personality test that allowed access to the data and profiles of participants and, without authorisation, their friends. It was initially estimated that the app allowed access to the data of 50 million users worldwide. Facebook later said the number was up to 87 million users.

The data was used by firm Cambridge Analytica to build a powerful software program to predict and influence voter choices. It was alleged that software was used to aid the Brexit and Trump campaigns.