To add more colour, the here’s the first para of the linked article:

> Data retention: Government gave Optus ‘exemption’ from encrypting metadata

> Editor, Computerworld | 17 JULY 2019 6:46 AEST

> Optus says that it would have struggled to comply with its legislative obligations without a decision by the government that exempted it from a requirement to encrypt all metadata collect as part of Australia’s data retention regime.

The government 100% has some responsibility in this. I can’t express how much this pisses me off, and I’m not even an Optus customer. The OAIC, it turns out, is a farce.