TRANSCRIPT:
Adelaide woman Isabel Lewis was willing to go to great lengths to fulfil her dream of motherhood.
Single and in her late 30s, she decided she didn’t need a partner to start her family, so she decided to go through in vitro fertilisation, also known as IVF.
"I started actually before I met my then partner and now husband trying to conceive with a sperm donor [I was] sick of waiting around for an appropriately functional and fertile male to be in my world. I was 38, but then ended up meeting Chris."
After going through genetic counselling and a series of appointments, Ms Lewis and husband Chris went through the IVF process together, using her embryos and his sperm.
To her amazement, Ms Lewis conceived twins after her IVF treatment with Genea Fertility in South Australia.
Eight years on, she thought she was done in her dealings with the clinic, until they made contact this year and, to her horror, said her personal information had been stolen by cyber criminals and shared online.
"It makes me feel like privacy is dead. The fertility treatment is probably the most invasive and emotional medical treatment. I've had treatment for mental health stuff and I'd probably be less concerned about that being on the dark web but this is so - it kind of cuts deep into your emotional-ness of why you want to be a parent and your journey there."
Genea Fertility has consistently apologised to its clients.
"We thank our community for their patience and understanding during our investigation into this cyber incident. We deeply regret that personal information was accessed and published and sincerely apologise for any concern this incident may have caused."
The exposed data includes those clients' medical histories, diagnoses and treatments, medications and prescriptions, as well as pathology and diagnostic test results.
SBS News contacted dozens of people online who claimed to be victims of the Genea data breach.
Many were discussing what action they could take against Genea, including the possibility of a class action.
Along with hundreds of others, Ms Lewis contacted law firm Phi Finney McDonald, which is looking into what it describes as "potential redress" for those impacted by the breach.
Ms Lewis hopes a class action could lead to penalties for Genea, and encourage other IVF clinics to improve their data security.
"I think changes come from remittance - as in, I'm not doing it because I want money, although money's fine and all, like how will the children ever buy a house? - but if there is damages that are significantly painful, hopefully, and maybe I'm deluded, the business affected, like Genea, will change their practices so that they don't have damages like that again. And hopefully other businesses will also change their practices so that they don't have damages against them like Genea."
Australia's IVF sector is under intense scrutiny following a series of high-profile incidents and systemic failures that have prompted calls for reform.
Earlier this year Monash IVF disclosed it had incorrectly transferred the wrong embryo to a patient, two months after a patient was mistakenly implanted with another customer's embryo, prompting its CEO to step down.
There have also been multiple data breaches targeting the health and fertility sectors.
Family Creation Lawyer Sarah Jefford says it's time to look at how the fertility industry is regulated.
"I think the fertility industry is in a place where there's a lack of community trust and particularly when we had a tumultuous few years with fertility. And I think it's time really that we look at how do we regulate fertility clinics in the industry so that we can rebuild that trust for the community."
Ms Jefford explains the IVF industry is currently self-regulated, and could improve if there was a national regulator.
"We have patchwork laws in each state and territory around assisted reproductive treatment. And most clinics are actually regulated by the NHMRC guidelines, which means they don't really have clear legislation on regulating their day-to-day practices of fertility treatment. So really the fertility industry is self-regulated now. I think that's worked really well up until a point, but I think now we need to look at a different framework to really bring it into line with community expectations about what we expect from the fertility industry."
So what could that framework look like?
"I think it's time that we had an Australian assisted reproductive commission that could actually regulate the entire fertility industry, including donor conception and surrogacy. Their job could be setting standards for fertility treatments, fertility clinics and licensing and making sure that there is accountability for fertility treatment in Australia as well as keeping records for donor treatment and surrogacy to make sure that people have access to information about their conception and birth heritage."
A class action for Genea customers affected by the data breach could involve Australia's Privacy Act.
David Vaile, former chair of the Privacy Foundation, says Australia doesn’t have a vigorous privacy data protection litigation process.
Australians are also unable to sue to enforce their rights for a breach of privacy under the Privacy Act. But the act has been reformed by the current government, and a new privacy right to action has been introduced.
Mr Vaile says it gives the right for people to sue if their privacy is breached and could be a relevant to a class action.
"It would be interesting to inquire of those lawyers whether this was the first and maybe soon to be a famous example of that new privacy right of action. It's a core question to resolve in this story."
Mr Vaile says it will be interesting to see how a legal firm tackles a class action.
He says one way could be to look at equity.
"In a weird realm of law called equity that isn't about 'have you breached this law or that law' or 'have you breached something like defamation' as sort of a well-known legal concept, but is your relationship with these people so special that you have a special obligation to them?"
He says it could be argued that nurses and doctors have a special obligation to the patients in their care.
But it's hard to say what exactly a class action could involve.
"You can imagine if both sides are fighting like hammer and tongs on every part of that point, it's a very murky area. On the other hand, in the right situation, which might be this because especially with something as not only medical information, which is by its nature and by definition under legislation, the most sensitive sort of personal information, but reproductive stuff is even more sensitive to people who are having difficulty. So this might be something that might fit off into that fiduciary duty, equitable obligation thing. It would make the whole medical profession just go nuts if it was, and understandably so. They're exposed to lots of obligations and responsibilities already."
