AU: American Express ordered to fix security gaps after customer was spied on

The Australian Privacy Commissioner found American Express Australia had inadequate, non-uniform technical and organisational measures to mitigate insider threats across five customer data systems, ordered the company to restrict employee access for sensitive customers, require timestamp logging of employee actions, and to issue an apology to a complainant after a prior insider incident.