I too was surprised when my ASIC photo was pulled up on the system when I went for my medical but for a different reason. It was quite an old photo and I actually looked good back then.
The Privacy Act is a bit of a wishy-washy instrument. Rather than use words like "must" and "must not" throughout they intersperse words like "could" and "shouldn't" in there which can make interpretation difficult. Then there are the built-in exemptions, often on condition and/or jurisdiction.
Outsourcing is also big in government, and many private companies handling matters on the government's behalf are completely ignorant of our Privacy Act even though they pretend they are experts, even government employees can be ignorant. Many of these people often make the mistake of sending confidential, sensitive and private information by internet e-mail which is not secure.
The OAIC tend to only go for the big fish as processing requests is expensive. My own experience with privacy breaches has been to deal with people making the breach kindly and educate them where their failure occured in the Privacy Act and highlight the consequences of not complying, often this works well enough, unfortunately not all the time.