Government agencies could've done the hack themselves for all we know to ensure the changes they want are pushed through without resistance from industry.

Also if I were to give the topic more thought, I recall MANY times where I've called up my telco, and their staff and call centres aren't even located in Australia.
I remember a situation during the pandemic, where the call centre staff of an Aussie telco I use (call centre located overseas) weren't even allowed to take the payment information, probably because staff in Pakistan were either selling the data or using it to privately steal from customers accounts.

Ultimately I think this will be used as part of a push towards digital ID.

I predict that industries will have to check and verify customer-given ID against the government ID database, and then automatically delete it, which will in turn give the government greater access not just to your data, but precisely where you use it.

Personally, I'd like for multinational companies that do business in Australia, to be required to have their call centre staff in Australia and not be permitted to access that data from overseas, or kept on a cloud server.
After all, a cloud server is just 'someone else's computer'.

http://www.afr.com/technology/why-australia-s-privacy-laws-failed-to-stop-the-optus-hack-20220927-p5blc7

"Australia’s privacy laws were already under review before the attack; the current Privacy Act was written in 1988, so well before sharing your personal information digitally was commonplace.

The Coalition government announced a review of the act, and whether it is fit for purpose in the digital economy, in 2020, and Attorney-General Mark Dreyfus took up the cause when Labor won government in May.

The Optus hack has strengthened Labor’s commitment to seeing through the reforms quickly. After originally pledging the changes would come into force in Labor’s first term, Dreyfus now says he wants the reforms passed in the remaining four parliamentary sitting weeks this year."