In Australia is it illegal for a company to sell substandard security?
<p>In Victoria (Australia), is it illegal for a company to sell substandard security?</p>

<ol>
<li>Physical security (locks, access devices, keypasses, etc.)</li>
<li>Digital security (data encryption, login credentials, etc.)</li>
</ol>

<p>Two ways it could happen:</p>

<ol>
<li>At the time of sale they said it was fit for purpose but it had known published security vulnerabilities</li>
<li>There were no known published security vulnerabilities but the security system was installed incorrectly leading to potentially easy breaches</li>
</ol>

<p>There are two scenarios I can think of:</p>

<ol>
<li>The vulnerability was discovered due to a breach</li>
<li>No known security breaches; a security review discovered the vulnerability</li>
</ol>

<p>Do any of these variations change the legality?</p>

<h2>Illegal? Yes. Criminal? No.</h2>

<p>Goods that are not fit for purpose and services that are not performed with due care and skill breach the consumer guarantees under the <a href="https://www.accc.gov.au/consumers/consumer-rights-guarantees/consumer-guarantees" rel="nofollow noreferrer">Australian Consumer Law</a> (if you are a consumer). You are a consumer if the price is less than $40,000 or the product or service is normally bought for household consumption.</p>

<p>If they breach the guarantees, you have rights to:</p>

<blockquote>
  <ul>
  <li>repair, replacement or refund</li>
  <li>cancelling a service</li>
  <li>compensation for damages &amp; loss.</li>
  </ul>
</blockquote>

australia security