The ACMA discovered the breaches via Latitude, which reported the incidents under mandatory compliance reporting.

ACMA member Samantha Yorke said the penalty’s size reflected the company’s “repeated compliance failures”.

“Latitude is now a two‑time offender, and it is disappointing that it let consumers down again,” Yorke said.

“The spam laws have been in place for more than 20 years, and there is simply no excuse for ongoing non‑compliance, particularly after a prior enforcement action.”

“Under Australia’s spam laws, consumers have the option to unsubscribe from commercial messages, and that process must work.

“They must also provide accurate information within the message about how the sender can be contacted.”

Latitude Financial must now accept a court-enforceable undertaking and has responded to the penalty with the steps it is taking.

“Latitude acknowledges the Australian Communications and Media Authority’s (ACMA) findings and enforceable undertaking,” Latitude said in a 15 April ASX announcement.

“The credit card entity of Latitude Group Holdings Limited has entered into an enforceable undertaking with the ACMA and paid a $3.96 million fine for breaching the Spam Act.”

Latitude noted that it had reported the breaches to the ACMA as soon as they were discovered and “immediately strengthened its spam compliance processes”.

“As part of the enforceable undertaking, Latitude will engage an independent expert to confirm that its strengthened spam processes are operating compliantly,” Latitude said.