Attorney-General Mark Dreyfus says “urgent reforms” to privacy laws might be introduced to parliament by the end of the year, after almost 10 million Australians had sensitive information stolen in the Optus data breach.

Mr Dreyfus said the nation’s privacy laws had to be made “fit for purpose in the digital age” with the government also seeking to complete the ongoing review of current regulations by 2022.

“We are also looking at even more urgent reforms that we can make straight away to the privacy act,” he told ABC radio.

Mr Dreyfus said harsher penalties were being considered for companies to ensure they take the necessary steps to protect the data of their customers following the “shocking intrusion”.

“We’re going to look very hard at whether the laws need to be toughened to make sure that there’s a proper incentive to companies to keep the care that they should,” he told Nine on Thursday.

“I think we are hoping to bring some laws in before the end of the year, or if not then, early next year.”

Prime Minister Anthony Albanese has demanded Optus pay for the cost of replacing passports for customers whose data was hacked, saying it was the telco’s blunder.

Foreign Minister Penny Wong wrote to Optus chief executive Kelly Bayer Rosmarin on Wednesday, saying there was “no justification” for affected customers or taxpayers to foot the bill.

The opposition has called for the government to cover the costs, but Liberal Senator Linda Reynolds later conceded Optus should pay, criticising Labor’s response to supporting people hurt by the breach.

“The government’s making people pay for (passports) themselves … Optus should be paying, or at least the government,” she said.

“People with their Medicare numbers (leaked) … what protections are the government putting in place?”

Almost all of the states and territories have announced residents can apply for replacement driver’s licence numbers, after the transport authorities initially said no because a licence number follows a driver for life.

Labor MP Peter Khalil, who heads parliament’s intelligence and security committee, said gaps in critical infrastructure and telecommunications laws left by the former government had made the Optus breach possible.

“There are gaps there … The previous government did not switch on the cyber security obligations for telecommunications companies, and that is something we are looking at very, very seriously,” he told the ABC.

– AAP