Federal police have arrested a 19-year-old Sydney man for allegedly sending scam texts to blackmail people whose data was separately published by the Optus hacker as the government moved to prevent fraud by letting the company share customer identification data with banks.

Assistant Commissioner Justine Gough said the texts, which demanded payments of $2000 to an Australian bank account, had gone to 93 people but that no one had fallen for the alleged scam.

"The warning is clear: do not test the capability or dedication of law enforcement," Gough said. "Just because there has been one arrest doesn't mean there won't be any more arrests."

Police and overseas law enforcement under the banner of Operation Hurricane are still trying to find the hacker who downloaded almost 10 million customers’ data, including driver’s licences, Medicare and passport numbers.

Information on 10,200 current and former Optus customers was uploaded to the internet by the hacker in an attempt to extort the company into paying a $1.5 million ransom, before the hacker backtracked and claimed to have deleted the information but copies are still circulating online.

The federal government announced the new exceptions to privacy rules in Australia's metadata laws on Thursday after Optus told officials it was not legally allowed to share information like Medicare, passport and driver's licence numbers despite the massive data breach.

Communications Minister Michelle Rowland said the regulations, which were expected from the government almost two weeks ago before the complexity of changing the law became clear, had strong privacy protections.

"Banks who receive the data need to review the need to continue holding the data for every 12 months," Rowland said. "If it is no longer required, it needs to be destroyed. There's that threshold."