Australia Implements Mandatory Data Breach Reporting

The Australian Parliament has enacted the Privacy Amendment Data Breaches Act 2017 which will take effect on 22 February 2018. It requires that all 'eligible' data breaches are notified to both affected individuals and to the Office of the Australian Information Commissioner (the OAIC).

The new regime will apply to all organisations that are caught by the principles set out in the Australian Privacy Act 1988. In practice, that is a long list and will include all Australian public sector agencies, any private sector and not-for-profit organisations with annual turnover of greater than A$3m, as well as some small businesses (collectively referred to in the Privacy Act as 'APP entities'). APP entities will be required to notify a data breach if:

  • There has been unauthorised access to, or disclosure of, information, or information has been lost in circumstances where unauthorised access or disclosure is likely to occur
  • Objectively, that access or disclosure is likely to result in 'serious harm' to any individuals to whom the information relates. In assessing whether 'serious harm' is likely to result, APP entities are required by the Amendment Act to:
  • Consider the kinds and sensitivity of the information
  • The kinds of people who are likely to have obtained access to it (and presumably, what their motives and likely uses of that information are)
  • Whether it was protected by any security measures (such as encryption)
  • The nature of the harm that could result.

Those factors allow APP entities a certain amount of discretion in determining how 'serious' a breach is. While it's frequently argued that immediate and voluntary disclosure following a breach is a very good thing, a significant number of breaches still go unreported in the hope of avoiding reputational, regulatory and legal damage. 

The same self-preservation interest is likely to remain a factor when an APP entity considers how 'serious' the harm from a breach could be, and therefore whether the mandatory notification requirements apply to them. At the same time, the new law needs to draw a line somewhere. As pointed out at a recent IAPP breakfast seminar hosted by Buddle Findlay, leaving a computer unlocked and unattended could be argued to be a data breach so any notification regime needs to create a sensible and workable yardstick that organisations can work with.

In Australia, the OAIC has promised guidance to assist APP entities in determining the seriousness of a breach.In New Zealand, guidance published by the Office of the Privacy Commissioner (OPC) strongly encourages notification to affected individuals and the OPC where there is a risk of harm (note the absence of the qualifier 'serious'). 
In a voluntary notification regime, organisations will exercise a lot more discretion, and so seriousness or materiality will be read into any decision on whether to notify or how to proceed.

The introduction of a mandatory breach reporting regime, and broader privacy law reform, has been on the cards in New Zealand for a long time and while there seems to be political will from both sides of the aisle, the process of introducing those reforms has not moved quickly. When it comes to breach notification, the best indicator we have is from a May 2014 Cabinet Paper which outlined a two-tier regime involving:

  •  Notification to the OPC of 'material' breaches
  •  Notification to both the OPC and affected individuals for more serious breaches, being those where there is a real risk of harm.

While any final statutory language would need to go through the various Law Commission, Parliament and Select Committee filters, it is interesting to note that, based on the wording of that Cabinet Paper, the prospect of any harm is enough to constitute a breach as 'serious' and therefore warrants notification to affected individuals. 
Whereas in Australia, there seems to be a qualitative threshold applied to the nature of the harm itself, i.e. a breach is only notifiable if it is likely to lead to serious harm.

To some extent, that might be playing with words, but there would presumably be advantages in aiming for consistency across the language and requirements of the two regimes. 

Companies operating in both the New Zealand and Australian markets could implement uniform policies and practices and there would be a greater body of applicable regulatory guidance.

Lexology

You Might Also Read: 

Is Breach Notification Part Of Your Response Plan?:

UK Parliamentary Committee Wish To Penalise CEOs for Cyber Breaches (£)

 

« UK SMEs Don’t Have Cybersecurity Recovery Plans
Healthcare Sector Accounts For 43% Of UK Data Breaches »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Simula Research Laboratory

Simula Research Laboratory

Simula Research Laboratory carries out research in the fields of communication systems, scientific computing and software engineering.

Advisen

Advisen

Advisen is the leading provider of data, media, and technology solutions for the commercial property and casualty insurance market including cyber risk.

Sqreen

Sqreen

Sqreen is a web application security monitoring and protection solution helping companies protect their apps and users from attacks.

LinOTP

LinOTP

LinOTP is an enterprise level, innovative, flexible and versatile OTP-platform for strong authentication.

Huntress Labs

Huntress Labs

Huntress provides managed threat detection and response services to uncover and address malicious footholds that slip past your preventive defenses.

Korn Ferry

Korn Ferry

Korn Ferry is a global organizational consulting firm, synchronizing strategy and talent to drive superior performance for our clients in key areas including cybersecurity.

Cypherix

Cypherix

Cypherix is tightly focused on cryptography and data security. We leverage our expertise to deliver state-of-the-art, world-class encryption software packages.

Cypress Data Defense

Cypress Data Defense

Cypress Data Defense helps clients build secure applications by providing training, best practices, and evaluating security during every stage of the Secure Application Development Lifecycle.

Everything Blockchain

Everything Blockchain

Everything Blockchain offer solutions that transform enterprise data-management capabilities. Increased efficiency, super-charged performance and all with government grade security.

Recon InfoSec

Recon InfoSec

The Recon InfoSec team includes analysts, architects, engineers, intrusion specialists, penetration testers, and operations experts.

VinCSS

VinCSS

VinCSS Internet Security Services JSC is a leading organization working in the field of researching, developing, producing products as well as providing cyber security services.

Primus Institute of Technology

Primus Institute of Technology

At Primus Institute of Technology our mission is to inspire, support, and empower current and aspiring IT professionals through training and career development workshops.

Indian Cyber Security Solutions (ICSS)

Indian Cyber Security Solutions (ICSS)

Indian Cyber Security Solutions is an Enterprise Cyber Security Platforms company offering Cyber Security & Technical Education and Compliance & Penetration Testing Services.

Saidot

Saidot

Saidot is a Finnish AI governance and alignment company committed to helping businesses safely and transparently integrate AI into their operations.

Bluerydge

Bluerydge

Bluerydge specialises in cyber security and technology, focusing on the delivery of innovative sovereign solutions through trusted, cleared and experienced professionals.

Alpha Echo

Alpha Echo

Specialising in security advice and enterprise-wide Cyberworthiness, Alpha Echo helps Australia deliver on cyber outcomes at a military grade level.

Security4Media

Security4Media

Security4Media is a non-profit association set up to reduce risks and support trust in media, in the face of increasing cybersecurity threat levels.