Australia now has mandatory data breach notification legislation

Summary

This blog post, "Australia now has mandatory data breach notification legislation", is a blueAPACHE article from 2017 covering security. The recent passing of mandatory data breach notification laws through the senate imposes on organisations a need for increased transparency and accountability. It is written for readers evaluating emPOWER Security, Governance, Risk and Compliance. The underlying security practice it describes, reducing attack surface and improving detection and response, is not tied to a specific product version and remains relevant to any organisation managing cyber risk today.

Key facts

Article

The recent passing of mandatory data breach notification laws through the senate imposes on organisations a need for increased transparency and accountability. Australian government agencies, businesses and not-for-profit organisations with an annual turnover of more than $3 million will soon be legally obliged to disclose eligible data breaches. The Privacy Amendment (Notifiable Data Breaches) Bill 2016 has been passed by both houses of parliament and will come into effect within the next 12 months. Unlike many other countries, Australia does not currently have a mandatory data breach notification law. Organisations could voluntarily undertake notification of data breaches, however, there has been no express requirement under the Privacy Act for them to do so. The new bill makes it a legal requirement for organisations subject to the Privacy Act to make notification of data breaches as soon as they are aware of it. This includes organisations with an annual turnover of more than $3 million, smaller organisations in the health and education sectors covered under the Privacy Act and individuals who handle personal information for a living, including those who handle credit reporting information, tax file numbers and health records.

Eligible data breaches

Once the law is passed, if organisations have reasonable grounds to suspect that there may have been an eligible data breach, they must carry out, and complete, an assessment within 30 days. Notification of such breaches must be made to the Australian Information Commissioner and affected individuals. An eligible data breach is one where there has been unauthorised access to, or disclosure of, personal information and there is a likely risk of serious harm to any of the affected individuals, or where personal information is lost in circumstances that are likely to give rise to unauthorised access to or disclosure. Whether an individual was at risk of “serious harm” would depend on a number of factors, such as whether the information is encrypted (and how hard that encryption would be to break) and the sensitivity of the information. The notification to the Australian Privacy and Information Commissioner and affected individuals should contain a description of the data breach, the kind of information involved, and steps that individuals can take to respond to the security incident.

Non-compliance

Disclosure in a timely manner can be a daunting task for many Australian businesses that are ill-equipped to detect a breach, often not finding out until months later. On average, breaches remain unnoticed for 229 days. Even then, while the company may know an intruder has accessed its systems, it might not be able to determine what, if anything, was stolen. The need to make a potentially damaging declaration in the event of a breach is now an incentive for organisations to review their information handling processes and ensure security systems are as tight as possible. Failure to comply with the notification scheme will be deemed an interference with the privacy of an individual and penalties include fines of $360,000 for individuals and $1.8 million for organisations. To assess if your customer data has been adequately secured and to equip your organisation with a response plan in the event of a data breach, contact the blueAPACHE team.

Related

• emPOWER Security
• emPOWER Security (pillar hub)
• Governance, Risk and Compliance
• Brotherhood of St Laurence (case study)

Frequently asked questions

What legislation does the article describe, and when does it take effect?

The Privacy Amendment (Notifiable Data Breaches) Bill 2016, passed by both houses of parliament, coming into effect within 12 months of the article.

Which organisations does the new law apply to, per the article?

Government agencies, businesses and not-for-profits with annual turnover over $3 million, smaller organisations in health and education covered under the Privacy Act, and individuals who handle personal information such as credit reporting data, tax file numbers and health records.

What timeframe does the article give for assessing a suspected eligible data breach?

Organisations must carry out and complete an assessment within 30 days of having reasonable grounds to suspect an eligible data breach.

How does the article define an "eligible data breach"?

Unauthorised access to or disclosure of personal information where there is a likely risk of serious harm to affected individuals, or personal information lost in circumstances likely to lead to unauthorised access or disclosure.

What factors does the article say determine whether harm is "serious"?

Factors such as whether the information is encrypted, and how hard that encryption would be to break, and the sensitivity of the information.

What must a breach notification to the Commissioner and affected individuals contain, per the article?

A description of the data breach, the kind of information involved, and steps individuals can take to respond to the security incident.

How long does the article say breaches typically go unnoticed on average?

The article states breaches remain unnoticed for an average of 229 days.

What penalties does the article cite for non-compliance with the notification scheme?

Fines of $360,000 for individuals and $1.8 million for organisations.

Source

• origin post (2017)

Knowledge Base