Mandatory data breach notification law comes into effect today. Now what? It all depends on proper regulation and enforcement

February 22, 2018

The Privacy Amendment (Notifiable Data Breaches) Act 2017 commences operation today.  There has been more than a ripple of reporting on what is a significant change to the regulatory landscape, ranging from the nerdy techy journals such as Computerworld, start up daily and InnovationAus to the insurance publications such as insurance and risk  to the general media such as Mumbrella and SBS. The coverage has been general but hits the key points, that in the event of a data breach involving authorised loss or access to personal information organisations and agencies must consider whether they are obliged to notify persons and the Information Commissioner of that breach. There is a hyperventilating report in the Canberra Times which, while good in parts, extrapolutes the law as it now exists with what might conceivably happen without the burden of evidence.  That is little better than crystal ball gazing.  The article seems to be suggesting that the effect of the legislation will be a blizzard of emails to customers and the possibility of “data breach notification fatigue.”  This sort of argument is a riff familiar in parts of America where 48 states have data breach notification laws which has meant that there have been multiple notifications arising from breaches.  To the extent that there is an identifiable fatigue, and what exactly that entails, is very much debatable.  Surveys of Americans have highlighted a high level of concern about the security of personal information (such as the Pew Research’s survey on privacy in September 2016).  Those who assert there is data fatigue are commonly representing businesses or defence lawyers given data breaches can attract class actions in the United States.  It is always a fraught exercise to look to another jurisdiction, with all their cultural and legal distinctions, and predict an identical outcome.

What is clear from the legislation is that organisations will need a step by step analysis of the breach and whether the elements of the scheme have been met to trigger that obligation.  It is far from a straightforward exercise and potentially can be quite complex involving weighing whether there was the likelihood of the risk of serious harm arising from the breach. It is certainly more complex than the reportage to date suggests.

The legislation has the real potential to affect many organisations and make them take a more serious approach to their privacy protections.  It could have a very positive and long lasting impact on data security in Australia.  Or it could end up being a dead letter law, as happens with much privacy protection in Australia at the moment.  As with all regulation the effectiveness has more to do with the effectiveness of the enforcement than what the regulations say.  And that is the rub given the legislation is structured such that the Commissioner must initiate most actions.  If he or she is disinclined to take an assertive role then there is little an individual can do under the Privacy Act.  There are other more complicated options that can be taken for a data breach which causes damage but it is a much more difficult process.  The Commissioner’s office has Read the rest of this entry »

Privacy and Information Commissioner releases guide to managing data breaches…just in time for the commencement of the Notifiable Data Breach legislation

February 21, 2018

The draft guidelines relating to the impending Data breach legislation coming into effect have now been finalised and were released yesterday.  All 64 pages of them.

While the guidelines are not regulations they will be very important when developing processes and procedures necessary to deal with a data breach.  They will also be important when dealing with data breach.  What is notable about this Guideline is that while it is comprehensive in one respect, addressing key issues in each category, and provides a very useful structure when dealing with a data breach it is drafted in broad and sometimes opaque terms.  That means there will need to be consideration of relevant principles of law when dealing with particular provisions of the Privacy Act.  The absence of case law does not assist.  It is a starting point only for Read the rest of this entry »

The Australian Information and Privacy Commissioner, Timothy Pilgrim, to retire on 24 March 2018

February 20, 2018

According to a report in the Mandarin,Last man standing: information and privacy commissioner Timothy Pilgrim to retire, Timothy Pilgrim, the Privacy and Information Commissioner is to retire on 24 March 2018. It is also reported in itnews, computerworld and zdnet.

Timothy Pilgrim has been one of the better privacy commissioners.  That is a comparative measure only.  His predecessors ranged from ineffective to hopeless.  As a result the privacy and data security culture has been poor.  Pilgrim was far more active than his predecessors both in terms of work rate and general profile.  But objectively measured he was a timid and tentative regulator.  Even with a limited budget from 2014 the Office of the Information Commissioner took a very low profile.  His determinations were excessively conservative and Read the rest of this entry »

Two days to mandatory data breach notification laws comes into effect and the advisory articles (sort of) come out

In two days the Privacy Amendment (Notifiable Data Breaches) Act 2017 becomes law.  Organisations and agencies covered by the Privacy Act will have obligations to notify those impacted by a data breach as well as notifying the Information Commissioner.  What was once good practice is now mandatory.  How mandatory it becomes in practice depends on the regulator.  That is a live question in this area.

It is interesting to see how these changes are being written up.  In today’s Australian under It’s D-Day for privacy breaches the VP of Cisco and chief data privacy officer, Michelle Dennedy, has written a sprightly piece ostensibly about the data protection laws but more a generalised discussion on good privacy practices, sprinkled with the word “Cisco”.  It offers next to no insight on how the legislation will operate.  It is a complex piece Act which requires balancing and some careful decision making.  If one was to Read the rest of this entry »

Mandatory data breach notification legislation comes into effect this week…Thursday

February 18, 2018

The long demanded, often promised and finally enacted mandatory data breach notification legislation comes into effect this week, Thursday 22 February 2018.

The legislation is complex but the failure to comply may result in significant consequences.  Much of the impact of the legislation depends Read the rest of this entry »

The Australian Senate passes a revenge porn Bill ..now onto the House of Representatives

Yesterday the Senate passed the Enhancing Online Safety (Non-consensual Sharing of Intimate Images) Bill 2017.  Or a bill to ban revenge porn. It must now pass through the House of Representatives before it will become law.  It is a complex Bill and one that is a reasonable but not the best response to this growing problem.

The summary is described Read the rest of this entry »

Australian websites attacked by a cryptojacking attack….

February 12, 2018

There is a positive in all of the attacks in cyberspace… the English vocabulary has grown and become enriched by new terms.  Ever heard of cyrpojacking.  It is a form of malware (another gift to the mother tongue to describe malicious software) which forces computers to mine cryptocurrency which generates profits for the hacker.  Australian Government sites have been successfully breached through a browser plug in provided by a third party.  Hackers inserted Coinhive into the plug in which hijacked the processing Third Party vulnerabilities are a chronic problem for businesses and government because their internal controls are not easily supervised and audited but their services are necessary.

The Guardian in Cryptojacking attack hits Australian government websites reports that in Australia the Victorian Parliament website has been compromised as has the Queensland Ombudsman, the City of Casey and the South Australian City of Unley Council. These types of breaches highlight which organisation and agencies have been less diligent with Read the rest of this entry »

Mandatory Data breach notification laws come into effect in 2 weeks, 22 February 2018

February 9, 2018

With the passage of the Privacy Amendment (Notifiable Data Breaches) Act 2017  Australia will have a mandatory data breach notification law.  It comes into effect from 22 February 2018 (though some practitioners believe it comes into effect on 23 February).

In summary the scheme as enacted int Part IIIC of the Privacy Act obliges organisations covered by the Privacy Act and agenices  to notify individuals whose personal information is involved in a data breach that is likely to result in serious harm. A notification must include recommendations about the steps individuals should take in response to the breach. The Australian Information Commissioner must also be notified of eligible data breaches.

That is the starting point.

It is a complex piece of legislation which requires careful consideration of the exemptions and consideration of what may or may not constitute serious harm.

Cabinet files found in an ex Government filing cabinet…a familiar story of appalling data security practices

February 1, 2018

There is quite a buzz about the ABC’s scoop in obtaining Cabinet documents stretching across a number of recent Australian Governments.  It has resulted in a cornucopia of stories which have found their way into the media in the last few days.  It is a hell of a scoop.  The documents were not “leaked” by government or opposition insiders or a disgruntled public servants.  They were found in an old second hand filing cabinet bought by a punter at an op shop who passed them onto the ABC.  This is hardly a new story.  I Read the rest of this entry »

Former ASIO boss warns that Australia’s cyber defence is weak and uncoordinated…hardly a revelation with weak privacy and data security laws and even weaker regulation of those laws

January 19, 2018

It is enough to make a cat smile how the obvious poor state of cyber defence across the board is breathlessly reported as a revelation, again and again.  And how nothing really changes even though the problem grows worse each year.

The ABC reports in Australia’s cyber defences ‘relatively weak, uncoordinated’, former ASIO boss David Irvine warns in a submission through the Australian Cyber Security Research Institute that that Australia’s ability to counter cyber threats and criminal activity is relevantly week and uncoordinated.  That is not surprising, coming from a former public servant of long standing, the proposal is single Commonwealth led Co operative Agency.  The proposed entity will Read the rest of this entry »