Peter A Clarke

The Prime Minister today foreshadowed legislation to unmask online trolls and amend the law of defamation in response to the High Court decision in Fairfax Media Publications Pty Ltd v Voller; Nationwide News Pty Limited v Voller; Australian News Channel Pty Ltd v Voller [2021] HCA 27.  The necessary bills will be released in the next week.  A mid morning media release on a Sunday, usually a slow news day where editors fret on what will fill the front page the next day, guarantees big coverage on Monday.

Extracting the reforms from the media release the changes will involve:

• legislating a requirement that social media platforms to set up a complaints system so as to remove defamatory remarks;
• establishing a new Federal Court order to require social media giants to identify details of trolls to victims without consent.
• Australians and Australian media organisations will not be considered publishers. 
• social media platforms will be considered publishers though liability may be avoided if they provide information which permits victims to commence defamation proceedings against a troll.

The curious thing is that there is already a process for applying to the Federal Court for an order to a social media platform, search engine or internet service provider to identify an author who is using a pseudonym to defame someone.  I make these applications regularly enough as part of my defamation practice.  The principles are well established and the process is not overly onerous.  What new order is required will be interesting to see. There is also concern raised about social media platforms being required to collect personal information which would be provided if the mooted application is made.  That is not as dramatic as has been reported.  Google and Yahoo and other platforms require email addresses and sometimes phone numbers.  They can provide the isp number. It is relatively easy to identify the author from those details.  Similarly if the social media is put on notice about defamatory posts they may currently lose their protection from suit in the Broadcasting Services Act. 

If the Government were serious about Read the rest of this entry »

The Security Legislation Amendment (Critical Infrastructure) Bill passed both houses of the Commonwealth Parliament on Monday 22 November 2021. 

Key elements of the legislation are:

• Section 8D defines the critical infrastructure sector as being:

Each of the following sectors of the Australian economy is a critical infrastructure sector:

                     (a)  the communications sector;

                     (b)  the data storage or processing sector;

                     (c)  the financial services and markets sector;

                     (d)  the water and sewerage sector;

                     (e)  the energy sector;

                      (f)  the health care and medical sector;

                     (g)  the higher education and research sector;

                     (h)  the food and grocery sector;

                      (i)  the transport sector;

                      (j)  the space technology sector;

                     (k)  the defence industry sector.

• section section 8E defines a critical infrastructure asset as being an asset that relates to a critical infrastructure sector. There are definitions of specific types of critical infrastructure assets
• there are very broad definitions of when assets relate to a sector
• the definition of a relevant impact is broad and general
• Part 2B sets out the obligations of mandatory reporting.  Section 30BC, regarding a critical cyber security incident, provides, in part:

Read the rest of this entry »

Another sign, if more more were needed, that data breaches are a chronic and increasingly damaging phenomana when the US Federal Trade Commission (the “FTC”) has issued amendments to the Standards for Safeguarding Customer Information. 

The Final Rule is a very substantial document. It is a useful document for those interested in privacy and cybersecurity generally. Given the dearth of clear and precise definitions, practices and protocols in Australia it is quite useful in Australia.  Like NIST publications it is a much more substantial and useful documents than the vague and opaque guidelines issued by regulators in Australia.

Those who are responsible for maintaining cyber security and establishes procedures and protocols to protect personal information could do worse than read these rules.  It is only a matter of time before the Information Commissioner prepares detailed guidelines which are more consistent with the voluminous GDPR documents or the direct and also comprehensive FTC rules Read the rest of this entry »