Peter A Clarke

Latitude’s woes continue with a high likelihood of more personal information being compromised over and above the reported 330,000 records. Latitude released a “Cybercrime Update” yesterday sometime. That is a very slow response to a data breach where customers were contacted last Thursday. By Australian standards the statement is middling. Compared to statements released in the United States it is very average both in terms of speed of statement (though there is a strand of late responders there as well as here) and the quality of communication.

What the poorly written statement advises is that:

• the attack remains active.  That is a model of vagueness, not making it clear that exfiltration of continues or whether they have not isolated and removed the malware, if malware has been deployed.  Given the access was through a person’s access credentials it is quite curious that it would not have been neutralised unless the hacker deployed some form of virus .
• Latitude does not know the extent of the compromise;
• the attack may have impacted non customer orginating platforms;
• Latitude kept historical customer information.  That is a huge problem, and one that affects Optus and Medibank.  Data that Latitude kept relating to individuals who no longer use Latitude.  That is very concerning.

It is quite concerning that a cyber attacker could have such easy access to a range of documents.  It will be interesting to see what access controls were in place within the system.  Issues of encryption and salting of data seem to be relevant considerations. 

If there is no class action with this data breach I would be amazed.  Just on the scraps of information provided to date it appears that Latitude was non compliance with Australian Privacy Principles relating to data security and retention of documents,

The statement Read the rest of this entry »

The timing of an announcement of a data breach at Latitude Financial couldn’t be more apposite. Submissions on the Government’s Report on reform to the Privacy Act, released in January, are due by 31 March 2023. The attack was effected through an employee login credentials from a major vendor used by Latitude. That is a depressingly familiar scenario. It also bespeaks inadequate controls. Approximately 103,000 identification documents, 97% of which were copies of drivers’ licences, and 225,000 customer records were compromised. The records were held by service providers. The breach has been reported in the Australian Financial Review, the NASDAQ, the Sydney Morning Herald among others (and it will grow in number).

Latitude has made a statement because it has been quoted in the media but it has not done what Optus and Medibank did with their data breaches and put out a statement on its website about what happened, what was done and what is being done.  That is a rookie error. 

The Australian’s Customer details stolen as Latitude suffers major cyber attack provides a good summary of what is known to date. The Information Commissioner has not made mention of any report or investigation. Given its recent decisions to investigate other major data breaches it is a reasonable expectation that Latitude Financial will be hosting officers from the Commissioner’s office in the near future.

The Australian article provides:

The loans, credit cards and insurance company said the activity was believed to have originated from a major vendor used by Latitude.

It said although it took immediate action, the attacker was able to obtain Latitude employee login credentials before the incident was isolated. “The attacker appears to have used the employee login credentials to steal personal information that was held by two other service providers,” it said. Read the rest of this entry »

The principles are consistent if the technology is in aconstant state of flux; do not share personal information through a program unless you know the privacy protections are strong and properly administered. In most cases that means don’t share! The Times story Do not share sensitive information with chatbots, cyber-experts warn makes that point very clearly. The privacy concerns are reinforced in the article AI uptake inhibited by security and data quality concerns: CSIRO.

It provides:

GCHQ’s cyber-experts have warned people not to share sensitive information with ChatGPT and similar artificial intelligence systems.

Private or confidential information included in questions to the chatbot could be viewed by others and leave users at risk of being hacked, the National Cyber Security Centre (NCSC) said.

Such so-called large language models (LLMs) could also be a boon for cyber-attackers, who could use them to impersonate people in emails, the centre warned in its blog.

The post is subtitled “Do loose prompts sink ships?” Two NCSC experts, David C and Paul J, write that the models are “undoubtedly impressive” but add: “They’re not magic, they’re not artificial general intelligence.” Read the rest of this entry »

With the Report of Proposed Reforms to the Privacy Act recently released it is apposite that the Federal Trade Commission has recently announced that it is taking action against BetterHelp for sharing its consumers health information, including about mental health problems, with Facebook and other platforms for advertising.  The odious practice was well entrenched and longstanding, commencing in 2013 and not concluding until the media reported on it in 2020. The nature of the data misuse is all the more appalling given BetterHelp repeatedly promised to keep the data private. Instead it monetised the data to target them and others for the service it provides.  BetterHelp has reached a settlement with the FTC. 

Arising from this action

• the FTC’ makes it clear that an email or an IP address by themselves can disclose private information about consumers based on the entity sharing the data.
• the FTC regards a failure to obtain “affirmative express consent” for disclosure of health information to social media companies for advertising purposes to be an unfair practice.

• Companies should:

  • consider carefully whether any of their web pages or apps collect information that could be considered sensitive
  • review their privacy policies and ensure they can be understood
  • train employees regarding privacy
  • develop policies and restrictions on how personal data must be protected

The terms imposed by the FTC are onerous and particularly swingeing compared to the relatively relaxed enforceable undertakings imposed in Australia. 

The media was, as usual, scathing with Fortune’s Counseling service BetterHelp to return $7.8M to customers in FTC settlement after it shared private health data with Facebook and Snapchat and Yahoo’ s Teladoc’s (TDOC) BetterHelp Faces FTC Hurdle, to Pay $7.8M.

The media release provides:

The Federal Trade Commission has issued a proposed order banning online counseling service BetterHelp, Inc. from sharing consumers’ health data, including sensitive information about mental health challenges, for advertising. The proposed order also requires the company to pay $7.8 million to consumers to settle charges that it revealed consumers’ sensitive data with third parties such as Facebook and Snapchat for advertising after promising to keep such data private.

This is the first Commission action returning funds to consumers whose health data was compromised. In addition, the FTC’s proposed order will ban BetterHelp from sharing consumers’ personal information with certain third parties for re-targeting—the targeting of advertisements to consumers who previously had visited BetterHelp’s website or used its app, including those who had not signed up for the company’s counseling service. The proposed order also will limit the ways in which BetterHelp can share consumer data going forward. Read the rest of this entry »

The Marriot Hotel entered into an enforceable undertaking with the Australian Privacy Commissioner for a data breach arising out of breaches between 2015 – 2018. I have posted on those breaches and the regulatory action taken by the UK Information Commissioner here, here, here and here. Worldwide the breaches affected the personal information of 339 million individuals. In Australia the records of 2.2 million were compromised. The Marriot Breach highlighted poor data security practices, with the breach occurring over a 3 year period, and the challenges of legacy IT issues. All too often IT systems are cobbled together and not properly maintained.

The enforceable undertaking is operable for 5 years.  Compared to agreements in the United States between the Federal Trade Commission and organisations for similar transgressions, that is a short time frame.  It is not uncommon for the FTC to enter into 20 year agreements.  This enforceable undertaking is more robust than the previous few enforceable undertakings the Commissioner has entered into however it is not as stringent as those imposed in the United States. In the United States such agreements usually incorporate a very significant fine.  Given the legislation in Australia that was not possible.

Some of the relevant matters of note from the enforceable undertaking Read the rest of this entry »

The High Court today revoked Facebook’s special leave application. The transcript is not available yet and reasons have not been published but the key argument for this volte face was a change to the Federal Court Rules on overseas service.

The Information Commissioner released a media release providing:

The Office of the Australian Information Commissioner (OAIC) today welcomed the Full Court of the High Court of Australia’s decision to revoke Facebook Inc’s special leave to appeal to the High Court.

The High Court granted the Commissioner’s application to revoke special leave due to a change in the Federal Court Rules in relation to overseas service.

This clears the way for proceedings to return to the Federal Court. The substantive proceeding seeking civil penalties against Facebook Ireland and Facebook Inc over the Cambridge Analytica matter will now progress.

“Today’s decision is an important step in ensuring that global digital platforms can be held to account when handling the personal information of Australians,” Australian Information Commissioner and Privacy Commissioner Angelene Falk said.

“Entities operating in Australia are accountable for breaches of Australian privacy law, and must ensure that their operations in Australia comply with that law,” Commissioner Falk said.

Background

On 9 March 2020, the Commissioner lodged proceedings against US-based Facebook Inc and Facebook Ireland (collectively, Facebook) in the Federal Court, alleging the social media platform had committed serious and/or repeated interferences with privacy in contravention of Australian privacy law.

The Commissioner alleges that from 12 March 2014 to 1 May 2015: Read the rest of this entry »

The National Institute of Science and Technology (“NIST”) has released its initial draft of Cybersecurity of Genomic Data.

The media release provides:

Genomic data has enabled the rapid growth of the U.S. bioeconomy and is valuable to the individual, industry, and government due to intrinsic properties that, in combination, make it different from other types of high-value data which possess only a subset of these properties. The characteristics of genomic data compared to other high value datasets raises some correspondingly unique cybersecurity and privacy challenges that are inadequately addressed with current policies, guidance, and technical controls.

This report describes current practices in risk management, cybersecurity, and privacy management for protecting genomic data, as well as the associated challenges and concerns. It identifies gaps in protection practices across the genomic data lifecycle and proposes solutions to address real-life use cases occurring at various stages of the genomic data lifecycle. This report also is intended to provide areas for regulatory/policy enactment or further research.

Genomic data has multiple intrinsic properties that in combination make it different from other types of high value data which possess only a subset of these properties. The characteristics of genomic data compared to other high value datasets raises unique cybersecurity and privacy challenges.

The NIST  report proposes a set of solution ideas that address real-life use cases occurring at various stages of the genomic data lifecycle along with candidate mitigation strategies and the expected  benefits of the solutions. Additionally, areas needing regulatory/policy enactment or further research are highlighted.

Cyber attacks targeted at genomic data include attacks against:

• the confidentiality of the data,
• data  integrity and its availability.
• the confidentiality of the data can threaten the economy through theft of the intellectual property owned by the  biotechnology industry,
• the integrity of the data can disrupt:
  • biopharmaceutical output,
  • agricultural food production,
  • bio-manufacturing activity.
• the availability of the data include:
  • encrypting for ransom,
  • deletion of data, and
  • disabling critical automated equipment used in:
    • research,
    • development,
    • and manufacturing.
• the potential harms of cyber attacks on genomic data threaten national security including enabling the development of biological weapons and the surveillance, oppression, and extortion of our citizens, military, and intelligence personnel based on their genomic data.
• genomic data can also harm individuals by enabling blackmail, discrimination based on disease risk, and privacy loss from the revealing of hidden consanguinity or phenotypes including health, emotional stability, mental capacity, appearance, and physical abilities.

Read the rest of this entry »

The Australian Information Commissioner chose a tough nut to crack when it chose to use for the first time its civil penalty powers against Facebook arising out of the use of personal information by Cambridge Analytica.  The Information Commissioner was late in bringing enforcement action against Facebook, The Facebook disclosed personal information to Cambridge Analystica between March 2014 and May 2015.  The Commissioner opened an investigation in April 2018 and commenced proceedings on 9 March 2020.  By then the FTC, on 24 July 2019 imposed a $ 5 billion penalty on Facebook while the UK Information Commissioner imposed a £500,00 fine on Faceook on 30 October 2019. 

On 9 April 2020 the Information Commissioner sought under rule and rule 10.43(2) leave to serve documents on Facebook, Inc. and Facebook Ireland in accordance with art 5 of Hague  Convention by substituted service. On 22 April 2020 His Honour Justice Thawley  made orders  that the Commissioner be granted leave to serve the documents in the United States of America. On 6 May 2020 Facebook Inc by interlocutory application sought to set aside those orders. Thawley J dismissed the application on 14 September 2020 and Facebook appealed that decision on 28 September 2020 to the Full Court of the Federal Court. 

The Full Court dismissed the appeal on 7 February 2022. On 16 September 2022 the High Court granted Facebook leave to appeal. It has been a long road, almost 3 years since commencing proceeding. And the case has barely begun.

The issue before the High Court is whether under Rule 10.43 of Federal Court Rules 2011 whether the Information Commissioner was successful in establishing prima facie case on application to serve appellant out of jurisdiction and whether Facebook “carr[ied] on business in Australia” within meaning of 5B(3)(b) of Privacy Act and whether it “collected… personal information in Australia” within meaning of s 5B(3)(c) of Privacy Act.

The Appellants and First Respondent filed detailed and densely argued submissions which will not be recited at length here.  It is however worth noting a number of points raised.

Facebook submits that:

• the issues are:

(a) Can a foreign corporation “carry on business” in Australia (within the meaning of s 5B(3)(b) of the Privacy Act 1988 (Cth) (the Act)) if it has no commercial activities or other recognised indicia of carrying on business in this country? Appellant contents that hte answer is“no”.
(b) Does the requirement of a “prima facie case” in r 10.43(4)(c) of the Federal Court Rules 2011 (Cth) (Rules) require evidence that could itself Read the rest of this entry »

Today the Information Commissioner released the latest Notifiable Data Breach report.

It makes for grim reading. The key findings are:

• 497 breaches were notified compared with 393 in January to June 2022 – a 26% increase.
• There was a 41% increase in data breaches resulting from malicious or criminal attacks. Malicious or criminal attacks accounted for 350 notifications – 70% of all notifications.
• Human error was the cause of 123 notifications (25% of all notifications), down 5% in number from 129.
• Health reported the most breaches (71), followed by finance (68). That the health sector provides the greatest number of breaches is no surprise.
• Contact information remains the most common type of personal information involved in breaches.
• The majority (88%) of breaches affected 5,000 individuals or fewer.
• 71% of entities notified the OAIC within 30 days of becoming aware of an incident. This is quite an indictment on compliance. Almost 30% of entities did not notify the OAIC within the statutory maximum of 30 days. That bespeaks poor culture.

The Commissioner’s media release provides:

Several large-scale data breaches impacted millions of Australians’ personal information in the second half of 2022, as part of a 26% increase in breaches overall, according to the latest Notifiable data breaches report released today.

Australian Information Commissioner and Privacy Commissioner Angelene Falk said cyber security incidents in particular can have significant impacts on individuals, and organisations need to be alert to the risks.

“We saw a significant increase in data breaches that impacted a larger number of Australians in the second half of 2022,” she said.

“Cyber security incidents continue to have a significant impact on the community and were the cause of the majority of large-scale breaches.”

Thirty-three of the 40 breaches that affected over 5,000 Australians were the result of cyber security incidents.

“Organisations should take appropriate and proactive steps to protect against and respond to a range of cyber threats,” Commissioner Falk said.

“This starts with collecting the minimum amount of personal information required and deleting it when it is no longer needed.”

Commissioner Falk said organisations need to be vigilant as large-scale compromises of personal information may lead to further attacks.

“As personal information becomes increasingly available to malicious actors through breaches, the likelihood of other attacks, such as targeted social engineering, impersonation fraud and scams, can increase.

“Organisations need to be on the front foot and have robust controls, such as fraud detection processes, in place to minimise the risk of further harm to individuals,” she said.

The Office of the Australian Information Commissioner has clear expectations of best practice with regard to data breach preparation and response, to ensure individuals are protected from harm.

“In response to a breach, organisations need to provide information to individuals that is timely and accurate.

“As well as setting out the kinds of information breached, the notification must include recommendations about clear steps people should take in response,” said Commissioner Falk.

The reporting period also saw the enactment of the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022. Among other things, the Act:

• • provides the Commissioner with new and greater powers to share information with other authorities about data breaches
  • provides the Commissioner with a new power to obtain information and documents relevant to an actual or suspected eligible data breach
  • enables the Commissioner to conduct an assessment of the ability of an entity to comply with the Notifiable Data Breaches scheme, including the extent to which the entity has processes and procedures in place to assess suspected eligible data breaches, and provide notice to the Commissioner and individuals at risk from such breaches
  • significantly increases penalties for serious or repeated privacy breaches, which includes non-compliance with the Notifiable Data Breaches scheme.

“While we will continue to work with organisations to facilitate voluntary compliance, we will use these regulatory powers where required to ensure compliance with the Notifiable Data Breaches scheme,” said Commissioner Falk.

“We also welcome the further proposals to strengthen the Notifiable Data Breaches scheme in the Attorney-General’s Department’s Privacy Act review report.”

The Report provides:

Notifications received July to December 2022 – All sectors

The OAIC received 497 notifications this reporting period – a 26% increase compared with January to June 2022. Read the rest of this entry »

The BBC in YouTube accused of collecting UK children’s data reports that YouTube has been accused of collecting the data of children aged under 13. This while the UK Information Office has developed a Children’s Code for on line services used by children.

The BBC article provides:

Read the rest of this entry »