Peter A Clarke

One of the misconceptions in privacy law is that once a person steps into a public place there is no reasonable expectation of privacy.  That is not, in and of itself correct under Australian, New Zealand,  UK and European law. That was made abundantly clear in the seminal 2004 House of Lords decision of Campbell v MGN Limited [2004] UK 22.  Naomi Campbell sued when she was photographed leaving a Narcotics Aonymous meeting in 2001.

Dani Laidley has reportedly sued Victoria Police over photographs allegedly taken of her in November 2020 at the Geelong Racecourse by a police officer.  She alleges those photographs were shared online.  The pleadings are not to hand so it is not possible to comment on the causes of action pleaded however the report in the Nine Papers claim there is a claim of a breach of duty.  Australia does not have a common law cause of action for harassment although the Gummow and Hayne JJ referred to ‘what may be a developing tort of harassment’ in ABC v Lenah Game Meats 2001] HCA 63; (2001) .  That was 21 years ago and the development of the law has stalled.  All the more reason for a statutory tort for interference with privacy which Read the rest of this entry »

Today the Australian Communications and Media Authority published its findings that the ABC has breached its privacy obligations in disclosing the identity of a person who used a dating app.  Beyond finding a breach and making recommendations there is no other sanction available to the ACMA.  Another example of why a stautory tort relating to the interference with privacy is long overdue.

ACMA’s  media release provides:

The Australian Communications and Media Authority (ACMA) has found the Australian Broadcasting Corporation (ABC) breached the privacy requirements in the ABC Code of Practice by broadcasting an identifiable person’s profile in a news report about dating app scams.

The Newshour segment, which was broadcast in May 2021, included footage of a screen scrolling through a dating app showing the profile of a person, including an image of a face, age and first name.

The ACMA investigation found that although the dating app profile was shown fleetingly, the image of the face was repeated twice in the news report and the person was identifiable.

ACMA Chair Nerida O’Loughlin said having personal information broadcast on television can be distressing for the individual in question.

“Media intrusion into a person’s private life without consent must be justified to be in the public interest,” Ms O’Loughlin said.

“There is a clear public interest in reporting on online scamming, however there are limits to the type of personal information that should be disclosed in a news report. In this case, there was no justifiable reason to identify the person and the ABC did not undertake adequate measures to ensure their privacy.”

The ACMA’s enforcement powers when it finds the ABC has breached its Code are limited to recommending the ABC take particular actions. In this case, the ACMA did not consider this necessary as the ABC had already removed the footage from its archive and advised that the ACMA finding will be made available to relevant ABC News staff. 

FACTS

The Australian Broadcasting Corporation (the ABC) broadcast the News Hour on 11 May 2021 at 5:00 pm.

The Report was comprised largely of the studio presenter and expert guest discussing the ramifications of the rise in online scamming appearing on dating apps. A montage sequence of people using mobile phones to view dating apps, with faces and names of subscribers to those dating apps appearing on-screen, punctuated the discussion.

In the Report, the relevant footage was Read the rest of this entry »

The ABC in Australian Clinical Labs accused of ‘sitting on’ hack that saw patient data posted to the dark web reports on Australian Clinical Labs having bneen hit by a data breach in February but only advised patients five months later.  This is not an isolated event.  Bleeping Computer reports in See Tickets discloses 2.5 years-long credit card theft breach that hackers had accessed customers payment card details via a skimmer on its website.  The breach was detected in April 2021 but the malicious code was only fully removed on 8 January 2022.  After further analysis that See Tickets finally concluded on 12 September 2022 that the hackers made accessed customer credit information including full names, .  An internal investigation determined that the initial breach occured on 25 June 2019.  In total an exposure of 2.5 years. It is not uncommon with sophisticated attacks that it can take considerable time to detect an intruder, particularly if a company does not have software designed to monitor unusual activities within a site.  But 2.5 years indicates a woeful level of cyber security.

The latest significant data breach has been a ransomware attack on the Department of Defence, specifically a communications platform used by the military.  Hackers accessed the ForceNet service which is operated by an external information provider.  It is reported in Australian Defence Department caught up in ransomware attack.  Given the function of the platform communications between the current and former Australian defence members have been compromised.  The dataset extends back to 2018.  It will be interesting to determine whether data was retained long after it should have been deleted.  That is a constant problem in Australian data management. I am not surprised the hackers targeted an ICT contractor.  Third party providers are often the weak link for organisations.  They are commonly Read the rest of this entry »

ISO 27001 is a global specification for an information security management system (known as ISMS). It is the standard for effective information management. Properly implemented it helps organisations to avoid security breaches. An ISMS is a framework of policies and procedures relating to  that includes all legal, physical and technical controls involved in an organisation’s information risk management processes.

The new ISO 27001 has just been released.  It is called ISO 21001:2022. This version introduces significant changes in the way organisations manage information security. The Standard was last revised almost a decade ago.

The standard  is no longer divided into 14 control categories.  It is now split into four ‘themes’:

• organisational,
• people,
• physical and
• technological.

The total number of controls has decreased from 114 to 93. This is because many of its controls have been reordered and merged. Under the new ISO 27001:

•  35 controls are unchanged,
• there are 11 new requirements which  are:
  • threat intelligence
  • information security for use of cloud services
  • ICT readiness for business continuity
  • physical security monitoring
  • configuration management
  • information deletion
  • data masking
  • data leakage prevention
  • monitoring activities
  • web filtering
  • secure coding

Read the rest of this entry »

The Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 was introduced into the House of Representatives by the Attorney General earlier today.

The amendments will provide the Commissioner with new powers including, but not limited to:

• The commissioner will have “new information-gathering powers regarding  the notifiable data breache reporting and notification requirements.
• The commissioner will have … information-gathering powers to conduct assessments of organisations’ practices.
• the Commissioner will have powers to issue a direction for the entity to notify individuals who have been affected by a data breach
• the Commissioner will have infringement notice powers.

The Commissioner being provided with infringement notice powers brings the Australian regulation more in line with the UK legislation where the UK Commissioner can issue monetary penalty notices.  Similarly the Federal Trade Commission has a different process but has a similarly quicker way of imposing penalties.  It will be critical for businesses and organisations to understand their obligations otherwise they may be the subject of significant financial penalty, not to mention the reputational damage that comes with that.

Itnews has undertaken a reasonable summation, from a lay perspective, of the proposed amendments in  Privacy Act amendments land in parliament which provides:

The Bill Read the rest of this entry »

Governments of both persuasion have avoided privacy law reform for over 20 years.  A Coalition Government made the most minimal changes to the Privacy Act in 2001 to cover the private sector. The ALP Government made relatively few amendments in 2012 in response to the mammoth and comprehensive Australian Law Reform Commission Report on privacy handed down in 2008. For the last 6 years the previous Coalition Government sat on another Australian Law Reform Commission Report and then instituted an internal Attorney General’s review of the Privacy Act.

Medibank provided an update yesterday about the cyber attack in October.  The data exfiltrated is more extensive than previously known.  It now includes Medibank customer data of both current and previous customers. The statement provides:

There has been a further development in Medibank’s cybercrime event, which is subject to a criminal investigation by the Australia Federal Police (AFP).

It has become clear that the criminal has taken data that now includes Medibank customer data, in addition to that of ahm and international student customers.

This is a distressing development and Medibank unreservedly apologises to our customers.

Here is what we can update

We have received a series of additional files from the criminal. We have been able to determine that this includes: Read the rest of this entry »

The ANU Centre for Social Research and Methods has released Data trust and data privacy: a brake on the data and digital dividend?   The timing couldn’t be more appropriate given the latest large scale data breaches.

The description of the paper provides:

Data is increasingly available at scale and many of the fastest growing companies are built on data and data analytics. Governments are also increasingly using data for service delivery and to a lesser extent policy development and evaluation. Regulating and managing the increasing availability and use of data by the public, community and private sectors requires new approaches and laws.

In April 2022 the Australian Parliament passed the Data Availability and Transparency Act 2022 which allows Australian Commonwealth bodies to share data. While the legislation and associated regulation is important, so are the levels of community data trust and attitudes to data privacy.

This paper reports data on Australian’s attitudes to data trust and data privacy and how these have changed since October 2018 using data from the ANUpoll series of surveys collected in October 2018, October 2019, May 2020, August 2021 and August 2022. This provides information on how attitudes have changed during the COVID-19 period and during a period of rapid digitisation and increasing availability and use of data. The data shows that trust in key institutions with regards to data privacy increased during the early stages of COVID-19 period, and has stayed high through to mid-2022.

Australians also for the most part think governments should be sharing data with researchers (particularly in universities) and making use of data internally. However, support for such uses of data is slipping. Part of the response to these trends is to make sure that when data is used, it is done so in a way that maximises benefits to society. Collectively, the Australian research and policy community also needs to better understand who is reluctant for their data to be used, why they are reluctant, and what the possible responses and safeguards might be to make better use of such resources whilst still maintaining a social licence.

Interesting points made in the Report Read the rest of this entry »

The Federal Trade Commission (“the FTC”) is taking action against Drizly, an online alcohol supplier, and its CEO, James Rellas, regarding a data breach that exposed personal information of 2.5 million consumers in 2020.  The data breach, it is alleged, was caused by security failures on Drizly’s part.

The core of the complaint is that Drizly:

• failed to implement basic security measures.  They included not requiring employees to use two-factor authentication for GitHub, not limiting employee access to personal data, not having adequate written security policies, or failing to train employees on those procedure;
• stored information on an unsecured platform. Drizly stored login credentials on GitHub contrary to the platform’s own guidance and well-publicized security incidents involving GitHub;
• failed to monitor its network for security threats. The FTC specifically claimed that the failure included not putting a senior executive in charge of ensuring that the data was secure.  It did it monitor its network for unauthorized attempts to access or remove personal data; and
• exposed its customers to hackers and identity thieves. After the data breach personal information that Drizly had collected about consumers was offered for sale on two different publicly accessible sites on the dark web.

The action is by way of administrative complaint, a precursor to formal litigation.  This has resulted in a consent agreement. It is a more assertive process than the Own Motion Investigation that the Australian Information Commissioner uses, on a very sparing basis, in Australia.

An interesting feature of this consent agreement is that the Chief Executive, James Rellas, is accountable for information security under the consent agreement, even if he leaves Drizly and works for another entity.  That is a procedure that the Australian Government should consider in its reforms of the Privacy Act.  Having the power to make orders against directors to ensure proper data security by way of enforceable undertakings would focus their minds.  With this approach the cost is not only to the business.  It is to its officers as well.  Having an order attached to a director wherever he or she went over a period would be something they would dread.

While the Australian enforceable undertakings are a pale version of what the FTC imposes on companies who have had a data breach or otherwise breached privacy it is worth reviewing how the FTC drafts its complaints and agreements.  They are the gold standard in terms of imposing comprehensive orders which enforce proper privacy practices over a 10 or 20 year period.  It is only a matter of time before Australia will move in this direction.

The statement provides:

Read the rest of this entry »

The timing couldn’t be better.  The European Data Protection Board (“EDPB”)  released Guidelines 09/2022 on personal data breach notification under GDPR on 18 October 2022. Given the issue of notification of data breaches is a significant issue currently in Australia it is a very relevant document.  More importantly the guidelines on privacy and data breach issues are much more comprehensive in the EU and the UK.  That makes for better and more effective systems and protections, if followed.

The announcement provides:

The European Data Protection Board welcomes comments on the Guidelines 09/2022 on personal data breach notification under GDPR. The targeted update and this public consultation concern paragraph 73 of the Guidelines (marked in yellow in the document). Such comments should be sent 29th November 2022 at the latest using the provided form.

Please note that, by submitting your comments, you acknowledge that your comments might be published on the EDPB website.

The EDPB Secretariat staff screens all replies provided before publication (only for the purpose of blocking unauthorised submissions, such as spam), after which the replies are made available to the public directly on the EDPB public consultations’ page. Unauthorised submissions are immediately deleted. The attached files are not altered in any way by the EDPB.

Please, note that regardless the option chosen, your contribution may be subject to a request for access to documents under Regulation 1049/2001 on public access to European Parliament, Council and Commission documents. In this case the request will be assessed against the conditions set out in the Regulation and in accordance with applicable data protection rules.

All legal details can be found in our Specific Privacy Statement (SPS).

The guidelines are referable to obligations under the GDPR.  That said they contain best practice processes when dealing with the data breaches.  To that extent they are a very valuable resources in the Australian context in providing structure in anticipating and responding to a data breach.  Some points worth noting are:

• the benefits of notification include the controllers obtaining advice on whether the affected individuals need to be informed. The supervisory authority may order the controller to inform those individuals about the breach.
• communicating a breach to individuals allows the controller to provide information on the risks presented as a result of the breach and the steps those individuals can take to protect themselves from its potential consequences.
• the focus of any breach response plan should be on protecting individuals and their personal data. Breach notification should be seen as a tool enhancing compliance in relation to the protection of personal data.
• controllers and processors are encouraged to plan in advance and put in place processes to be able to detect and promptly contain a breach, to assess the risk to individuals, and then to determine whether it is necessary to notify the competent supervisory authority, and to communicate the breach to the individuals concerned when necessary. Notification to the supervisory authority should form a part of that incident response plan
• GDPR requires:
  • both controllers and processors to have in place appropriate technical and organisational measures to ensure a level of security appropriate to the risk posed to the personal data being processed which should take into account:
    • the state of the art,
    • the costs of implementation
    • the nature,
    • the scope,
    • context and
    • purposes of

Read the rest of this entry »

While the media in Australia is in hyperdrive over the Optus data, My Deal and Medibank Private data breaches it is relevant to put them into perspective. Data breaches are a worldwide phenomenon.

The Advocate Aurora Health network, with 26 hospitals in Wisconsin and Illinois are in the process of sending out notifications of a data breach involving 3 million patients.   To put it even more into perspective itGovernance has undertaken an analysis of data breaches in the 3rd quarter of 2022.  On its calculations, between July and September 2022 there were 285 publicly disclosed security incidents involving 232,266,148 compromised records.  The numbers are eye watering but the greater concern is that there has been a rise in both the number of incidents, of over 20%, and a massive increase, of 134%, in the number of compromised records. By a wide margin cyber attacks are the most prevalent form of data breach.  The public sector was the most vulnerable followed by the health sector.

The itGovernance article provides:

Welcome to our third quarterly review of security incidents for 2022, in which we take a closer look at the information gathered in our monthly list of data breaches and cyber attacks.

In this article, you’ll find an overview of the cyber security landscape from the past three months, including the latest statistics and our observations.

This includes year-on-year comparisons in the number of publicly disclosed data breaches, a review of the most breached sectors and a running total of incidents for the year.

Overview

Read the rest of this entry »