Peter A Clarke

As part of the Government’s second stage relief package it has announced that it will amend the Corporations Act 2001 to:

• increase the threshold for issuing a statutory demand from $2,000 to $20,000; and
• extend the time within which to apply to set aside a statutory demand from 21` days to 6 months.

The Prime Minister’s media statement of earlier today relevantly provides:

The Government is temporarily increasing the threshold at which creditors can issue a statutory demand on a company and the time companies have to respond to statutory demands they receive. The package also includes temporary relief for directors from any personal liability for trading while insolvent.  The Corporations Act 2001 will be amended to provide temporary and targeted relief for companies to deal with unforeseen events that arise as a result of the Coronavirus.

(Emphasis added_

No details have been provided as to what is meant by relief from liability of directors who may trade while insolvent.  It is too cryptic at this stage.  

The pressure of receiving a statutory demand for relatively small debts is lifted, for the time being.  The threshold of $ 20,000 remains within the scope of many existing statutory demands.  Statutory demands for sums a little over $2,000 are issued but they do not make up the majority of statutory demands. 

The sting of statutory demands has been dulled by the long period within which an application to set it aside can be made, Read the rest of this entry »

At the end of February the Australian Information Commissioner released the Report of Notifiable Data Breaches for the July – December 2019 period.  There were 537 notifications, up from 460 in the previous 6 months and making 997 for the 2019 calendar year. 

As usual health service providers top the list, with 117 notifications, followed by finance with 77 notifications.  Interestingly though less than 10% of notifications there were 40 notifications from the legal/accountancy and management services.  In terms of numbers of individuals affected 132 notifications, about 20%, affected only one person’s personal information but one breach affected more than 10,000,000. The majority of notifications, 309, affected from 2 to 1,000 individuals while 13 notifications covered between 25,000 – 10,000,000. 

Contact information was Read the rest of this entry »

Yesterday, 9 March 2020, the Australian Information Commissioner commenced proceedings against Facebook in the Federal Court.  The actual citation is Australian Information Commissioner v Facebook Inc & Facbook Ireland Limited (court number NSD 246/2020).

It has taken 2 years for the Information Commissioner to conclude her investigations regarding Facebook’s actions in permitting personal information to be misused through the This is Your Digital Life app which was disclosed to Cambridge Analytica. The UK Information Commissioner resolved its investigation and issued a monetary penalty notice of 500,000 pounds in October 2018.  The US Federal Trade Commission imposed $5 billion penalty for its breach of the previous order in July 2019.

This litigation will be significant as it is the first consideration of the operation of section 13G of the Privacy Act, a civil penalty proceeding for serious or repeated interference with privacy.  Unfortunately the Information Commissioner has not proven to be an adept litigator to date though Facebook’s egregious conduct in permitting its users personal information to be misused is well documented.  What is less clear is how the Commissioner will convince the Court that the statutory limit of $1.7million for an infraction is a limit on each breach.  That will be a significant Read the rest of this entry »

Today the 7.30 program and the 9 Fairfax press report on possible non compliance with data storage conditions imposed on Alinta when it was sold to overseas, Chinese, purchasers. The source of the story is damaging internal documents questioning compliance. 

The essence of the story, that Alinta is not complying with its obligations under the Privacy Act regarding data security obligations, is not as exciting as the media outlets suggest.  It collects personal information of 1.1 million customers.  As do many large corporations and agencies.  It may not be properly protecting that data.

Inadequate data security is a problem endemic throughout the business sector.  Because regulation is light touch to the point of no contact compliance is patchy at best.  Some sectors are better than others, with banking, insurance and mining having reasonable structures and better compliance than other sectors because they are more often the targets of hackers and the consequences of a breach are significant.  But for many businesses cyber security is an optional extra.  

What makes the Alinta story notable is that there were strict data security conditions imposed on the purchaser, a Chinese entity, as part of the approval process. There is no culture of privacy protection in China and the Chinese government has a well deserved reputation in getting whatever benefit it can from western businesses, including the use of personal information.  Having access to over a million peoples data can be useful.

A better story would have been Read the rest of this entry »

It has long been known that the legislation in place to regulate the collection, use and protection of personal information is both porous, with many exceptions, and incomplete, not covering all organisations that collect personal information.

Even with these chronic problems with privacy legislation, the Medical Republic has discovered and reported on a government practice of releasing medical records to police without the need for a warrant or court order.  The process is entirely administrative, without any right of review by the person whose data is being provided to police.  The Guardian has also reported on the issue in Australian government secretly releasing sensitive medical records to police.

I provided comment on this little known scheme, amongst other privacy experts.

This process covering medical records held under the medical benefits and pharmaceutical benefits scheme completely undermines the protections that are supposed to reside in the Privacy Act. It is anachronous that Read the rest of this entry »

California’s much touted, and feared in some quarters, privacy law is now 2 days old and the West Coast of the USA has not slid into the sea. The Attorney General of California has set out the operation of the California Consumer Protection Act (CCPA) here with a short fact sheet.

It is common practice in the United States for significant law reform to emanate from the States and then for the Federal Government to legislate to cover the field and generally supersede those state laws.  That is particularly the case where the law applies to commerce that crosses state boundaries, clearly a federal law.  Often times that is done to establish uniformity and avoid duplication and efficiency.  Also states tend to be incubators for public policy experimentation.  Successful policies tend to get picked up and adopted federally.  That happened with welfare reform in the 1990s.  That occasionally occurred in Australia however the States are rarely so ambitious these days and are content to have the Commonwealth organise uniformity through the COAG process, amongst other fora.  The problem is that the genius of experimenting with new concepts has been suppressed for the sake of sameness.  In the area of privacy that has resulted in a dismal Federal Act and Read the rest of this entry »

The UK practice of announcing the New Years Honours recipients in the period between Christmas and New Years has turned into a disaster this year.  There was no controversy as to who the 1,097 recipients were.  It was just that both the recicpients’ names and addresses were published online.  The addresses included those of senior police officers and celebrities who may enjoy some limelight but are usually wary of divulging where they live.

This is a serious data breach pure and simple.  It happens with depressing frequency and is almost invariably caused by human error.  In my experience it often involves a distracted, poorly trained or overworked (or all three) staff member in the Cabinet Office attaching a PDF to a media release or engaging in a very sloppy cut and paste and sending without reviewing.  This “drag and drop” practice of Read the rest of this entry »

I wish all my readers, returning or first time occurring, a wonderful Christmas and an enjoyable festive season.  I hope 2020 will bring you joy and prosperity (if that is your aim).

As is my wont, I take the opportunity to repost a wonderful piece of prose, the famous Yes, Virginia, There is a Santa Claus which appeared on the pages of the Sun on 21 September 1897.  I have always admired the crisp prose that could be put to good effect in turning out a moving and sweet article that 9 year old Virginia could understand. It is also a wonderful push back against the cynicism of the time, something we experience today when reading some of the smarmy articles of some hacks in the mainstream press.

The editorial provides:

DEAR EDITOR: I am 8 years old.
Some of my little friends say there is no Santa Claus.
Papa says, ‘If you see it in THE SUN it’s so.’
Please tell me the truth; is there a Santa Claus?

VIRGINIA O’HANLON.
115 WEST NINETY-FIFTH STREET.

VIRGINIA, your little friends are wrong. They have been affected by the skepticism of a skeptical age. They do not believe except they see. They think that nothing can be which is not comprehensible by their little minds. All minds, Virginia, whether they be men’s or children’s, are little. In this great universe of ours man is a mere insect, an ant, in his intellect, as compared with the boundless world about him, as measured by the intelligence capable of grasping the whole of truth and knowledge.

Yes, VIRGINIA, there is a Santa Claus. He exists as certainly as love and generosity and devotion exist, and you know that they abound and give to your life its highest beauty and joy. Alas! how dreary would be the world if there were no Santa Claus. It would be as dreary as if there were no VIRGINIAS. There would be no childlike faith then, no poetry, no romance to make tolerable this existence. We should have no enjoyment, except in sense and sight. The eternal light with which childhood fills the world would be extinguished.

Not believe in Santa Claus! You might as well not believe in fairies! You might get your papa to hire men to watch in all the chimneys on Christmas Eve to catch Santa Claus, but even if they did not see Santa Claus coming down, what would that prove? Nobody sees Santa Claus, but that is no sign that there is no Santa Claus. The most real things in the world are those that neither children nor men can see. Did you ever see fairies dancing on the lawn? Of course not, but that’s no proof that they are not there. Nobody can conceive or imagine all the wonders there are unseen and unseeable in the world.

You may tear apart the baby’s rattle and see what makes the noise inside, but there is a veil covering the unseen world which not the strongest man, nor even the united strength of all the strongest men that ever lived, could tear apart. Only faith, fancy, poetry, love, romance, can push aside that curtain and view and picture the supernal beauty and glory beyond. Is it all real? Ah, VIRGINIA, in all this world there is nothing else real and abiding.

No Santa Claus! Thank God! he lives, and he lives forever. A thousand years from now, Virginia, nay, ten times ten thousand years from now, he will continue to make glad the heart of childhood.

The New York Times, per Thomas Vinciguerra, wrote a lovely piece about the article on its 100th anniversary with Yes, Virginia, a Thousand Times Yes.

That article in itself is a terrific piece of writing.

The data breach of personal information relating to New South Wales Ambulance officers in 2016 has had its conclusion in the resolution of a class action in the New South Wales Supreme Court earlier this month.  One hundred and six officers will receive a total of $275,000. The breach was egregious, being the workers compensation files of a officers including psychiatric assessments.   It was originally reported in the Sydney Morning Herald in November 2017 in Paramedics launch class action over the sale of their medical records to personal injury solicitors.

It is notable for being the first privacy class action which has been resolved. It highlights the need for employers to be rigorous in controlling access and use of personal information they collect, particularly sensitive information.

The success of the class also highlights what has always been known, there is scope to take action for interferences with privacy.  Notwithstanding Read the rest of this entry »

On 4 July 2017 the Guardian reported that Medicare card details were being sold on the dark web. As at July 2017 the vendor had sold details of 75 Medicare card details since the previous October.   In May of this year the Guardian reported that Medicare details were still being offered for sale on the darknet.  That should not have been a great surprise.  The personal information available from Medicare details is very valuable in engaging in identity theft and the ability of law enforcement to identify the thieves is often limited.  Even if an identity is established more often than not, by a wide margin, it is almost impossible to arrest that person because he (it is almost always a he) is domiciled in a country with a shaky legal system or with a government which connives in the fraudulent activity.

The ABC reports in Medicare card details of former Australian Federal Police commissioners available on dark web that the personal information of former Australian Federal Police Commissioners, Keelty, Negus and Colman contained in their Medicare details have been sold on the darknet. The fact that the former Commissioners personal information is being sold is no more egregious that the personal information of other individuals.  It is an interesting angle for the story. The key takeaway from the story is Read the rest of this entry »