Data breach notification places cyber-risk at the top of the agenda

The bar is to be raised yet again for privacy compliance in Australia. Cyber-risk has become a key agenda item for boards for the public sector, and the impending mandatory data breach notification regime is set to propel cyber-risk to the top of the agenda.

The Attorney-General’s Department has released an exposure draft of the Australian Government’s promised mandatory data breach notification bill. The Privacy Amendment (Notification of Serious Data Breaches) Bill 2015 (Cth) (Exposure Bill) is the Government’s response to one of the recommendations of the Parliamentary Joint Committee on Intelligence and Security on the Telecommunications (Interception and Access) Amendment (Data Retention) Act 2014 (Cth), which recently commenced operation.

The introduction of a mandatory data breach notification regime in Australia has been on the cards for some time. Following legislative developments around the world (most notably in the United States), attempts were made in 2013 and 2014 to amend the Privacy Act 1988 (Cth) (Privacy Act) to introduce a mandatory data breach notification regime in Australia. The most recent of these efforts was a private member’s bill introduced by a Labor senator, the Privacy Amendment (Privacy Alerts) Bill 2014 (Cth) (Prior Bill), which has not progressed beyond the Senate. The Exposure Bill is quite similar in many respects to the Prior Bill and it has been reported that the Exposure Bill has the support of both major political parties.

The Exposure Bill proposes to amend the Privacy Act to introduce an obligation for organisations and Commonwealth Government agencies that are subject to the Privacy Act to notify the Australian Information Commissioner (Commissioner) and affected members of the public of the occurrence of a data breach in certain circumstances. In brief, if:

• an organisation or agency holds personal information, credit reporting information, credit eligibility information or tax file number information; and
• there is unauthorised access to, or unauthorised disclosure of, the information (or the information is lost in circumstances where unauthorised access to, or unauthorised disclosure of, the information is likely to occur, or the information is of a particular type specified in the regulations) that will result in “a real risk of serious harm” to any of the individuals to whom the information relates,

then this will be regarded as a “serious data breach”. For the purposes of this definition, the Exposure Bill clarifies that “harm” includes physical, psychological, emotional, economic, reputational and financial harm and that a “real risk” means a risk that is not a remote risk.

If an organisation or agency is aware, or ought reasonably be aware, that there are reasonable grounds to believe that there has been a serious data breach, then the organisation or agency must:

• prepare a statement (Notification Statement) that sets out the identity and contact details of the organisation or agency, a description of the serious data breach that the entity has reasonable grounds to believe has occurred, the kinds of information that were affected and recommendations about the steps that individuals should take in response;
• provide a copy of that Notification Statement to the Commissioner; and
• either:
  • notify the contents of the Notification Statement to each of the affected individuals; or
  • if that is not practicable, publish a copy of the Notification Statement on its website and take reasonable steps to publicise the contents of the Notification Statement.

Organisations and agencies are allowed up to 30 days to assess whether there are reasonable grounds to believe that the relevant circumstances amount to a serious data breach.

The Commissioner will also be granted additional powers to:

• direct an organisation or agency to prepare and publicise a Notification Statement if the Commissioner believes on reasonable grounds that there has been a serious data breach in relation to that organisation or agency; and
• exempt an organisation or agency from having to prepare and publicise a Notification Statement (either on the Commissioner’s own initiative or if the affected organisation or agency applies for an exemption from this requirement).

A failure to notify a serious data breach (either when required by the relevant provision or when directed to do so by the Commissioner) is deemed to be an interference with the privacy of an individual. This deeming provision activates the complaints regime and also the civil penalty regime that exists in the Privacy Act, with the potential for serious or repeated interferences with privacy to be subject to civil penalties of up to AU$1.8 million in the case of body corporates.

The Attorney-General’s Department is currently seeking public comments on the Exposure Bill. The deadline for submissions is 4 March 2016. A submissions template (along with an explanatory memorandum, regulatory impact statement and discussion paper on the Exposure Bill) can be found on the Attorney-General’s website.

The explanatory memorandum to the Exposure Bill notes that concepts in the Commissioner’s Data Breach Notification Guide are reflected in the Exposure Bill and contemplates that the Commissioner may provide further guidance to organisations and agencies in preventing, identifying, notifying and containing serious data breaches.

The Exposure Bill also contemplates that some additional clarifications could be included in accompanying regulations, so it is possible that future regulations may provide more clarity on some of the obligations set out in the Exposure Bill.

Interested companies, agencies and industry bodies should consider whether they may wish to make a submission in relation to the Exposure Bill.

If passed (as now seems likely, at least in some form), the substantive obligations in the Exposure Bill for organisations and agencies to notify serious data breaches will take effect on a day to be fixed by proclamation, but will come into effect no later than 12 months after the Exposure Bill receives royal assent. Organisations and agencies should expect that these obligations will become binding by no later than mid- to late-2017. While this may not seem on the horizon, it is important for agencies and organisations to take action now. It is not practical to respond in an effective manner ‘in the heat of the moment’ after a data breach has occurred. Instead, organisations and agencies need to be prepared for a data breach with a comprehensive response plan that involves all relevant stakeholders, as well as ensuring that their information security systems are robust.

The introduction of mandatory data breach notification laws in the United States saw the number of reported data breaches jump exponentially, and in most cases a data breach resulted in a class action. We expect the same to occur in Australia, so get your house in order now.

Cyber-risk is perceived as a key issue for most organisations. For that reason, it is critical to have a response plan setting out what to do if a breach occurs. Many breaches arise from weaknesses in vendors’ systems, rather than organisations’ own systems. It is therefore also important to have a vendor cyber-risk management framework in place. Our Australian Privacy and Cyber-risk Team has worked with our colleagues overseas to develop two fixed price global best practice cyber-risk management packages to address these issues. Please contact us for further details.