InfoGovANZ

Information Governance Think Tank

Privacy - Australia and NZ

Australia’s Privacy Act Reforms 2024

by

On the final Parliamentary sitting day of 2024, the long-awaited first tranche of privacy reforms was finally passed by the Parliament in the Privacy and Other Legislation Amendment Act 2024 (Cth). This first tranche of reforms implements 23 of the 25 proposals the Government agreed to in its September 2023 Response to the Privacy Act Review. However, the Privacy Act Review Report 2022 made 116 recommendations for reform, including 89 legislative change proposals. A further tranche of reforms is anticipated in 2025.

In summary, the reforms concern information security, automated decisions, overseas disclosure of personal information, children’s privacy, civil penalties, and enforcement powers. They also include a new statutory tort for serious invasions of privacy and targeted criminal offences to respond to doxxing.

The amendments to the Privacy Act 1988 (Cth) introduce a series of measures to increase transparency and certainty regarding the handling of personal information for individuals and entities by:

  • clarifying that reasonable steps to protect information in APP 11 include technical and organisational measures,
  • introducing a mechanism to prescribe countries and binding schemes as providing substantially similar protection to the APPs, to assist entities in assessing whether to disclose personal information to an overseas recipient, and
  • requiring entities to include information in privacy policies about automated decisions that significantly affect the rights or interests of an individual.

The Office of the Australian Information Commissioner (OAIC) now has access to a broader range of enforcement options, as well as new functions and capabilities.  Importantly, these include two new provisions to ensure civil penalties can be tailored appropriately to the level of seriousness of the privacy breach. Additionally, the Information Commissioner has enhanced code-making powers.  To strengthen and protect the privacy of children online, the Information Commissioner is required to develop and register a Children’s Online Privacy Code (COP Code) within two years of the commencement of the relevant provisions.

Access the Privacy and Other Legislation Amendment Act 2024 (Cth) here and access the latest version of the Privacy Act 1988 (Cth) here.

NZ Privacy Commissioner’s Report 2024

by

 

The New Zealand Privacy Commissioner Annual Report was published on 26 November 2024. It revealed that 864 privacy breach notifications were received and that 1,003 complaints had been processed, with financial settlements in 6.5% of complaints. A key highlight reported was the European Commission determining that New Zealand has an adequate level of protection for personal data transferred from the European Union.

The report sets out four recommended amendments to the Privacy Act 2020 to ‘further modernise’ and ‘strengthen privacy outcomes’ including:

  1. A ‘right of erasure’ to enable individuals to ask agencies to delete their personal information.
  2. Establishing a new and significantly stronger penalty regime for agencies to take privacy seriously.
  3. Requiring agencies to demonstrate how they meet their privacy requirements, such as the privacy management programmes recommended by the OECD.
  4. Providing New Zealanders with stronger protections for automated decision making, such as AI, which can have issues with inaccurate predictions, discrimination, unexplainable decisions and a lack of accountability.

Read the full report here.

OAIC Guidance on Facial Recognition and Bunnings Decision

by

 

On 19 November 2024, the Office of the Australian Information Commissioner (OAIC) released guidance on assessing the privacy risks in facial recognition.  The guidance sets out general considerations for private sector organisations considering using facial recognition technology (FRT) to undertake facial identification in a commercial or retail setting.

The release of the guidance was on the same day as Australian Privacy Commissioner, Carly Kind, found that Bunnings Group Limited breached Australians’ privacy by collecting their personal and sensitive information through a facial recognition technology system. The system, via CCTV, captured the faces of every person who entered 63 Bunnings stores in Victoria and New South Wales between November 2018 and November 2021. Commissioner Kind said, ‘We acknowledge the potential for facial recognition technology to help protect against serious issues, such as crime and violent behaviour. However, any possible benefits need to be weighed against the impact on privacy rights, as well as our collective values as a society.’

  • Read the OAIC Guidance here
  • View the Bunnings decision here
  • Access the OAIC Bunnings determination factsheet here

OAIC Guides on AI and Privacy

by

The Office of the Australian Information Commissioner (OAIC) has published two new guides to assist organisations in navigating the intersection of AI and privacy: Guidance on privacy and the use of commercially available AI products: This guide assists organisations in complying with privacy obligations using commercially available AI products and helps them […]

Member only content (join now or login)

OAIC Data Breach Report: Key Themes

by

From January to June 2024, OAIC received 527 data breach notifications, the highest number since July to December 2020. The top five sectors that notified of data breaches in this period, were Health Service Providers, the Australian government, Finance, Education, and Retail.

In a media release accompanying the Notifiable Data Breaches Report on 16 September 2024, Australian Privacy Commissioner Carly Kind said, ‘the high number of data breaches is evidence of the significant threats to Australian’s privacy.’  The reporting period included the MedicSecure data breach notification affecting nearly 13 million Australians.

So far this year, the Information Commissioner has filed civil penalty proceedings in the Federal Court against Medibank arising from its October 2022 data breach. The OAIC has also issued an intention and a direction to notify of an eligible data breach about incidents in previous reporting periods and opened an investigation into the HWL Ebsworth Lawyers 2023 data breach.

OAIC’s Data Breach Report identifies the following key themes and recommendations:

  • Mitigating cyber threats – organisations need to have appropriate and proactive measures in place to mitigate cyber threats and protect the personal information they hold.
  • Addressing the human factor – individuals are a significant threat to the strength of an entity’s privacy practices.  Organisations need to mitigate the potential for individuals to intentionally or inadvertently contribute to the occurrence of data breaches.
  • Extended supply chain risks – organisations that outsource the handling of personal information can reduce the impact of a data breach in the supply chain by implementing a robust supplier risk management framework.
  • Misconfiguration of cloud-based data holdings – organisations need to be aware there is a shared responsibility for the security of data in the cloud.
  • Relevance of a threat actor’s motivation in assessing a data breach – entities should not rely on assumptions. They should weigh in favour of notifying the OAIC and affected individuals when a breach occurs.
  • Data breaches in the Australian Government – of all sectors, the Australian Government reported the most data breaches involving social engineering or impersonation. Organisations need to have access control measures in place to ensure only authorised persons access their systems.

Access the OAIC ‘s Data Breach Report here and the OAIC’s Guide to Securing Personal Information here.

IPC Data Breach Report: Key Themes

by

The first NSW Mandatory Notification of Data Breach Scheme Trends Report for November 2023 to June 2024 was released on 1 October.   According to the Report, 79% of all notifications made were caused by human error, followed by criminal or malicious attack. Acting Privacy Commissioner Sonia Minutillo said, ‘The high frequency of […]

Member only content (join now or login)

The Role of Information Governance in Reducing Data Breach Risks

by

As data breaches continue to rise, the importance of robust governance to align and improve integrated cybersecurity, technology procurement, privacy compliance, and information lifecycle management becomes critical.  Recently released reports by the Office of the Australian Information Commission and the New South Wales Information Commission reveal the high percentage of data breaches caused by human error, third-party supplier risks, and a significant rise in Australian Government data breaches, particularly those involving social engineering or impersonation.  This article highlights the trends and recommendations to mitigate these risks, together with how robust information governance works to align policies, processes, people and technology across organisational silos to reduce data breaches and to ensure timely responses to data incidents and data breach notification.

 

OAIC Notifiable Data Breaches Report: January to June 2024

In a media release accompanying the Notifiable Data Breaches Report  (OAIC Report) on 16 September 2024, Australian Privacy Commissioner Carly Kind said, ‘the high number of data breaches is evidence of the significant threats to Australian’s privacy.[1]  The reporting period included the MediSecure data breach notification affecting nearly 13 million Australians.  The Information Commissioner filed civil penalty proceedings in the Federal Court against Medibank arising from its October 2022 data breach and Australian Clinical Labs Limited from its February 2022 data breach. The OAIC has also opened an investigation into the 2023 HWL Ebsworth Lawyers data breach.

  The top five sectors in the reporting period that notified of data breaches were:

  • Health service providers (19%)
  • The Australian Government (12%)
  • Finance (11%)
  • Education (0.8%), and
  • Retail (0.6%).

OAIC Report: Key Themes and Recommendations

While malicious and criminal attacks remain the primary source of breaches (67%), the report reveals that 47% of all data breaches were due to people’s actions within the organisation.  The OAIC’s Report identifies key themes and makes recommendations as follows:[2]

  • Addressing the Human factor (47% of all breaches) – organisations need to mitigate the potential for individuals to intentionally or inadvertently contribute to data breaches. This includes training on secure information handling, keeping staff up to date on the latest techniques to detect phishing attempts, and minimising access to personal information for those staff who require it to carry out their work.
  • Mitigating cyber threats (38% of all breaches) –  organisations need to have appropriate and proactive measures in place to mitigate cyber threats and protect the personal information they hold.  These include multi-factor authentication, enforcing password management policies for strong passwords, layer security controls, regularly monitoring user access permissions and removing access privileges when no longer required, and implementing robust security monitoring processes to detect, respond to and report incidents promptly.  Read more at The Australian Signals Directorate’s (ASD) Australian Cyber Security Centre (ACSC) and implementing the Essential Eight.
  • Extended supply chain risks – this ‘continues to be a prevalent issue’  and compromises within a supply chain included the MediSecure and Outabox incidents. Guidance to managing third-party providers and supply chain risks includes implementing a strong supplier risk management framework with more robust security measures, and that entities consider the risks of outsourcing personal information at the earliest stage of procurement.  Read more at the OAIC’s Guide to securing personal information.
  • Misconfiguration of cloud-based data holdings – organisations need to be aware there is a shared responsibility for the security of data in the cloud.  The Report states that ‘[t]he OAIC observed various data breaches where an entity misconfigured security settings due to human error, leaving the personal information it held vulnerable to unauthorised access or inadvertent public disclosure.’  The ACSC has guidance on cloud security, including a Blueprint for Secure Cloud.  Cloud service providers guidance: Microsoft: Shared responsibility in the cloud; Amazon Web Services: Shared Responsibility Model; and Google: Shared responsibilities and shared fate on Google Cloud.
  • Relevance of a threat actor’s motivation in assessing a data breach – the OAIC observed an increase where an entity relied on its perception of a threat actor’s motivation in assessing a suspected eligible data breach.  The Report says entities should not rely on assumptions and should weigh in favour of notifying the OAIC and affected individuals when a breach occurs.
  • Data breaches in the Australian Government – the Australian Government reported the most data breaches involving social engineering or impersonation (42% of all breaches within this category). These breaches experienced by agencies typically involved a threat actor impersonating a customer and gaining access to their customer account by using legitimate identity credentials that bypassed the agency’s identity verification procedures. The Report states that ‘[e]ntities should have processes in place to identify users and have access control measures in place to ensure only authorised persons access their systems.’ [3]

The number of data breaches reported to the OAIC increased from 38 in the previous reporting period to 63 in this reporting period, with the Australian Government moving from fifth position to the second highest data breaches of all industry sectors.

 

IPC NSW Data Breach Report – Nov 2023 to June 2024

The first Mandatory Notification of Data Breach Scheme Trends Report (IPC Report) was released on 1 October by the Information and Privacy Commission NSW following the commencement of the Mandatory Notification of Data Breach Scheme (MNDB Scheme) on 28 November 2023.  The Scheme applies to New South Wales public sector agencies and includes Local Governments and Universities enacted under New South Wales legislation.

IPC Report: Key Themes and Recommendations

This IPC Report identifies several key themes and provides the following recommendations:[4]

  • Notifications are gradually increasing – it is recommended that agencies take the opportunity to review the effectiveness of their policies and procedures for assessing data breaches.
  • Cyber security uplift should be a focus for all sectors –  leaders across the sectors are strongly encouraged to engage with the risks arising from cyber security. This requires investment to uplift ICT security and staff capability, which are key to improving the safety and security of personal information held by agencies. While the NSW Cyber Security Policy is not mandatory for the Local Government or University sectors, its adoption is recommended to build a foundation of strong cyber security practice.
  • Data breach readiness –  being prepared and ready to respond to a data breach is key to limiting harm to affected individuals.  A comprehensive data breach policy provides staff with a clear plan to follow that will enable the agency to  manage a data breach in a timely manner, swiftly notify affected individuals, mitigate the effort and expense an agency will need to remediate the incident, and meet its compliance obligations under the MNDB Scheme. The Report recommends that agencies regularly review their data breach policy and privacy management plan to ensure they remain current and responsive to changes in the agency’s functions or structure, and the changing ways agencies deliver services. They should also be reviewed post-incident and responsive to any lessons learned.
  • Delegations – to facilitate a timely response to data breaches, make sure that appropriate delegations are in place so that the right people have the authority to act and make decisions quickly.  Delegations should be to officers at the appropriate level of seniority and with the necessary expertise to respond to a data breach in compliance with the Privacy and Personal Information Protection Act 1998 (PPIP Act).This means that at a minimum, these officers will need to understand and apply the legislation and statutory guidelines.
  • Effective notifications – effective notifications should provide all the information required under section 59O of the PPIP Act, be written in plain English and provide clear instructions for recommended steps the individual can take or the services that may be contacted for assistance.
  • Provision of assistance – where a data breach impacts a large number of individuals or involves particularly sensitive personal information, a dedicated webpage or support line should be established to provide affected individuals with a centralised contact point to seek further information about the breach, ask questions about the recommended actions made in the notification, or seek support to reduce harm arising from the breach.
  • Contracted service providers –  a small number of breaches notified by agencies in the reporting period involved private sector entities performing services under contract to an agency. To facilitate prompt assessment of breaches involving contracted service providers, data breach policies, data breach response plans and service contracts must adequately address all arrangements necessary in the event of a data breach, including those involving a service provider. This should include providing access to all the information necessary for the agency to assess harm, determining which entity will undertake notification and any other matters relevant to responding to, and managing, a data breach. ‘Chain of contracts’ scenarios are common where agencies are providing complex services which involve numerous service providers. The Privacy Commissioner has issued guidance to help agencies understand their obligations in these circumstances.

The IPC Report also provides a concise one-page summary of Good Practice Tips – Responding to breaches and reducing harm to affected individuals.[5]

 

The Role of Information Governance in Reducing Data Breach Risks

The coordinating mechanism of Information Governance enables key data breach risks to be reduced through robust information lifecycle management and data disposal. This improves collaboration across the organisation to minimise human error, reduce third-party risks, and better prepare for and respond to data breaches.

The nexus between Cybersecurity and Information Lifecycle Management

Information lifecycle management (ILM) is the system by which an organisation controls the collection and generation of data, storage, use and disposal and archiving of data and information. As the OAIC report states: ‘[u]ltimately, effective cyber security practices also require entities to practice ‘privacy by design’ across the information lifecycle, including the collection, retention, use, disclosure and destruction of personal information.’[6]  Achieving a program where there is ongoing disposal of personal information in accordance with privacy and legal requirements can be very challenging. There can be resistance to change when attempting to balance the tension between various business processes wishing to retain data (e.g., marketing and business development) and following best practices for privacy and regulatory requirements for data minimisation.  There can also be difficulties in actioning disposal due to a lack of decision-making authority, accountability, and inadequate auditing.

 

Data Minimisation, Data Security and Information Governance

Australian Privacy Principle APP 11.2 states an organisation ‘must take reasonable steps to destroy or de-identify information it no longer needs for any purpose for which the information may be used or disclosed under the APPs.’  Reasonable steps include both technical and organisational measures. Guidance on technical and organisations measures is provided in OAIC’s Guide to securing personal information.   The guidance points out that governance, accountability and lines of authority for decisions regarding personal information security need to be clear.  Even where these are clear, ongoing disposal and data minimisation may still be challenging.  Typically, in larger organisations, there are a number of different areas handling different aspects of data and information across separate organisational areas, as shown in the InfoGovANZ model below.

The issue is how to embed privacy governance into enterprise-wide information management to meet organisational strategic objectives, which focus on innovation through data-driven technologies and the need to meet legal obligations, including privacy, cybersecurity and record-keeping obligations.  This is where the information governance can help.  An essential component is the information governance committee, which has representatives from relevant areas (e.g., legal, privacy, records, technology systems, and data owners).  The information governance committee can prioritise data and information projects, such as data minimisation or data disposal projects, make decisions and recommendations to the risk committee.

For Australian Government agencies, information governance is part of the Building Trust in the Public Record: managing information and data for government and community policy (Building Trust in the Public Record Policy).  The Policy recommends that agencies review and update their information governance framework to incorporate enterprise-wide information management for records, information and data (see more here).

The Human Factor: a critical key to reducing data breach risk

While malicious and criminal attacks remain the primary source of breaches (67%) notified to OAIC, a deeper analysis reveals that 47% of all data breaches were due to people’s actions within the organisation.  The OAIC Report provides that while 30% of data breaches were due to human error, a further 12% were due to clicking on malicious links or downloading a compromised attachment, and 5% were due to a rogue employee or insider threat.  Reducing human error and taking steps to reduce risks around insider threats, along with robust information lifecycle management and training, are key ways organisations can reduce the risk of and prevent data breaches.

With regular reminders from media coverage of high-profile cyberattacks, ransomware demands and data breaches, from a corporate governance perspective, the primary focus is often on the external cyber risks and ensuring that IT and cybersecurity are adequately resourced to withstand relentless malicious cyber-attacks on the organisation.  However, as the OAIC Reports have consistently shown since 2018, around one-third of all data breaches are caused by human error. If clicking on phishing links (recorded in the malicious attacks category) is added to the human error category, then staff (and contractors) errors are a key cause of data breaches, arguably more than half of all data breaches.

The IPC Report reveals that, close to 79% of all notifications made in the three main sectors – government, local government and universities – were caused by human error.[7] Acting Privacy Commissioner Sonia Minutillo said, ‘The high frequency of notifications caused by human error reinforces that agencies must embed robust privacy practices into the design of their systems and processes of work, particularly with the use of email. An agency’s staff can be its most valuable asset for ensuring that personal information is safely and securely handled. This relies on the agency creating a pro-privacy culture where all staff have an appreciation of their role and an understanding of their obligation to protect the personal information the agency holds.’[8]   Building a pro-privacy and data protection culture is key to privacy compliance.

The antithesis of a data protection and privacy culture is the malicious insider who can access and misuse the organisation’s information.  The OAIC Report provides an example of a health service provider becoming aware of a data breach in which a former employee, over a period of 2 years, accessed over 20,000 individuals in its customer relationship management system and disclosed personal information without authorisation.  The Report says, ‘the employee disclosed the personal information to an external party for financial gain, via a work email and personal social media accounts, using their work-issued laptop.’[9] As a result of the incident, the Report states, ‘the entity implemented additional monitoring capabilities to flag high volume record searches and access by staff, large copying and pasting of data, and uploading of files to social media websites and external web services.’[10]  This is an example where technology can be used to flag discrepancies.  However, resources are then required to review flagged discrepancies and prompt action taken if there has been a failure to comply with user access policies.

The IPC has a comprehensive Privacy Governance Framework, which includes a high-level overview of the roles and responsibilities for effective privacy implementation.  The OAIC’s Guide to Securing Personal Information includes a section on ‘personnel security and training.’  In addition to implementing the guidelines from OAIC and the IPC, it is recommended that robust information governance, which connects some of the typically siloed training, can help build a culture of data protection and information as an organisational asset. That is, reframing cybersecurity training as ‘information security and protection’ and incorporating information and cyber security, safe data practices, and compliance with record-keeping obligations, to emphasise the role and responsibility of everyone within the organisation for protecting data and building information as a valuable asset.

The Role of Governance and Delegations

The latest reports have also shone a light on the importance of the delegations framework, the data breach response plan and co-ordination between areas within the organisation to ensure privacy regulatory notification requirements are met in a timely way.  As referred to above, the IPC Report identified that organisations need to ensure that ‘appropriate delegations are in place so that the right people have the authority to act and make decisions quickly.’[11]  The OAIC Report provides that, ‘the Australian Government continues to have the largest proportion (87%) of notifications identified over 30 days after it occurred and further delay in escalating it to the responsible area for responding to the data breach and notifying the OAIC.’[12]

These latest responses indicate a disconnect between those at the initial ‘coal face’ of detecting a data breach, which is usually the area responsible for cybersecurity or the business area, and a delay in communicating the incident to privacy and legal.  Building data and information relationships across areas, including cybersecurity, business areas, privacy and legal, can help improve data breach response.    Building relationships through ongoing collaboration for data protection and information governance should also help when responding to a data breach.  While all organisations should have robust data breach response plans in place – see OAIC’s Data Breach Preparation and Response  and IPCs Guide – Mandatory Notification of Data Breach Scheme: Guide to Preparing a Data Breach Policy, the information governance committee can be involved in post data breach analysis to help identify and oversee implementation of measures to reduce future data breach risks.  For example, IPC’s  Fact Sheet – How to calculate the estimated cost of a data breach  provides a valuable tool to examine data breach costs and identify ways and measures that can be implemented and overseen by privacy and an information governance committee.

Key Points 

  • Data breach notifications are increasing.
  • Privacy regulatory activity and enforcement action is increasing.
  • The OAIC and IPC’s latest reports set out case scenarios to provide guidance to help organisations comply. These can be used to discuss and identify risks and implement the necessary steps to reduce them and improve data security.
  • Managing personal information across the organisation requires ongoing collaboration, expertise (in systems, data, and regulatory compliance), decision-making and accountability.
  • Privacy compliance can be improved by a robust information governance framework that aligns policies, people, and technology and through an information governance committee, particularly in relation to ongoing information lifecycle management.
  • Robust enterprise-wide information governance helps integrate privacy, cybersecurity, records, and information management, to reduce risks and build a culture where information is protected and valued as an asset.

 

InfoGovANZ offers bespoke workshops for organisations, bringing together key stakeholders to improve information governance for information lifecycle management, enabling data-driven innovation and privacy and cybersecurity compliance. For more information get in touch here.

Author: Dr Susan Bennett PhD, LLM(Hons), MBA, FGIA, FIP, CIPP/E, CIPT

Founder of InfoGovANZ, Principal Sibenco Legal & Advisory, Governance and Privacy Lawyer

Footnotes

[1] OAIC, Media Release, 16 September 2024.

[2] OAIC, Notifiable Data Breaches Report: January to June 2024 (OAIC Report), 16 September 2024, 9.

[3] Ibid 21.

[4] IPC, Mandatory Notification of Data Breach Scheme Trends Report 1 October 2024 (IPC Report) 6-8.

[5] Ibid 13.

[6] OAIC Report, 11.

[7] IPC Report, 14.

[8] IPC Media Release, 1 October 2024.

[9] OAIC Report, 14.

[10] Ibid.

[11] IPC Report, 7.

[12] Ibid 20.

Privacy Bill tabled in Parliament

by

On 12 September 2024, the Attorney-General, the Hon Mark Dreyfus KC tabled the long-awaited Privacy and Other Legislation Amendment Bill 2024 (the Bill).  This would enact the first tranche of reforms to the Privacy Act 1988 (Cth) (Privacy Act) and implement 23 of the 25 proposals the Government agreed to in its September […]

Member only content (join now or login)

NZ’s OPC report-back on Biometric Consultation

by

On 7 August 2024, the Office of the Privacy Commissioner (OPC) provided an update on the consultation process for new rules for biometric processing, which includes facial recognition technology.  The OPC publicly released draft rules for using biometrics, for consultation, in May and received 250 submissions from members of the […]

Member only content (join now or login)

Have your say on proposed changes to New Zealand’s Privacy Act

by

The Privacy Amendment Bill (the Bill) amends the Privacy Act 2020. The key purpose of the Bill is to improve individuals’ transparency about the collection of their personal information and better enable them to exercise their privacy rights. The Bill addresses a current gap that arises because there is no requirement […]

Member only content (join now or login)

Privacy Framework Resource

by

The Information and Privacy Commission NSW has released an updated Privacy Governance Framework, designed to assist NSW public sector agencies implement robust privacy.  The Privacy Governance Framework is a dynamic tool designed to assist New South Wales public sector agencies implement robust privacy governance throughout their organisation to manage personal […]

Member only content (join now or login)

Privacy Act Review Report

by

The long awaited report reviewing Australia’s Privacy Act 1988 has been released by the Australian Government, proposing significant changes including individual rights modelled on the GDPR, such as the right to request erasure, and notification of databreaches to Office of the Australian Information Commissioner within 72 hours. Attorney-General Dreyfus’ statement […]

Member only content (join now or login)

Changes to Australia’s Privacy Act: Overview and Preparation Checklist

by

In the wake of the recent wave of high-profile data breaches at Optus, Medibank and MyDeal, the Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 was passed by Federal Parliament on 28 November 2022. The Attorney-General referred to the data breaches as having highlighted ‘the potential to cause serious financial and emotional harm […]

Member only content (join now or login)

Balancing Organisational Accountability and Privacy Self-management in APAC

by

The Asian Business Law Institute and Future of Privacy Forum has published a report providing a detailed comparison of the requirements for processing personal data in 14 jurisdictions in APAC including Australia, China, India, Indonesia, Hong Kong SAR, Japan, Macau SAR, Malaysia, New Zealand, the Philippines, Singapore, South Korea, Thailand, and […]

Member only content (join now or login)

OAIC Notifiable Data Breaches Scheme – The first 4 years

by

The Notifiable Data Breaches (NDB) scheme commenced in February 2018, introducing new obligations for Australian government agencies and private sector organisations with an annual turnover of $3 million AUD or more. Notably, under the NDB scheme organisations are required undertake an assessment should they suspect: 

  • Unauthorised access to or disclosure of personal information, or loss of personal information where access by unauthorised persons is likely to occur, 
  • Serious harm to the individuals to whom the information relates is likely to occur, and 
  • The risk of serious harm cannot be addressed through remedial action. 

If the assessment indicates that serious harm is likely to result from a data breach, they must notify the Office of the Australian Information Commissioner (OAIC) as well as all affected individuals so they can take action to address possible consequences and also. As data breaches and subsequent investigations are often significantly complex, an organisation or agency is given a baseline of 30 days to assess whether a data breach is likely to result in serious harm. However, once the organisation has formed the view that a data breach has occurred, individuals who may be seriously impacted by the data breach must be notified as soon as practicable. For example, in their recent data breach Optus has indicated that the assessment process took place over the course of no more than a couple of days prior to start of the notification process. 

The OAIC has published bi-annual reports summarising the details of reported data breaches since 2018 and this article examines some of the identifiable trends in these reports over the past four years. The OAIC report for the most recent 6-month period (Jan-Jun 2022) should be released in the next few weeks, however some released statistics from the impending report indicate that the observed trends discussed in this article continue through the most recent period. The full OAIC reports are available from https://www.oaic.gov.au/privacy/notifiable-data-breaches/notifiable-data-breaches-statistics, and further information is available on the OAIC website: https://www.oaic.gov.au/privacy/data-breaches.  

Organisations that fail to report a notifiable data breach can be subject to the same penalty as if they committed a serious or repeated breach of privacy, however organisations may look for a defensible reason to avoid reporting a breach as opposed to having to report a data security failure to the regulator. Even serious breaches where substantive personal data has been lost might be considered non-notifiable should the breached organisation feel they have undertaken sufficient remediation action which lessens the chance of serious harm.  

Ransomware attacks, one of the common externally perpetrated data breach events, have evolved in recent years to extend beyond holding data in an encrypted state and often now include the exfiltration of sensitive data from target organisations. Data is often held by the attacker, with the threat of publication on the dark web balanced against payment of the ransom. Should the breached organisation make payment of the ransom, the attacker generally will agree to delete the exfiltrated data. While it is essentially impossible to be certain that all copies of this data have been deleted, a breach organisation is likely to consider such an arrangement as sufficient “remediation” of the breach event in that the likelihood of the data being used in such a way that would cause serious harm to individuals is substantially reduced. In such circumstances, the breached organisation may choose not to report the incident to the OAIC, despite the severity of the initial data breach.

Breach Notification Trends 

Due to the complex nature of data breaches and reclassification of notifications over time, there is some variation in breach notification statistics between the time of OAIC publication and the present date. The stats shown in this article are taken from each quarterly/bi-monthly report which reflected notification data at the time of report publication, however it should be noted that breach statistics will have changed to a degree from what we have summarised from the OAIC reports. 

Over the past 4 years, there have been more than 3,500 reported data breaches, of which 60% were Malicious (or criminal), 35% were Human Error and 4% were due to System Faults. Taking into account that 2018 was a partial reporting year, approximately 1,000 breaches would have been reported to the OAIC across 2018 and 2019, with a slight uptick in 2020 and a substantial reduction in 2021. A summary of the data breach notifications made to the OAIC are displayed in the table immediately below 

Year  Breaches  Change  Malicious  Change  Human error  Change  System fault  Change 
20181  749    449    265    35   
2019  997  0%  625  +4%  329  -7%  43  -9% 
2020  1,057  +6%  627  0%  380  +16%  50  +16% 
2021  910  -14%  545  -13%  324  -15%  41  -18% 
Total  3,713    2,246    1,298    169   

 The table above also shows that malicious action breach incidents (combining both internal and externally originated) increased in 2019 compared against “non-malicious” breach types, however this trend was reversed in the following year. This was followed by was a slight reduction in all types of breach notifications in 2021. Overall, the OAIC NDB reports show a fairly flat trajectory over the length of the scheme.  

Conversely, US data on publicly reported data breaches over this time period shows year on year increases between 2018 and 2021, effectively doubling from 1,244 to 2,407 per year over this time period2. It is worth noting that data breach reporting requirements in the US vary from state to state and are substantially different to the Australian NDB scheme. However, the significant difference in the overall trend of breach reports is still interesting, particularly as the US Data indicate that the number and severity of malicious cyber-attacks appear to be increasing over time 3.  in contrast, the declining number of reported malicious breaches (as well as non-malicious breaches) in the Australian NDB data suggests there may be other systemic factors at play with regards to the number and type of breaches reported under NDB scheme.   

Number of individuals impacted by a breach 

As can be seen in the table below, the majority of data breaches tend to have low numbers of individuals affected by the breach. However, the number data breaches affecting large numbers of individuals remained fairly steady over the data period, indicating that a significant proportion of the Australian population is likely to have been impacted by a data breach throughout this time period. 

Year  Total Breaches  <1k  1k-5k  5k-10k  10k-25k  25k-50k  50k-100k  100k-250k  250k-500k  500k-1m  >1m  Unknown 
2018  749  638  61  15  9  1  4  4  1  0  2  14 
2019  997  834  74  19  16  7  5  5  2  0  5  30 
2020  1,057  890  90  12  13  14  6  2  4  2  7  13 
2021  910  787  71  12  15  7  5  4  2  1  4  2 
Total  3,692  3,149  296  58  53  29  20  15  9  6  16  59 

Kinds of personal information (PI) involved in breaches 

The majority of personal information present in data breaches was contact information, followed almost equally by financial and identity information. The proportions of personal information types present in data breaches has not changed significantly year to year, indicating that there has not been significant changes in the how organisations are holding or protecting particular types of personal information over this period.  

The higher number of breaches relating to contact information will be, to some degree, a function of the fact that only certain organisations need to hold more specific personal information about their customers. Despite the apparent lower impact from breaches relating to contact information, such data is still of substantial value for cyber-criminals for use in phishing and other targeted attacks, and may also be combined with information from other data breaches for more specific criminal use. 

Year  Contact Info  Financial Details  Identity Information  TFN  Health  Other sensitive information 
2018  647  335  273  186  148  61 
2019  817  398  293  255  157  85 
2020  890  408  439  272  184  134 
2021  803  376  432  256  184  140 
Total  3,157  1,517  1,437  969  673  420 

Maliciously originated breaches 

Most forms of malicious/criminal attack have been fairly consistent year-on-year, however ransomware in particular has been increasing year on year and 45% of all ransomware incidents occurred in 2021. The steady increase in this form of money-motivated cyber-attack aligns with anecdotal and industry reports of increases in this type of activity from organised cyber-criminal gangs and certain nation-state actors. 

It is interesting to consider the Optus data breach in the light of whether it would be considered a maliciously originated breach, a system fault, or a combination of both. While it certainly appears the case that a maliciously motivated individual or group has exfiltrated Optus customer data, the methods used remain a matter of debate and have not been fully confirmed by Optus or the federal government. Should it have been the case, an oversight which results in an API (Application Programming Interface) connected to a customer details database being left in an open state to external connections would almost certainly be viewed as a failure of internal systems and procedures. Optus’ CEO has indicated that the breach cause was not as straightforward as this, suggesting a more complex cause involving specific malicious technical action. 

Year  2018  2019  2020  2021  Total 
Malicious Breaches  449  625  627  545  2,246 
Theft paper/Storage  73  80  53  61  267 
Social Engineering  28  52  84  65  229 
Rogue Employee/Insider Threat  41  71  60  54  226 
Cyber (ALL)  307  422  430  365  1,524 
Cyber – Phishing  125  146  132  113  517 
Cyber – Stolen Credentials  79  140  108  100  426 
Cyber – Ransomware  18  29  69  86  202 
Cyber – Hacking  27  34  59  31  151 
Cyber – Brute  34  25  30  18  107 
Cyber – Malware  20  37  24  16  95 
Cyber – Other  5  10  9  2  26 

Human error breaches 

The majority of human error breaches are due to wrongly addressed emails, and this has been consistently the highest category, even with the 15% reduction in 2021.  Unlike malicious or systemic breaches, human error breaches – as classified by the OAIC – have limited technical controls that can be implemented to assist with prevention. Instead, education and procedure remain the best defence against these type of breaches. 

Year  2018  2019  2020  2021  Total 
Human Error Breaches  265  329  380  324  1,298 
Wrong email recipient  74  101  160  136  471 
Wrong hardcopy recipient  33  30  37  18  118 
Loss of hard/soft storage  34  40  25  23  122 
Unintended release/publication  41  76  62  71  250 
Failure to use BCC  22  18  30  25  95 
Failure to redact  14  19  20  23  76 
Unauthorised verbal disclosure  8  19  18  11  56 
Insecure disposal  8  5  2  0  15 
Wrong Recipient (Other)  19  21  25  17  82 
Other  12  0  1  0  13 

 

Business Sector Activity 

The Health, Finance and Business Services sectors collectively made up over 45% of all reported breaches in 2019 and 2020. In 2021, where a substantial reduction of breaches reports were made compared to previous periods, the combined breaches in there three sectors were still approximately 40% of the overall reports. Maliciously originated data breaches in the Legal, Accounting and Management sector was the only category to see a substantial rise in 2021, with almost all other types of breaches in these sectors seeing a decline from the previous year. 

Given the level of highly personal information held by Health sector organisations, the fact that these organisations feature so highly in the NDB statistics is of cause for specific concern. While federal and state legislation provides guidance for the collection, management and use of health data, as well as highlighting the highly confidential nature of such data, Australia currently does not have an equivalent to the US HIPA Act where substantive penalties and sanctions can be levied specifically pertaining to non-criminal use or loss of health data.

Sector  2019  2020  2021  Total 
Health – Malicious  111  97  87  295 
Health – Human Error  106  135  74  315 
Health – System Error  5  6  7  18 
Finance – Malicious  77  98  57  232 
Finance – Human Error  59  47  44  150 
Finance – System Error  10  11  12  33 
Legal, accounting & management – Malicious  60  42  61  163 
Legal, accounting & management – Human Error  25  22  24  71 
Legal, accounting & management – System Error  2  5  1  8 
Total  455  463  367  1285 

The OAIC provide details on the top 5 sectors reporting data breaches over each period. As only the Health, Finance and Legal, Accounting & Management sectors have consistently appeared in the periodic reports, and only the 2019-2021 reporting periods include complete data, only the data from those three sectors and three periods has been included in this analysis.  

 

Observations 

The OAIC official data breach statistics show an overall declining trend in reported breaches under the NDB scheme. On the surface this would potentially represent a good new story – in that organisations are becoming better at preventing data breaches and successful malicious attacks on organisations may becoming fewer. The counter-argument to this observation is the legal advice and remediation response organisations are using to inform their decisions on whether a breach falls under the NDB may have changed over time, resulting in fewer breaches being reported rather than fewer breaches actually occurring. 

The recent data breach incident at Optus has highlighted the widescale impact that a large data breach can have both on the breached organisation and the individuals to which the data belonged to. In terms of the scale, size and type of data that was taken, in addition to the media coverage, there would be little chance that any person assessing this breach would consider that it would not require mandatory reporting. However, in circumstances where a less comprehensive data set was exposed, with substantially fewer affected individuals, the potential for serious harm may not be considered as high, resulting in variable decisions to report.  

A smaller scope breach just involving loss of customer name and address information might be considered to hold lesser chance to cause serious harm by themselves. When such a breach is potentially remediated – say by payment of a ransom – it may be the case that an organisation feels that the breach no longer meets the threshold to require mandatory reporting and notification of affected individuals. However there is little in the way of guarantees that organisations can seek from cyber-criminals who hold exfiltrated data at ransom. The destruction of this data upon payment of a ransom is entirely in the control of the criminals and cannot be verified by the organisation.  

It is also worth noting that a somewhat “lesser” data breach containing names and addresses may be combined with data sets containing account details, passwords and identify information obtained from other breaches. In a similar way that de-identified “Big Data” sets hold the potential for  “re-identifcation” of individuals, combining multiple data sets residing on the dark web following successive breaches of different organisations results in a substantially higher chance of serious harm to affected individuals over time. As such, the OAIC and the Federal Government may wish to consider the provision of further guidance around notification requirements based on the type of data that exposed during a breach as well as what successful remediation of a breach should cover. 

The Optus data breach has also demonstrated that certain types of organisation are required for regulatory reasons to collect more personal information than others. There appears to be substantial uncertainty in the various regulations governing this requirement as to the length of time such information needs to be held and also as to how such information can be used and must be protected by the collecting organisation. Undoubtedly both Federal and State governments in Australia have observed this issue in recent weeks and it can be hoped that specific actions clarifying and improving regulatory requirements around collection, storage, use and disposal of personal information by Australian organisations will be forthcoming in the near future. 

 

Other obligations in reporting an NDB 

Organisations may have other obligations outside of those contained in the Privacy Act that relate to personal information protection when responding to a data breach. These may include data protection obligations under state-based or international data protection laws. Notably, Australian businesses may need to comply with the European Union’s (EU’s) General Data Protection Regulation (GDPR) if they have an establishment in the EU, if they offer goods and services in the EU, or if they monitor the behaviour of individuals in the EU. 

For data breaches affecting certain categories of information, other mandatory or voluntary reporting schemes may exist. For example, entities may need to consider reporting breaches to: 

  • the entity’s financial services provider 
  • police or law enforcement bodies 
  • the Australian Securities & Investments Commission (ASIC) 
  • the Australian Prudential Regulation Authority (APRA) 
  • the Australian Taxation Office (ATO) 
  • the Australian Transaction Reports and Analysis Centre (AUSTRAC) 
  • the Australian Cyber Security Centre (ACSC) 
  • the Australian Digital Health Agency (ADHA) 
  • the Department of Health 
  • State or Territory Privacy and Information Commissioners 
  • professional associations and regulatory bodies 
  • insurance providers.

Useful resources 

Office of the Australian Information Commissioner https://www.oaic.gov.au/privacy 

Australian Cyber Security Centre (ACSC) https://www.cyber.gov.au/ 

IDCare https://www.idcare.org/about-idcare/what-is-idcare 

Scamwatch https://www.scamwatch.gov.au/ 

MoneySmart https://www.moneysmart.gov.au/ 

The Office of the eSafety Commissioner https://www.esafety.gov.au/ 

Author

Dr Peter Chapman, Director, Forensic Technology – KPMG

Thank you to Matthew Golab, Director – Legal Informatics and R&D at Gilbert and Tobin, for his analysis of the OAIC reports and contribution to this article.

OAIC guidance on retention and deletion of PI

by

In July, OAIC published guidance on the retention and deletion of personal information (PI) collected during the COVID-19 pandemic. Organisations should take stock of the personal information they hold and assess whether it is necessary to continue to collect and retain PI.

Australian Privacy Principles 11.1 and 11.2 require that reasonable steps be taken to protect personal information and personal information be destroyed or de-identified once it is no longer needed.

If information is stored electronically, such as in cloud-based storage, servers, USBs or with a third-party provider, you should ensure that the digital records are permanently destroyed, including in any back-up system or offsite storage.

It is also important to consider whether employees require any training to ensure that personal information is securely destroyed.

In November, OAIC published the COVIDSafe privacy report in accordance with s 94ZB of the Privacy Act, which examined compliance and risk throughout the ‘information lifecycle’ of COVID app data collected during the pandemic. Read the COVIDSafe Report May–November 2022 here.

OAIC’s guidance on vaccination status and protecting privacy

by

OAIC has updated its guidance on COVID-19: Vaccinations and privacy rights as an employee and Vaccinations: Understanding your privacy obligations to your staff. Key points include: Vaccination status information can only be collected without consent in circumstances where the collection is required or authorised by law (including a state or territory […]

Member only content (join now or login)

New Zealand’s Privacy Commissioner releases a paper on biometric regulation

by

New Zealand’s Office of the Privacy Commissioner (OPC) has released a position paper setting out how the Privacy Act regulates biometrics.  The increasing role of biometric technologies in the lives of New Zealanders has led to calls for greater regulation of biometrics. In a statement releasing the paper, the OPC said, ‘[it] believes […]

Member only content (join now or login)