Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright size-medium wp-image-4849" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2017/03/DPM-03-07-2017-300x276.jpg" alt="Australia Map" width="300" height="276" />On February 13, 2017, the Australian Senate passed a bill establishing a mandatory requirement to notify the Privacy Commissioner and affected individuals of “eligible” data breaches. The <a href="https://www.legislation.gov.au/Details/C2017A00012"><em>Privacy Amendment (Notifiable Data Breaches) Act 2016</em></a>, which was passed by the House of Representatives the previous week, amends Australia’s <a href="https://www.legislation.gov.au/Details/C2016C00979">Privacy Act 1988</a> and is slated to take effect on February 22, 2018 if no earlier date is proclaimed.

The new law introduces a data breach notification scheme that obligates all agencies and businesses that are regulated by the Privacy Act to provide notice to the Office of the Australian Information Commissioner (OAIC) and affected individuals of certain data breaches that are “likely” to result in “serious harm.”

An <a href="http://parlinfo.aph.gov.au/parlInfo/search/display/display.w3p;query=Id%3A%22legislation%2Fems%2Fr5747_ems_ed12b5bb-d3b3-4a6a-9536-53bb459a00df%22">explanatory memorandum</a> accompanying the law indicates that “serious harm” is “likely” if it is more probable than not, and lists factors to consider when making the determination, such as the sensitivity of the information involved, whether the information was protected, who may have obtained the information, and the nature of the harm that could result. Although “serious harm” is not defined, the explanatory memorandum states that serious physical, psychological, emotional, economic, reputational or financial harm may qualify, as well as other types of serious harm that reasonably could result from the breach.

A failure to notify that is found to constitute a serious interference with privacy under the Privacy Act may result in a fine of up to AU$360,000 (about US$274,560) for individuals or AU$1.8 million (about US$1.37 million) for organizations.

Prior to the passage of this bill, the OAIC had a voluntary breach notification system in place and had published a <a href="https://www.oaic.gov.au/agencies-and-organisations/guides/data-breach-notification-a-guide-to-handling-personal-information-security-breaches">best practice guide</a> that will be updated prior to implementation of the mandatory notification requirement. According to a <a href="https://www.oaic.gov.au/media-and-speeches/statements/mandatory-data-breach-notification">statement</a> issued by Australian Privacy and Information Commissioner Timothy Pilgrim, from 2015 to 2016 the OAIC received 107 voluntary data breach notifications.

Australia’s New Breach Notification Law Set to Take Effect February 2018