Privacy compliance and data breach risk management is too often not taken seriously enough by Australian organisations. With the recent increase in penalties for repeated or serious privacy breaches – from $2.22 million to the greater of AU$50 million, or three (3) times the value of any benefit obtained through the misuse of information, or 30 percent of a company’s adjusted turnover in the relevant period – businesses cannot afford to be complacent about privacy compliance.
The complexity of organisational structures and IT business systems in many instances results in management not knowing what data is collected by the business as a whole and how the data is managed and stored. Privacy policies often do not accurately reflect how the organisation manages personal information, that is:
- The kind of personal information that the organisation collects and holds;
- How the organisation collects and holds the personal information;
- The purpose for which the organisation collects, holds, uses and discloses personal information;
- For how long the personal information is needed by the organisation and whether/when it should be destroyed or deidentified;
- Whether the organisation outsources the handling of personal information to third party service providers and contractors;
- Whether the personal information is likely to be disclosed to an overseas recipient and where that recipient is located;
- How individuals can access information about them and seek correction or lodge a complaint about a breach.
Data breaches can have significant impact on the businesses and result in:
- Business disruption
- Significant costs in responding to a data breach
- Reputational damage
- Loss of valuable intellectual property/confidential information
- Loss of business and revenue
- Reduction in capital/share value of the business
- Substantial costs in regaining consumer confidence that the organisation can be trusted with personal information/data
- Regulatory fines and penalties
- Compensation claims by individuals/class actions.
OAIC Data Breach Statistics
The NDB scheme under the Australian Privacy Act commenced on 22 February 2018. The scheme requires mandatory notification by organisations[i] of a privacy data breach that is likely to result in “serious harm” to the individual whose personal information held by that organisation has been the subject of an unauthorised access, disclosure or loss of personal information.[ii]
The OAIC, which is responsible for compliance with the NDB scheme, has recently published its NDB Report for the period from January to June 2023.[iii]
The OAIC Report provides statistics of notifiable data breaches together with valuable insights and learnings on the trends emerging under the NDB scheme. These statistics also provide very useful information for the risk assessment and potential organisational exposure to data breaches.
During the 6 months from 1 January 2023 to 30 June 2023 the OAIC received 409 notifications of eligible data breaches under the NDB scheme – a 16% decrease in the number of data breach notifications, compared to the previous 6-month period (during which 497 data breach notifications were received) with one of these data breaches impacting more than ten million Australians’ personal information, for the first time since the scheme began in 2018[iv]. The highest number of notifications during the period were received during the month of March (100 notifications) with the proportion of all notifications (288 notifications or 70% of all notifications) attributed to malicious or criminal attack – a decrease of 15% on the number of malicious or criminal attack notifications made during the previous 6 months.
Once again, the majority of notified breaches during this period affected fewer than 100 people (63% of all notifications) – with 177 of these notifications impacting only 1 to 10 individuals. There were also 28 breaches that affected over 5,000 Australians during this period, compared with 40 during the last reporting period. Significantly, 7 of the notifications reported during this reporting period affected over 1 million Australians (compared with 5 in the previous reporting period),[v] with 1 of them affecting over 10 million people –the first breach notified under the NDB scheme to affect more than 10 million Australians.[vi]
Other key findings and trends during the 6-month period ending 30 June 2023 include: –
- Twenty-one (21) of the 23 breaches that affected over 5,000 Australians were caused by cyber incidents;
- The top two (2) data breach reporting sectors (under the NDB scheme) were, once again, Health service providers (63 notifications) followed by Finance (54 notifications – including superannuation).
- Across all sectors, and consistent with previous reporting periods, the majority of notified data breaches (87%) involved ‘contact information’ (such as an individual’s home address, phone number or email address) while 64% of the notified data breaches involved ‘identity information’ (such as an individual’s passport and/or driver licence numbers or other government identifiers). In addition, 40% of notified data breaches involved ‘financial details’ (such as bank account or credit card details).
- Once again, the time taken by entities to identify breaches varied depending on the source of breach. During this reporting period 81% of human error breaches were identified within 30 days (the fastest to be identified) while system fault breaches were the slowest to be identified – with 14% not identified “for over a year”.[vii]
- Across all sectors, the time between when an entity became aware of an incident and when they notified the OAIC (and affected individuals) remained very similar to the time taken during the previous reporting period – with 78% of breaches being identified by the entity within 30 days of it occurring (compared to 77% during the previous period).
- Malicious or criminal attacks (288 notifications or 70% of all notifications) and human error (107 notifications or 26% of all notifications) continue to be the cause of the majority of the reported breaches.
- There was a small decrease in the number of data breaches attributed to human error (compared to the previous 6-month period) – 107 notifications, down from 123 – accounting for 26% of the data breaches while similarly, data breaches attributed to malicious or criminal attack also decreased (to 288 notifications, down from 340), accounting for 70% of them.
- The largest source of malicious or criminal attacks notifications during the period, involved cyber security incidents (42% or 172 of all notifications). These included ransomware (31%), compromised or stolen credentials (29%), phishing (19%), hacking (9%), malware (8%) and brute force attack (4%).
- Cyber incidents reported to the OAIC during the period affected 319,761 individuals on average – a significantly higher number of individuals worldwide compared to other types of breaches caused by malicious or criminal attack.[viii]
- With nearly 1 in 5 data breaches during this reporting period caused by social engineering or impersonation, the OAIC is strongly encouraging all entities to remain vigilant and to review and strengthen their access security measures, including identity management and authentication.[ix]
- Noting the evolution and increase in remote and hybrid work and related working environments during the last three years the OAIC strongly encourages entities and employers “to conduct a privacy impact assessment and address identified risks arising from their employees’ and contractors’ work environments” [x] .
- The OAIC’s Australian Community Attitudes to Privacy Survey (ACAPS) 2023 revealed that “three-quarters (74%) of Australians feel data breaches are one of the biggest privacy risks they face today” while “a quarter (26%) of Australians believe the most important step is for organisations to only collect the information necessary to provide the product or service” with the second most important thing that organisations can do considered by 24% to be the taking of “proactive steps to protect the information they hold”.[xi]
- Further to new and increased regulatory powers[xii] provided to the Privacy Commissioner by the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (Cth), the OAIC is prioritising regulatory action in instances of “serious or repeated non-compliance with the requirements of the NDB scheme”.[xiii]
- The last 12 months have seen an increase in the number of data breaches affecting more than one/multiple entities resulting in the OAIC receiving multiple notifications relating to the same incident.[xiv]
- Constantly evolving and increasingly sophisticated scams and cyber security incidents.
Data breaches caused by human error (26% of data breaches in this reporting period) can be avoided by staff awareness and training. These kinds of data breaches can affect larger numbers of individuals. The OAIC noted that “Entities should assume human error will occur and design for it”.[xv]
The major causes of human error breaches during this reporting period include:
- Personal information sent by email or mail to the wrong recipient (46%).
- Unauthorised disclosure (unintended release or publication or failure to redact) – (25%), and unauthorised verbal disclosure (3%).
- Failure to use ‘BCC’ when sending emails – with an average of 453 individuals affected per breach in this category or 7%.[xvi]
- Loss of paperwork/data storage device (9%); and
- Insecure disposal of personal information (1%).
In many cases unauthorised disclosure of confidential information or data occurs because employees do not have an adequate understanding of the type of data/information that is protected under the Privacy Act and other laws for the protection of confidential information/data and the organisation’s obligations under those laws in relation to data protection from unauthorised disclosure, use and loss. Many of the human error data breaches can be avoided by appropriate ongoing staff training in data protection and privacy compliance and handling of information.
Minimising Risk of Data Breaches – Steps to Assist in Data Protection
There is no single solution for the protection of data and compliance with data protection laws. A whole of business approach is required. People are the most important part of the process and solution, followed by technology. Safeguards against unauthorised use, disclosure, theft, cyber-attacks, industrial espionage and sabotage of IT system have to be agile and updated to deal with evolving and increasing sophistication of cyber-attacks or cyber incidents. There are also additional risks to be considered where an organisation outsources the handling of personal information to service providers and contractors.
Some steps that Organisations may consider taking to minimise risk and harm and to protect confidential information/data:
- Understand what type of data, including confidential information and personal and sensitive information, is collected and managed by the organisation and who is authorised to access this information and whether the collection is necessary. An audit of the organisational data collection and flow may be required. Legal advice may also be required.
- Undertake ongoing reviews and assessments of the organisational and technological data flows, storage (including location of storage) and risks – as well as ongoing reviews of whether personal information is still needed and if it should be destroyed or deidentified[xvii].
- Have all staff sign non-disclosure/confidentiality agreements and provide appropriate training.
- Ensure that the organisation’s information governance framework covers contractors and service providers that have access to or handle personal information on the entity’s behalf[xviii].
- Implement and update appropriate security measures for the protection of confidential information/data (including when emailing sensitive personal information). Measures and controls could include encryption, password protection, multi-facet authentication and monitoring of data flows.
- Have a cyber-security expert assess and monitor your computer system for potential vulnerabilities to cyber-attacks and implement appropriate measures to deal with risks.
- Implement and update appropriate technological measures to deal with possible cyber threats including viruses, ransomware, malware, hacking and other cyberattacks.
- Develop and implement a data breach response plan which implements the requirements of the NDB scheme and includes guidelines for ‘best practice’ post-breach communication to affected individuals for reduction of ‘harm’ to both the affected individuals and the entity;
- Keep up to date in relation to the latest scams and cyber threats including identification/impersonation fraud or social engineering, phishing emails and telephone calls requesting passwords and other personal information and keep management and employees updated. Useful resources for such updates include:
- Stay Smart Online – an online alert service which provides alerts on the latest threats and information on how to reduce the risk of cyber threats
- ACCC Scam watch
- Australian Cyber Security Centre (ACSC) – including the ACSC’s cyber security defence strategies guidance[xix], cyber incident response plan guidance, template and checklist[xx];
- Australian Cybercrime Online Reporting Network (Acorn)
- Office of the Australian Information Commissioner (OAIC) – including the OAIC’s guidance on securing personal information[xxi] and on data breach preparation and response[xxii]
- Australian Securities & Investments Commission (ASIC) – including ASIC’s guidance on cyber security resilience[xxiii]
- Education and training of management and employees on commencement and then “at least annually”[xxiv] – including on:
- data handling practices;
- how to report suspected privacy breaches; and
- how to communicate a data breach to affected individuals – to minimise harm to the entity and the affected individuals.
Disclaimer: This legal update is not intended to be a substitute for obtaining legal advice.
Authored by Katarina Klaric, Principal, Stephens Lawyers & Consultants. The contribution of Rochina Iannella, Lawyer, is acknowledged in the research and update of this Legal Update.
© Stephens Lawyers & Consultants. 3 October 2018 – Updated 12 September 2020, 10 August 2021 and 2 May 2023; Updated 28 November 2023
For further information contact:
Katarina Klaric
Principal
Stephens Lawyers & Consultants
Melbourne Head Office
Suite 205, 546 Collins Street, Melbourne VIC 3000
Phone: (03) 8636 9100
Sydney Office
Level 29, Chifley Tower, 2 Chifley Square, Sydney, N.S.W. 2000
Phone: (02) 9238 8028
Email: [email protected]
Website: www.stephens.com.au
All Correspondence to:
PO Box 16010
Collins Street West
Melbourne VIC 8007
To register for newsletter updates and to send your comments and feedback, please email [email protected]
[i] Under the scheme, any organisation or government agency covered by the Privacy Act 1988 (Cth) that experiences an eligible data breach must notify affected individuals and the OAIC.
[ii] Privacy Act 1988(Cth) s 26 WE(2)
[iii] Office of the Australian Information Commissioner Notifiable Data Breaches Report: January to June 2023 – Published 5 September, 2023
[iv] Office of Australian Information Commissioner, Media Release “Ongoing vigilance in data protection measures essential”, 5 September, 2023
[v] Office of the Australian Information Commissioner Notifiable Data Breaches Report: January to June 2023 at Page 10
[vi] Office of the Australian Information Commissioner Notifiable Data Breaches Report: January to June 2023, at Page 11
[vii] Office of the Australian Information Commissioner Notifiable Data Breaches Report: January to June 2023 at Page 14
[viii] Office of the Australian Information Commissioner Notifiable Data Breaches Report: January to June 2023 at Page 23
[ix] Office of the Australian Information Commissioner Notifiable Data Breaches Report: January to June 2023 at Pages 21, 22
[x] Office of the Australian Information Commissioner Notifiable Data Breaches Report: January to June 2023 at Page 18 – and OAIC’s guidance published at https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/privacy-impact-assessments/assessing-privacy-risks-in-changed-working-environments-privacy-impact-assessments
[xi] Office of the Australian Information Commissioner Notifiable Data Breaches Report: January to June 2023 at Page 9
[xii] Office of the Australian Information Commissioner Notifiable Data Breaches Report: January to June 2023 at Page 10 – – New regulatory powers include the power to require a person or an entity to provide information and documents relevant to a suspected or actual eligible data breach (sec 26WU)
[xiii] Ibid.
[xiv] Office of the Australian Information Commissioner Notifiable Data Breaches Report: January to June 2023 – at Page 28
[xv] Office of the Australian Information Commissioner Notifiable Data Breaches Report: January to June 2023 – at Page 14 – The OAIC noted that “Entities should assume human error will occur and design for it”
[xvi] Office of the Australian Information Commissioner Notifiable Data Breaches Report: January to June 2023 – at Page 26
[xvii] Office of the Australian Information Commissioner Notifiable Data Breaches Report: January to June 2023 – at Page 29
[xviii] Office of the Australian Information Commissioner Notifiable Data Breaches Report: January to June 2023 – at Page 27
[xix] https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight
[xx] https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/publications/cyber-incident-response-plan
[xxi] https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-securing-personal-information
[xxii] https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response
[xxiii] https://asic.gov.au/regulatory-resources/corporate-governance/cyber-resilience/
[xxiv] Office of the Australian Information Commissioner Notifiable Data Breaches Report: January to June2023 at Page 29