Privacy & Information Security Law Blog

On February 13, 2017, the Parliament of Australia passed legislation that amends the Privacy Act of 1988 (the “Privacy Act”) and requires companies with revenue over $3 million AUD ($2.3 million USD) to notify affected Australian residents and the Australian Information Commissioner (the “Commissioner”) in the event of an “eligible data breach.”

The Privacy Act defines “personal information” to include “information or an opinion about an identified individual, or an individual who is reasonably identifiable (1) whether the information or opinion is true or not; and (2) whether the information or opinion is recorded in a material form or not.”

The new legislation includes a harm threshold for determining what constitutes an “eligible data breach,” which is defined as occurring when:

• (1) “there is unauthorized access to, or unauthorized disclosure of, the [personal] information” and (2) “a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates”; or
• “the information is lost in circumstances where:
  • (1) unauthorized access to, or unauthorized disclosure of, the information is likely to occur; and
  • (2) assuming that unauthorized access to, or unauthorized disclosure of, the information were to occur, a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates.”

The new legislation does not define “serious harm,” but an official explanatory memorandum states that serious harm could include “serious physical, psychological, emotional, economic and financial harm, as well as serious harm to reputation.” In determining whether serious harm has occurred, entities may consider the sensitivity of the information involved, the kind of person who might gain access to the information and the nature of the harm that may result from the breach.

The explanatory memorandum lists the following examples of breaches that may require notification:

• a malicious breach of the secure storage and handling of information (e.g., in a cybersecurity incident);
• accidental loss (most commonly of IT equipment or hard copy documents); and
• negligent or improper disclosure of information.

Pursuant to the new legislation, if an entity suspects that an eligible data breach has occurred, it must take “all reasonable steps to ensure” that it completes an assessment of the incident within 30 days following discovery. This is not a hard deadline, but a preferable timeframe that may be adjusted depending on the complexity of the incident. If the assessment determines that an eligible data breach has occurred, entities must notify the Commissioner and affected individuals “as soon as practicable.”

Notification to both the Commissioner and affected individuals must include:

• the identity and contact details of the entity;
• a description of the serious data breach;
• the kinds of information possibly breached; and
• recommendations about the steps that individuals should take in response to the serious data breach.

The explanatory memorandum states that an entity may notify affected individuals using the method of communication it normally uses to communicate with those individuals.

In addition, there is an exception to notification for situations where the entity takes remedial action before the access or disclosure results in serious harm. The new legislation also contains a “secrecy” provision exception, which states that where compliance with the notification requirement would be inconsistent with a provision under Australian law (other than the Privacy Act) that prohibits or regulates the use or disclosure of information, the notification requirement would “be limited to the extent of the inconsistency.”

A failure to notify that is found to be a serious or repeated interference with privacy under the Privacy Act can be penalized with a fine of up to $360,000 AUD ($274,560 USD) for individuals and $1.8 million AUD ($1.37 million USD) for organizations.

Although the effective date for the new legislation has yet to be set, the new notification requirements will come into force at the latest one year after the receiving Royal Assent, which typically occurs seven to ten days after Parliament passes a bill.