Consultation Paper - Draft Voluntary Information Security Breach Notification Guide - April 2008

Acknowledgements

The Office of the Privacy Commissioner acknowledges the informative work undertaken by the Office of the Privacy Commissioner of Canada, the Offices of the Information and Privacy Commissioner of British Columbia, Ontario and Alberta and the Office of the Privacy Commissioner of New Zealand in the area of privacy breach notification information and guidance. The draft Voluntary Information Security Breach Notification Guide presented in this consultation paper builds on the guidance material produced by those Offices.

PART A

About this Consultation Paper

1. Purpose

The aim of this consultation paper is to seek stakeholder views on a draft voluntary information security breach notification guide (the draft guide) developed by the Office of the Privacy Commissioner (the Office) to assist public sector agencies and private sector organisations to respond effectively to an information security breach.

The consultation paper appears in two main parts. This section (Part A) of the consultation paper provides background on breach notification as well as a number of questions which stakeholders may like to consider when commenting on the draft guide.

It is followed in Part B by the draft guide itself, which provides an outline of the key steps agencies and organisations should consider taking when responding to an information security breach, including considering breach notification to affected individuals.

2. Background

Information security breaches of personal information are a risk to individuals, agencies and organisations.  Over the past few years, incidents in Australia and overseas have illustrated the importance of adequate information security and the consequences that breaches can have. These consequences can include both adverse outcomes for individual privacy, and for the reputation and activities of agencies and organisations that were responsible for the information.

The serious nature of information security and the issue of what is the appropriate response to an information security breach have been highlighted by several major high-profile data breaches occurring in the United Kingdom and the United States which have collectively resulted in the loss of millions of people's personal information.

Such events are of particular concern with an increasing incidence of identity theft and identity fraud around the world, a concern reflected in the Australian community.  For example, the Office's Community Attitudes to Privacy 2007 research found that 60% of individuals are concerned about becoming a victim of identity fraud or theft, with 9% indicating they had been a victim themselves and 17% personally knowing someone who has been a victim.[1]

Countries have introduced a range of measures in an attempt to address these issues.  Following the introduction of breach notification laws in California in 2002, a further 40 states in the United States have introduced such laws.  The Commission of the European Communities also proposed the introduction of security breach notification provisions for network operators and internet service providers in its 2006 Review of the EU Regulatory Framework for electronic communications networks and services.[2] In Canada, privacy regulators at both the federal and provincial level have developed voluntary guidelines for responding to data breaches. New Zealand has also adopted guidelines developed along similar lines.

In Australia, the Privacy Act 1988 (Cth) (Privacy Act) does not specifically require an agency or organisation to notify individuals or the Privacy Commissioner of a breach of information security.  However the issue of an amendment to the Privacy Act to require mandatory data breach notification is under consideration as part of the Australian Law Reform Commission's (ALRC) review of privacy. 

In recognition of the global trends in this area and to respond to requests from agencies and organisations, the Office has developed a voluntary guide to assist agencies and organisations to respond to information security breaches and take steps to prevent such incidents from occurring.  The draft guide has been informed by voluntary guidelines adopted by the Privacy Commissioner of Canada and the New Zealand Privacy Commissioner.[3]

It is the Office's view that breach notification in certain circumstances is good privacy practice and reflects key privacy principles. In particular, notifying individuals of a breach to the security of their personal information allows individuals to take steps to protect their personal information. In this way notification can enhance an agency or organisation's transparency and openness with individuals; an important part of consumer trust and confidence. It would also provide a strong market incentive for agencies and organisations to adequately secure the personal information they hold.

3. Relationship of the draft guide to law reform proposals

The issue of information security breach notification laws for Australia is currently under consideration by the ALRC as part of its review of the Privacy Act.  In its 2007 Discussion Paper Review of Australian Privacy Law, the ALRC made a preliminary reform proposal for amendments to the Privacy Act to require agencies and organisations to notify affected individuals and the Privacy Commissioner of an information security breach in certain circumstances.[4] 

While the development of this draft guide precedes the ALRC's final recommendations from the review (due in the first half of 2008) and the Australian Government's consideration of those recommendations, this draft guide is not intended to be a substitute for further consideration of legislative reform in respect of mandatory breach notification.[5]

In this regard, given the benefits to individuals, organisations and agencies, the Office supports the introduction of an appropriate mandatory information security breach notification requirement for agencies and organisations.[6]

4. Some topics for consideration when commenting on the draft guide

The following questions provide possible issues for consideration when commenting on the draft guide. It is not mandatory to address these questions in your submission.

• 1. Is the terminology 'information security breach' appropriate? Would another term be more appropriate?
• 2. Are the steps in the draft guide adequate and easy to follow? In your opinion, are any steps missing?
• 3. Are the examples realistic and relevant? Are there any other specific scenarios that might warrant inclusion as a way of illustrating a particular aspect of breach notification?
• 4. What amendments could be made to improve the clarity and accessibility of the document? For example, how might the drafting, language and formatting of the document be made clearer?
• 5. Are there any details not contained in the draft guide that, in your view, need to be included?
• 6. Do you consider this a useful model for your own organisational or agency response to information security breaches?
• 7. Is the guidance on when, how and who to notify in the event of an information security breach clear? Are there further aspects to notification that would benefit from explanation?
• 8. Is the Privacy Commissioner's role in the notification process sufficiently clear? Would more or less information be useful?
• 9. Are there any terms in the draft guide that would benefit from definition?
• 10. Are there any other issues you would like to raise?

Comments on the consultation paper may be emailed to consultation@privacy.gov.au.  Alternatively, they may be posted to:

Information Security Breach Notification Consultation
Office of the Privacy Commissioner
GPO Box 5218
Sydney NSW 2001

If you would like to discuss the consultation paper, please contact us on
1300 363 992.
Comments are invited by 16 June 2008.

PART B

Draft Voluntary Information Security Breach Notification Guide - April 2008

1. The purpose of this guide

This guide has been developed to assist agencies and organisations to respond effectively to an information security breach. In particular, the guide explains when an effective response to an information security breach might include notification of individuals affected by the breach.

The Office has developed this guide to respond to requests from agencies and organisations and in recognition of the global trends towards breach notification.  Breach notification has been introduced as law in many states in the United States and is being considered by other countries including Australia. This voluntary guide has been informed by voluntary guidelines developed by the Privacy Commissioner of Canada and the Privacy Commissioner of New Zealand.[7]

2. Scope of this guide

Breach notification is one particular option in responding to an information security breach.  However a key challenge is to determine in what circumstances it is an appropriate response.  While establishing appropriate thresholds for requiring breach notification can be considered good privacy practice, the steps and actions outlined in the guide are not specifically required under the Privacy Act 1988 (the Privacy Act). Therefore, compliance with this guide is voluntary.

The aim of this guide is to provide general guidance on key steps and factors for agencies and organisations to consider when responding to an information security breach, without the sole focus being notification of breaches.  In this way the guide encourages a risk-analysis approach so that agencies and organisations evaluate an incident on a case-by-case basis and make decisions on actions to take according to their own assessment of risks and responsibilities in their particular circumstances.

The guide also highlights the importance of preventative measures as part of a holistic information security plan.

It is important to note that, while the guidance is not mandatory and is of an advisory nature only, agencies and organisations do have binding legal obligations under the Privacy Act to secure personal information, as set out in the Information Privacy Principles (IPPs) and National Privacy Principles (NPPs).

3. Who should use this guide?

This guide has been developed for use by Australian and ACT Government agencies and private sector 'organisations'[8] that handle personal information. As well as businesses, organisations in the not-for-profit, community and charity sectors may find the guide useful.

The guide may also be useful to small businesses that have obligations under Part IIIA of the Privacy Act.

Government agencies of the states and the Northern Territory, as well as private sector businesses not covered by the Privacy Act, may find the guide helpful in outlining good privacy practice.  However, the Privacy Commissioner would not have a role in receiving notifications about information security breaches from these entities. 

State and Northern Territory government agencies should also consider the role of relevant Privacy or Information Commissioners in their own jurisdictions.

4. What is an information security breach?

An information security breach occurs when personal information is exposed to unauthorised access, use, disclosure or modification as a result of a breach of an agency's or organisation's information security.

Information security breaches can occur in a number of ways.  Some of the most common information security breaches happen when personal information held by an agency or organisation is lost, misused, mistakenly disclosed or stolen.  Some examples include:

• laptops, removable storage devices, or physical files containing personal information becoming lost or stolen
• an agency or organisation mistakenly providing personal information to the wrong person, for example by sending details out to the wrong address
• an individual deceiving an agency or organisation into improperly releasing the personal information of another person
• databases containing personal information being 'hacked' into or otherwise illegally accessed by individuals outside of the agency or organisation and
• employees accessing personal information outside the requirements of their employment.

It is important to recognise that information security breaches are not limited to external malicious actions, such as theft or 'hacking', but may just as often involve internal errors and failures to follow established information handling procedures.  While there may be no harm intended, these types of security breach can affect individuals' privacy as much as malicious actions.

Although a key concern relating to information security breaches is the risk of identity theft or fraud (particularly where credit card information is compromised), the risks from information security breaches are not limited to financial harm-for example, leaks of details about an individual's personal affairs or health information can cause other types of harm such as humiliation, damage to reputation or relationships and loss of business or employment opportunities.

4.1   Terminology-'data', 'privacy' or 'security' breaches?

A range of jurisdictions have adopted laws or guidelines in relation to breach notification.  As a result, a range of different terminology has been adopted, with terms such as 'data breach', 'privacy breach' and 'security breach' being used.

This guide uses the term 'information security breach', for two main reasons.  Firstly, the reference to 'information' reflects the focus of the Privacy Act on the protection of 'personal information', and is used in preference to the term 'data' which is generally not used in the language of the Privacy Act. [9]  Secondly, the reference to 'security' emphasises that security is one particular aspect of protecting information privacy, and is used in preference to the term 'privacy breach' which could be construed more broadly as encompassing breaches of other privacy principles, for example, the obligations on agencies and organisations to keep information accurate, complete and up to date.

5. Preventing information security breaches

Information security is a basic principle in the protection of information privacy.[10]  In Australia, this principle is reflected in the Privacy Act in both the IPPs and the NPPs. 

5.1   Obligations under the Privacy Act

The IPPs regulate the way most Australian and ACT Government agencies handle personal information.  These principles cover the collection, storage, use, disclosure and access obligations of those agencies. 

The NPPs regulate the way private sector organisations handle personal information.  These principles cover collection, storage, use, disclosure and access obligations of organisations covered by the Privacy Act.  In general the NPPs apply to all businesses and non government organisations with a turnover of more than $3 million, all health service providers and a limited range of small businesses.[11]

Agencies and organisations are required to take reasonable steps to protect the personal information they hold from misuse and loss and from unauthorised access, modification or disclosure.  This requirement is set out in IPP 4 for public sector agencies and NPP 4 for private sector organisations.[12] (See Appendix A for IPP 4 and NPP 4.)

In addition, section 18G(b) of the Privacy Act imposes equivalent obligations on credit reporting agencies and all credit providers. Similarly, guideline 6.1 of the statutory guidelines regulating Tax File Numbers (TFN) requires TFN recipients to afford TFNs security safeguards as are reasonable in the circumstances.

5.2   Other obligations

Many agencies are subject to agency-specific legislative requirements that add further privacy protections (such as secrecy provisions), as well as legislative and other requirements which apply more generally across government.[13]

Organisations may also be subject to additional obligations through sectoral specific-legislation in respect of particular information they hold.  For example, Part 13 of the Telecommunications Act 1997 (Cth) sets out obligations on the telecommunications industry in relation to the handling of certain telecommunications-related personal information.  Some organisations may also have common law duties relating to confidentiality of particular information. 

These additional obligations need to be considered by agencies and organisations when taking steps to prevent or respond to information security breaches.

5.3   Considerations for keeping information secure

While the focus of the guide is the process of responding to an information security breach agencies and organisations should aim to avoid such breaches in the first place by ensuring that they have appropriate security safeguards in place consistent with IPP 4 or NPP 4.

What are reasonable steps to secure personal information will depend on the agency or organisation's particular circumstances.  Generally, the steps agencies and organisations should take to keep personal information secure should be proportionate to the type of the information held, how it is held and what risks could be associated with its mishandling.  Some relevant factors could include:

• the sensitivity to the individual of the personal information the organisation holds
• the harm that is likely to result to people if there is a breach of security
• how the agency or organisation stores, processes and transmits the personal information (for example, paper-based or electronic records, or using a third party service provider).

Appropriate security safeguards for personal information need to be considered across a range of areas.  This could include maintaining physical security, computer and network security, communications security and personnel security.  To meet their information security obligations, agencies and organisations should consider the following steps: 

• risk assessment - identifying the security risks to personal information held by the organisation and the consequences of a breach of security
• policy development - developing a policy or range of policies that implements measures, practices and procedures to reduce the identified risks to information security
• staff training - training staff and managers in security awareness, practices and procedures
• technology - implementing privacy enhancing technologies to secure personal information held by the agency or organisation
• monitor and review - monitoring compliance with the security policy, periodic assessments of new security risks and the adequacy of existing security measures, and ensuring that effective complaint handling procedures are in place
• standards - looking at relevant Australian and international standards as a guide and
• privacy impact assessments and audits- evaluating, in a systemic way, the degree to which proposed or existing information systems align with good privacy practice and legal obligations.

In seeking to prevent information security breaches, agencies and organisations should consider their other privacy obligations under the IPPs and NPPs.  Some breaches or risks of harm can be avoided or minimised by not collecting particular types of personal information or only keeping it for as long as necessary.  Consider:

• What personal information is necessary to be collected? Simply put, personal information that is not collected can not be mishandled, so why risk collecting unnecessary information? Both IPP1 and NPP1 require that agencies only collect personal information that is necessary for one or more of its functions or activities. IPP 3 also requires that a collector of personal information take steps to ensure that the information collected is relevant to the purpose for which it was collected.
• How long does the personal information need to be kept? NPP4.2 requires organisations to securely destroy or permanently de-identify information that is no longer needed for the permitted purposes for which it may be used or disclosed. Although the IPPs do not contain a similar obligation, agencies should nevertheless consider retention practices, subject to other applicable record-keeping requirements.

6. Why breach notification is good privacy practice

Both the Information Privacy Principles (IPPs) and the National Privacy Principles (NPPs) in the Privacy Act 1988 require that personal information be held securely. Failure to comply with security principles constitutes an interference with privacy under the Privacy Act.

The Privacy Act does not specifically require an agency or organisation that holds personal information to notify individuals or anyone else (such as the Privacy Commissioner) if personal information becomes accessible to unauthorised persons as a result of a breach of information security safeguards.  However, notifying individuals where an information security breach affects their personal information is consistent with important privacy principles, as can be seen in the following points: 

• Notification as a reasonable security safeguard: As part of the obligation to keep personal information secure,[14] notification may in some circumstances be considered as a reasonable step in the protection of personal information against misuse, loss or unauthorised access, modification or disclosure.
• Notification as openness about privacy practices: Being open and transparent with individuals about how personal information may be handled is recognised as a fundamental privacy principle.[15] Part of being open about the handling of personal information may include telling individuals when something goes wrong and explaining what has been done to try to avoid or remedy any actual or potential harm.
• Notification as restoring control over personal information: Privacy is valued, not only because it underpins our human dignity but also because it gives individuals a measure of control in their everyday interactions as to how personal information about them is handled. To this end, the Privacy Act seeks to ensure that individuals know why information is collected, what it is used for, who it is ordinarily disclosed to and provides for rights of access and correction.[16]

Notification of a breach in appropriate circumstances is consistent with good privacy practices and is to be encouraged in maintaining a community in which privacy is valued and respected.  The main challenge is to determine what circumstances justify notification. This includes giving consideration to factors such as the type of personal information involved in the breach and the risk of harm to individuals amongst other things.

7. Four key steps in responding to a breach

Information security breaches can be caused by a variety of factors, affect different types of personal information and give rise to a range of actual or potential harms to individuals, agencies and organisations. 

Given this context, it is clear that there is no single way of responding to an information security breach.  Each incident will need to be dealt with on a case-by-case basis, undertaking an assessment of the risks involved, and using that risk assessment as the basis for deciding what actions to take in the circumstances.

Each of the steps is set out in further detail below.

General tips:

• Be sure to take each situation seriously and move immediately to contain and assess the suspected breach. Breaches that may initially seem immaterial may be significant when their full implications are assessed.
• You should undertake steps 1, 2 and 3 either simultaneously or in quick succession. Step 4 provides recommendations for longer-term solutions and prevention strategies.
• The decision on how to respond should be made on a case-by-case basis. Depending on the incident, not all steps may be necessary, or some steps may be combined.

STEP 1: Contain the breach and do a preliminary assessment

Once you have discovered or suspect that an information security breach has occurred, you should take immediate common sense steps to limit the breach. For example:

• Immediately contain the breach. For example, stop the unauthorised practice, recover the records, shut down the system that was breached, revoke or change computer access codes or correct weaknesses in physical or electronic security.
• Designate an appropriate individual to lead the initial assessment. This individual should have sufficient authority to conduct the initial investigation, gather any necessary information and make initial recommendations. If necessary, a more detailed evaluation may subsequently be required.
• Determine the need to assemble a team which could include representatives from appropriate parts of the agency or organisation.
• Determine who needs to be made aware of the incident internally, and potentially externally, at this preliminary stage. Escalate internally as appropriate including informing the person within your agency or organisation responsible for privacy compliance.
• If the breach appears to involve theft or other criminal activity, notify the police. Do not compromise the ability to investigate the breach.
• Be careful not to destroy evidence that may be valuable in determining the cause or would allow you to take appropriate corrective action.

STEP 2: Evaluate the risks associated with the breach

To determine what other steps are immediately necessary you should assess the risks to the individual associated with the breach. 

Consider the following factors in assessing the risks:

• (a) What personal information is involved?
• (b) What is the cause and extent of the breach?
• (c) Who is affected by the breach?
• (d) What is the risk of harm that could result from the breach?

These factors are further expanded in the table below:

STEP 3: Consider notification

Notification can be an important mitigation strategy that has the potential to benefit both the agency or organisation and the individuals affected by a breach.  The challenge is to determine when notification is appropriate.  Each incident needs to be considered on a case-by-case basis to determine whether breach notification is required. 

In general, if an information security breach creates a real risk of serious harm to the individual, those affected should be notified. 

Prompt notification to individuals in these cases can help them mitigate the damage by taking steps to protect themselves.  You should:

• take into account the ability of the individual to take specific steps to mitigate any such harm.
• consider whether it is appropriate to inform the Privacy Commissioner of the information security breach or anyone else, such as the police, other regulators or professional bodies.

(a) Deciding whether to notify affected individuals

A key consideration in deciding whether to notify affected individuals should be whether notification is necessary in order to avoid or mitigate serious harm to an individual whose personal information has been inappropriately accessed, collected, used or disclosed. 

You should consider the following factors when deciding whether to notify:

• What is the risk of serious harm to the individual as determined by step 2?
• What is the ability of the individual to avoid or mitigate possible harm if notified of a breach (in addition to steps taken by the agency or organisation)? For example, would an individual be able to have a new bank account number issued to avoid potential financial harm resulting from a breach?
• What are the legal and contractual obligations?
• What are the consequences of failing to notify affected individuals? If individuals subsequently find out about the breach through the media for example, what could be the associated loss of trust that your agency or organisation sustains?

(b) Process of notification

At this stage, you should have as complete a set of facts as possible and have completed your risk assessment in order to determine whether to notify individuals.  The following tables set out some of the considerations in the process of notification:

(c) What should be included in the notification?

The content of notifications will vary depending on the particular breach and the method of notification chosen.  In general, the information in the notice should help the individual to reduce or prevent the harm that could be caused by the breach.  Notifications should include the types of information detailed in the table below.

(d) Others to Contact

In general, notifying the Office, other authorities or regulators should not be a substitute for notifying individuals. However, in some circumstances in may be appropriate to notify these third parties.

STEP 4: Prevent future breaches

Once the immediate steps are taken to mitigate the risks associated with the breach, agencies and organisations need to take the time to investigate the cause of the breach and consider whether to develop a prevention plan.

A prevention plan should suggest actions which are proportionate to the significance of the breach and whether it was a systemic breach or an isolated instance.

This plan may include the following:

• a security audit of both physical and technical security
• a review of policies and procedures and any changes to reflect the lessons learned from the investigation and regularly after that (for example, security, record retention and collection policies)
• a review of employee training practices and
• a review of service delivery partners (eg. dealers and retailers).

The resulting plan may include a requirement for an audit at the end of the process to ensure that the prevention plan has been fully implemented.

Some suggestions for being prepared to respond to a breach are: 

• Develop a breach response plan: while the aim should be to prevent breaches, having a breach response plan may assist in ensuring a quick response to breaches, and greater potential for mitigating harm from the breach.
  A plan could set out contact details for appropriate staff that should be notified; clarify the roles and responsibilities of staff; and document processes for the agency or organisation to contain breaches, coordinate investigations and breach notifications and cooperate with external investigations.
• Depending on the size of the agency or organisation, a management group responsible for responding to information security breaches could be established, with representatives from relevant areas that may be needed to investigate an incident, conduct risk assessments and make appropriate decisions (eg. privacy, senior management, IT, public affairs, legal).
  The group could convene periodically to review the response plan, discuss new risks and practices, or consider incidents that have occurred in other agencies or organisations.
• Include information in your agency or organisation's privacy policy about how you respond to breaches. This could include letting individuals know how they are likely to be notified in the event of a breach and whether your agency or organisation would ask them to verify any contact details or other information.
  This would make clear to individuals how their personal contact information is used in the event of a breach, and may also assist individuals to avoid 'phishing' scam emails involving fake breach notifications and asking recipients to verify their account details, passwords and other personal information.

Tips for preventing future breaches

Some of the measures that have resulted from real-life information security breaches are:

• the creation of a senior position in the agency with specific responsibility for data security
• a ban on bulk transfers of data onto removable media without adequate security protection (such as encryption)
• disabling the download function on computers in use across the agency to prevent the download of data onto removable media
• secure couriers and appropriate tamper proof packaging in the transport of bulk data and
• a ban on the removal of unencrypted laptops and other portable devices from government buildings.

Technological advances are allowing increasingly larger amounts of information to be stored on increasingly smaller devices.  This creates an increased risk of security breaches due to the size and portability of these devices, which can be lost or misplaced more easily when taken outside of the office. There is also a risk of theft because of the value of the devices themselves (regardless of the information they contain).

Preventative steps that agencies and organisations can take include conducting risk assessments to determine:

• whether and in what circumstances (and by which staff), personal information is permitted to be removed from the Office, whether it is removed in electronic form on disks, USB storage devices, laptops and other portable devices or in physical files and
• whether their stored data, both in the office and when removed from the office, requires encryption security.

8. The Role of the Office of the Privacy Commissioner

The Office has the function of investigating possible breaches of the Privacy Act.  An information security breach may constitute a breach of information security obligations under the IPPs or NPPs, and result in an interference with an individual's privacy.[17] However, the Office has no formal role in relation to breach notification and assisting agencies and organisations to respond to an information security breach. 

If an individual thinks an agency or organisation has interfered with his or her privacy they can complain to the Privacy Commissioner.  The Office conciliates between the parties to attempt to adequately resolve the dispute. 

The Office also has the power to initiate an investigation on its own motion in appropriate circumstance without needing to first receive a complaint.  In some circumstances the Commissioner may publicise information about the information management practices of an agency or organisation.

8.1   Reporting an information security breach to the Office

The Privacy Act does not specifically require agencies and organisations to report information security breaches to the Privacy Commissioner.  You may however choose to notify the Office of an information security breach.  The following are some potential benefits from doing so: 

• An agency or organisation's decision to notify the Office on its own initiative may be viewed by the public as a positive action. It tells your clients and the public that your agency or organisation views the protection of personal information as an important and serious matter. This may enhance public/client confidence in your agency or organisation.
• It can assist the Office in responding to inquiries made by the public and managing any complaints that may be received as a result of the breach.

It is important to note that reporting a breach does not preclude the Office from receiving complaints and conducting an investigation of the incident (whether in response to a complaint or of its own motion). 

If you decide to report an information security breach to the Office, the following provides an indication of what the Office can and can't do:

What the Office can do:

• Provide general information about obligations under the Privacy Act, factors to consider in responding to an information security breach and steps to take to prevent similar future incidents.
• Respond to community enquiries about the breach and explain possible steps individuals can take to protect personal information

What the Office cannot do:

• Provide detailed advice about how to respond to a breach or approve a particular proposed course of action. Agencies and organisations will need to seek own legal or other advice.
• Agree not to investigate (either using the Commissioner's 'own motion investigation' powers, or if a complaint is made to the Office) if the Office is notified of a breach.

The Office uses risk assessment criteria to determine whether to investigate a matter on its own motion.  These criteria include the:

• Number of people affected and the consequences for those individuals
• Sensitivity of the personal information involved
• Progress of an agency or organisation's own investigation into the matter and
• Likelihood that the investigation will reveal acts or practices that involve systemic interferences with privacy and/or that are widespread
• What actions have been taken to minimise harm to individuals from breach, such as notifying them and/or offering to re-secure their information and
• Whether another body such as the police are investigating.

These factors are similar to those included in the risk assessment criteria for responding to an information security breach.

Also, under s 27(1)(j) of the Privacy Act, the Privacy Commissioner can inform the Special Minister of State, as the Minister responsible for the Privacy Act, of action that needs to be taken by an agency in order to achieve compliance by the agency with the IPPs.

9. Schematic guide to breach notification

Appendix A

[1] Office of the Privacy Commissioner, Community Attitudes to Privacy 2007 (August 2007), pp 67-68, available at http://www.privacy.gov.au/business/research/index.html.  The research indicated that 60% of respondents were concerned, with 17% of this total very concerned.

[2] Commission of the European Communities, Review of the EU Regulatory Framework for electronic communications networks and services', June 2006, p30, available at http://europa.eu.int/information_society/policy/ecomm/doc/info_centre/public_consult/review/staffworkingdocument_final.pdf.

[3] See Office of the Privacy Commissioner of Canada, 'Key Steps for Organisations in Responding to Privacy Breaches' (August 2007) available at
http://www.privcom.gc.ca/information/guide/2007/gl_070801_02_e.asp.
and New Zealand Office of the Privacy Commissioner draft privacy breach guidelines, available at http://www.privacy.org.nz/privacy-breach-guidelines-2/.    

[4] See Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (September 2007), Chapter 47 and Proposal 47-1, available at: http://www.austlii.edu.au/au/other/alrc/publications/dp/72/ .

[5] It is anticipated that, if a mandatory notification requirement is introduced, agencies and organisations would nevertheless need to undertake some form of a risk assessment of a breach incident to determine whether they are legally required to notify affected individuals or others.  For example, as proposed by the ALRC (see note 7 above), making an assessment of whether there is real risk of serious harm to affected individuals.  The risk assessment approach emphasised in this guide may therefore be compatible with such future privacy law reform. 

[6] See the Office of the Privacy Commissioner, Submission to the Australian Law Reform Commission's Review of Privacy - Discussion Paper 72 (December 2007), chapter 47, pp.32 and 551-517, available at http://www.privacy.gov.au/publications/alrc211207.html.  

[7] See Office of the Privacy Commissioner of Canada, 'Key Steps for Organisations in Responding to Privacy Breaches' (August 2007), available at
http://www.privcom.gc.ca/information/guide/2007/gl_070801_02_e.asp.
and New Zealand Office of the Privacy Commissioner draft privacy breach guidelines, available at http://www.privacy.org.nz/privacy-breach-guidelines-2/.    

[8] An organisation, as defined under the Privacy Act 1988, is

• (a) an individual, or;
• (b) a body corporate or;
• (c) a partnership or;
• (d) any other unincorporated association or;
• (e) a trust;

that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed instrumentality.

[9] Although the titles for NPP 3, NPP 4 and NPP 9 all refer to 'data' (being the 'Data quality', 'Data security' and 'Transborder data flows' principles respectively), this term tends not to be used in the substantive provisions of the Act.  See Privacy Act 1988 (Cth), Schedule 3.  The NPPs are available at http://www.privacy.gov.au/publications/npps01.html.

[10] See the 'security safeguards principle' in the Organisation for Economic Cooperation and Development (OECD) Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980) available at http://www.oecd.org/document/18/0,2340,en_2649_34255_1815186_1_1_1_1,00.html.
The Privacy Act 1988 (Cth) was enacted to implement the OECD guidelines in Australia, as recognised in the preamble to the Act.

[11] For further information on coverage of the NPPs, see Information Sheet 12-2001 Coverage of and Exemptions from the Private Sector Provisions, available at http://www.privacy.gov.au/publications/IS12_01.html.

[12] The Office has provided further guidance on compliance with the information security principles elsewhere, available at

Guidelines to the Information Privacy Principles (principles 4-7) (for Australian and ACT Government agencies), available at
http://www.privacy.gov.au/government/guidelines/index.html.

Guidelines to the National Privacy Principles (for private sector organisations), available at
http://www.privacy.gov.au/publications/nppgl_01.html.

Information Sheet 6-2001:  Security and personal information
Provides information for organisations on compliance with NPP 4 available at  http://www.privacy.gov.au/publications/IS6_01.html.

[13] See the Office's Guidelines to the Information Privacy Principles (principles 4-7) for a brief overview of existing guidance on security standards for agencies, available at http://www.privacy.gov.au/government/guidelines/index.html.

[14] Information security obligations on agencies and organisations are outlined in the draft Voluntary Information Security Breach Notification Guide attached. 

[15] See the 'openness principle' in the Organisation for Economic Cooperation and Development (OECD) Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980), available at http://www.oecd.org/document/18/0,2340,en_2649_34255_1815186_1_1_1_1,00.html.  This principle is reflected in NPP 5 and IPP 2 in the Privacy Act 1988 (Cth).

[16] See the Information Privacy Principles in section 14 and the National Privacy Principles in Schedule 3 of the Privacy Act.  The IPPs are available at  http://www.privacy.gov.au/publications/ipps.html.  The NPPs are available at http://www.privacy.gov.au/publications/npps01.html.

[17] See sections 13 (agencies) and 13A (organisations) of the Privacy Act 1988 (Cth).

Return