Government releases draft and discussion paper on Privacy Amendment (Notification of Serious Data Breaches) Bill 2015
The Australian Government has released a new draft of its mandatory serious data breach notification bill for public consultation. And it’s already raising concerns for one industry association, which claims the legislation could actually harm consumers in the long run.
The Privacy Amendment (Notification of Serious Data Breaches) Bill 2015 is set to make it mandatory for Australian organisations to report data breaches that create a ‘risk of serious harm’ to affected individuals.
At present, Australian organisations are expected to take reasonable steps to secure personal information they hold under the Australian Privacy Principles (APP), but there’s no legal requirement to notify individuals or the wider industry and community following a data breach. The APP applies to all organisations with more than $3 million in annual turnover, with a limited number of exceptions.
In addition, a voluntary data breach reporting scheme is overseen by the Office of the Australian information Commissioner (OAIC). This asks organisations to both describe the nature of a breach, and the steps taken to contain the breach, mitigate harm to affected individuals, and improve security practices in future.
However, the OAIC currently cannot enforce data breach reporting or impose fines on those organisations that don’t report such a breach. A previous bill proposed in 2013 to make data breach reporting mandatory also failed to pass.
Under the newly proposed scheme, organisations would be required to notify the Australian Information Commissioner and affected individuals following a ‘serious data breach’. This encompasses data about individuals such as personal information, credit report information, credit eligibility information or tax file number information. Notification would have to be made through operating channels such as email, post and phone where practical.
A serious data breach would also occur if the loss of that information could lead to unauthorised access or disclosure putting individuals at real risk of serious harm, such as physical, psychological or financial.
The latest mandatory breach reporting draft has raised concerns at the Association for Data-driven Marketing and Advertising (ADMA), which continues to advocate self-regulation and existing policies over introducing mandatory ones.
The association’s director of legal and regulatory affairs, Jeanette Scott, told CMO mandatory reporting will impact every marketing department, and could ultimately end up hurting consumers,.
While the latest version of the proposed bill included a better outline of what ‘serious harm’ actually meant, Scott suggested the definition remained vague and could lead to organisations over-reporting data breaches to compensate for nervousness about risk. This could, in turn, trigger an increase in costs to businesses, ultimately born by the consumer, along with add regulatory burden, she said.
Without a clear definition of ‘serious harm’ and over-reporting, Scott also argued messaging to consumers could become white noise and lose impact.
“Consumers could start ignoring these messages, which are designed to be sent to consumers to give them a chance to mitigate any risk that may have been posed to them. If those messages don’t have cut-through, then potentially you’re going to increase the risk to consumers, rather than reduce it,” she said.
“Ultimately, it’s the consumer who is going to suffer from this.”
According to Scott, the industry has a working program in the OAIC’s guidelines on breach reporting. In addition, the Privacy Laws introduced last year have raised awareness of the obligation to be vigilant around customer data, she said.
According to the OAIC, 110 voluntary data breach notifications were reported in 2014-2015, up from 67 notifications in 2013-2014 and 61 in 2012-2013.
“We have asked the government to explain why they feel they need to put this bill out and what is the urgency and impetus for this,” Scott said. “It seems ironic that a government with an agenda to reduce red tape and increase productivity is looking to introduce a piece of legislation in a regime that already seems to be working.
“Reputation is a key driver behind compliant behaviour: Businesses understand it’s their brand that’s at stake, and we have seen really compliant behaviour in businesses, in that they’re going out to the regulator and consumers when these breaches occur.”
For director of legal and regulatory affairs for the Interactive Advertising Bureau (IAB) Australia, Daad Soufi, the problem with the new mandatory data breach reporting is it's too generic in focus and implementation.
"It has already been accepted by the Australian Law Reform Commission, and the previous government, that Data Protection laws require flexibility given that we have principal-based legislation," he commented. "This policy should therefore thread into the Mandatory Breach Reporting dialogue, rather than taking the more blanket style approach currently articulated in the proposed draft legislation.
"We cannot lose sight of the fact that the digital industry has a diverse range of participants with differing 'nature, scale and complexity' and we need to work with industry in such a way that we reach a commercial and practicable outcome that is consistent with the APPs while protecting core personal information."
Soufi and the IAB also prefer self-regulation, supported by the voluntary data breach reporting guidelines issued by the Privacy Commissioner. The association will now work with Government on taking a deeper look to identify core pieces of information centric that require protection.
"These insights will provide a framework to work together to define the self-regulatory, commercial and practical measures that will complement the existing data security compliance obligations of APP 11 [Australian Privacy Principle: The need to take reasonable steps to protect personal information from misuse, interference or loss, unauthorised access, modification or disclosure]," Soufi added.
What to do to improve your data breach plans
For those looking to improve their data reporting, Scott recommended having the Privacy Commissioner’s current breach notification guidelines part of their privacy compliance programs internally. She also said ADMA will continue to report on the current draft breach response plan, a tandem piece to the guidelines that already exist.
“And make sure you do respond in a timely manner as soon as you think a breach has occurred. The worst thing you can do, as a brand, is try and ignore a potential breach,” she said. “The second you suspect something is afoot, you should be investigating so you can contain the risk and notify those who may be impacted.
“Often the worst reputational harm doesn’t come necessarily from the breach itself, but the way the breach is handled.”
Consultation on the exposure draft of the bill, along with discussion paper and Explanatory Memorandum, will be open until 4 March 2016.
Background to the latest Bill
The recommendation to introduce mandatory report was made following a February 2015 inquiry by the Parliamentary Joint Committee on Intelligence and Security into the telecommunications (Interception and Access) Amendment (Data Retention) Bill 2014.
Australia's Privacy Laws were introduced in March 2014.
In cases where an organisation suspected a data breach, the draft bill allows 30 days to assess if notification is needed. In addition, in instances where the commissioner believed a serious data breach had occurred, but has not been notified, the commissioner could also pursue further action.
Failure to comply with these proposed obligations could result in penalties and infringement notices.
Notably, the draft offers up a clause supporting leniency for businesses unable to notify affected individuals because they do not hold contact details, or if the cost of justifying each individual would be excessive in all the circumstances. In these cases, public notices may need to be published through an entity’s website or via external media channels, the draft states.
Follow CMO on Twitter: @CMOAustralia, take part in the CMO conversation on LinkedIn: CMO ANZ, join us on Facebook: https://www.facebook.com/CMOAustralia, or check us out on Google+: google.com/+CmoAu
In the third and final episode of our 3-part CMO50 video series exploring modern marketing and why it’s become a matter of trust, we’re delighted to be joined by Telstra’s former CMO and now digital services and sales executive, Jeremy Nicholas, and Adobe VP Marketing Asia-Pacific and Japan, Duncan Egan.
Flash back to the classic film, Willy Wonka and the Chocolate Factory. Television-obsessed Mike insists on becoming the first person to be ‘sent by Wonkavision’, dematerialising on one end, pixel by pixel, and materialising in another space. His cinematic dreams are realised thanks to rash decisions as he is shrunken down to fit the digital universe, followed by a trip to the taffy puller to return to normal size.
Why is it there is no shortage of leadership development materials, yet outstanding leadership is so rare? Despite having access to so many leadership principles, tools, systems and processes, why is it so hard to develop and improve as a leader?
As a nation united by sport, brands are beginning to learn money alone won’t talk without aligned values and action. If recent events with major leagues and their players have shown us anything, it’s the next generation of athletes are standing by what they believe in – and they won’t let their values be superseded by money.
