You've been hacked! How will your data breach response plan perform and what does the OAIC suggest? - Data Protection

Recent and highly publicised data breaches confirm they can affect any organisation, at any time. Whether a result of malicious hacking, data leak or unintended human error, an unmanaged data breach can be disastrous. The key is to have a clear and known response plan that can be implemented quickly and thoroughly.

The Privacy Act 1988 (Cth) imposes obligations on private sector organisations and Commonwealth government departments and agencies to handle personal information appropriately.

In particular, Australian Privacy Principle 11 requires an organisation to take reasonable steps to protect the personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure.

"Reasonable steps" includes notification of certain data breaches, and having and implementing a data breach response plan.

WHAT IS A DATA BREACH?

The term "data breach" is not found in the Privacy Act and has no settled meaning under Australian law. However, the OAIC's Data Breach Notification Guide (Guide) adopts the generally understood meaning:

A "data breach" occurs when personal information is lost, interfered with, misused or is otherwise accessed, modified or disclosed without authorisation.

Data breaches are not limited to malicious actions like theft or "hacking". They include human error and mishandling of personal information resulting in accidental loss or disclosure. Lost or stolen laptops, employees accessing or disclosing personal information outside the authorisation of their employment, and an organisation mistakenly providing personal information to the wrong person or sending it to the wrong email address are just some of the examples noted in the Guide.

STEPS TO TAKE IN THE EVENT OF A DATA BREACH

The Guide outlines four key steps when responding to a data breach:

Step 1	Contain the breach and make a preliminary assessment	Take immediate steps to contain the breach Designate person/team to coordinate response
Step 2	Evaluate the risks for individuals associated with the breach	What personal information is involved? Establish cause and extent of the breach Identify what is the risk of harm
Step 3	Consider notification	Risk analysis on a case by case basis Should affected individuals and/or others be notified?
Step 4	Review the incident and take steps to prevent further breaches	Fully investigate the cause of the breach Consider developing a prevention plan Option of audit to ensure plan implemented Update security/response plan Update policies, procedures and training, if required

IS NOTIFICATION OF A DATA BREACH MANDATORY?

There is not, currently, a specific obligation under the Privacy Act to notify affected individuals (or the OAIC) of a data breach.

However, it may be commercially appropriate to notify affected individuals in certain circumstances. Further, the OAIC considers that notifying affected individuals may form part of an organisation's data security obligations under APP 11, in certain circumstances. It may also be appropriate to notify the OAIC.

In March 2015, the Federal Government agreed to introduce a mandatory data breach notification scheme by the end of 2015. However, we are yet to see any draft legislation and the Attorney-General has now confirmed that legislation will not be passed this year.

WHEN AND WHO SHOULD YOU CONSIDER NOTIFYING?

The 'best practice' general rule is that you should notify affected individuals and the OAIC where there is a real risk of serious harm to the individuals as a result of the data breach (or suspected data breach). A real risk is a risk that is not remote, and harm includes reputational, economic and financial harm.

While the Guide does not provide a clear test for determining when there is a "real risk of serious harm" (such as number of affected individuals or specific types of information, e.g. credit card details, health records), it does provide guidance as to factors to consider in deciding whether or not to notify:

type of harm to which affected individuals could be exposed (e.g. identify theft, financial loss, threat to physical safety or emotional wellbeing, humiliation, reputational damage);
whether notification would assist the affected individual to mitigate possible harm (e.g. by changing passwords); and
any legal or contractual obligations to notify (or not to notify, such as where it may prejudice an on-going investigation by law enforcement into the data breach).

There is no need to notify individuals of all data breach incidents. The Guide specifically discourages organisations from over-reporting minor breaches, which may result in undue anxiety and de-sensitise individuals to notification.

TIMING FOR NOTIFICATION

The Guide suggests organsations should only notify affected individuals once they have as complete a set of facts as possible and can provide affected individuals with an assessment of the potential risks of harm and suggestions about what the individual can do to reduce those risks.

WHO ELSE SHOULD BE NOTIFIED?

The Guide recommends organisations notify the OAIC where the data breach is likely to attract a "high level of media attention" or complaints to the OAIC. If appropriate, also consider notifying other parties such as the police, insurers, credit card companies, and professional or other regulatory bodies.

RESPONSE PLAN TIPS AND NEW OAIC GUIDANCE

The OAIC's Guide to securing personal information suggests what a data breach response plan should identify, including:

strategy for assessing and containing breaches;
actions required under legislation¹ or relevant contracts;
key personnel responsible for implementing the strategy (e.g. the Privacy Officer and Chief Technology Officer);
clear lines of command and accountability for data breach issues;
a procedure for determining whether to notify affected individuals or the OAIC; and
a strategy for identifying and remediating the source of the data breach to prevent further issues.

The plan should also include details of key contacts including:

service providers storing or handling your personal information; and
professional advisers who can assist in the event of a data breach (e.g. IT security consultants, legal advisers).

The OAIC's just-released consultation draft Guide to developing a data breach response plan also notes:

once a breach has been identified, time is of the essence – corrective actions taken directly after a breach occurs will likely mitigate the damage suffered by individuals as well as the costs incurred by the organisation;
a response plan is just one tool to manage a data breach – the plan should be monitored and reviewed on an ongoing basis to maintain its effectiveness;
roles and responsibilities should be clearly outlined in the plan and sufficient staff training in relation to the plan is required to give it effect – hypothetical and scenario based training provides good practice and allows for lessons learnt to be incorporated into the plan; and
build a process into the plan that allows for 'lessons learnt' to be considered to prevent future breaches.

The OAIC is seeking public comment on the draft data breach response plan Guide. The closing date for comments is Friday 27 November 2015.

Footnote

¹ Mandatory obligations could arise under the laws of other jurisdictions (where personal information is regulated under the laws of multiple countries) or under specific Australian legislation such as the Personally Controlled Electronic Health Records Act 2012 (Cth).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.


Most awarded firm and Australian deal of the year Australasian Legal Business Awards	Employer of Choice for Women Equal Opportunity for Women in the Workplace (EOWA)