The Office of the Australian Information Commissioner (OAIC) recently published its Notifiable Data Breaches Report (Report), which was based on notifications made under the Notifiable Data Breaches (NDB) Scheme between the period 1 July 2020 to 31 December 2020. The Report revealed a significant increase in data breaches that resulted from human error. The Report provides a timely reminder of the importance of organisations’ taking active steps to prevent data breaches.
What is the NDB scheme?
The OAIC introduced the scheme in February 2018 to protect consumers by encouraging better standards when dealing with consumer’s personal information. Under the scheme, any organisation or agency covered by the Privacy Act 1998 must notify the OAIC and all affected individuals when they have reasonable grounds to believe that an eligible data breach has occurred.
Who does the scheme apply to?
The following entities are covered by the scheme:
- Australian Government agencies;
- Organisations’ that have an annual turnover of more than AU$3 million;
- Private sector health service providers;
- Credit reporting bodies;
- Credit providers;
- Tax file number recipients; and,
- Entities that trade in personal information.
What is an eligible data breach and what must be done if a breach occurs?
If a data breach meets the following criteria, it will be classified as an eligible data breach:
- Personal information that an entity holds has been lost or there is unauthorised access or disclosure of personal information.
- From the perspective of a reasonable person, the breach is likely to result in serious harm to affected individual/s.
- The entity has not been able to prevent the risk of harm with remedial action.
In the context of a data breach, serious harm can include serious physical, psychological, emotional, financial, or reputational harm.
An entity must take reasonable steps to complete its assessment within 30 days after it suspects an eligible data breach. If an eligible data breach is established, the entity must then, as soon as practical provide a statement to the Information Commissioner and notify the affected individuals promptly.
What were the key findings of the Report?
The Report demonstrated that in the period from 1 July 2020 to 31 December 2020:
- the OAIC received 539 data breach notifications, which is an increase of 5% compared to the previous six months;
- 58% of notifications resulted from malicious or criminal attack, 38% resulted from human error, and 5% were as a result of system fault;
- there was an 18% increase in data breaches attributed to human error (173 to 204 notifications); and,
- the health sector remained the highest reporting industry sector (23% of notifications).
The key concern has been the significant increase in breaches that resulted from human error.
What can organisations do to prevent data breaches and meet their obligations under the scheme?
The OAIC has stated that “organisations need to reduce the risk of a data breach by addressing human error – for example, by prioritising staff training on secure information handling practices.”
Organisations should also implement the following to prevent and mitigate data breaches:
- strong password protection strategies for example, increasing password complexity and length;
- raising staff awareness about the importance of protecting credentials;
- training staff on cyber security awareness; and,
- using multi-factor authentication for remote access to business systems.
Organisations should also have a data breach response plan in place to promptly respond to data breaches. The plan should address how to:
- Contain the breach
- Assess the risks for individuals associated with the breach
- Consider breach notification
- Review the incident and take action to prevent future breaches.
How can we help?
If you require assistance with understanding your privacy obligations, putting in place a data breach response plan, or responding to a data breach, please do not hesitate to contact a team member of Coleman Greig’s Commercial Advice Team, who would be more than happy to assist you.
