Large businesses be warned! A breach of data will now result in more than a social media backlash and/or loss of reputation. Obligations to report data breaches are now more stringent, and non-reporting of these breaches may result in huge fines being imposed. Further to this, individuals whose personal information has been compromised may commence proceedings to recover damages beyond those stipulated in the Privacy Act 1988 (Cth).
Notifiable Data Breach (‘NDB’) Scheme
On 22 February 2018, the NDB Scheme came into force which was established under the Privacy Amendment (Notifiable Data Breaches) Act 2017 and introduced under the Privacy Act 1988 (Cth) (‘Privacy Act’). It ultimately gave more rights to any individuals affected by data breaches.
The Privacy Act lists the penalties available for those responsible for data breaches, however under this scheme, more damages are available beyond those listed under the Privacy Act. For businesses with a $3 million annual turnover, the scheme also introduced an obligation to notify both the affected individuals and the OAIC of a data breach which would likely result in serious harm. The scheme applies to organisations and agencies under the Privacy Act.
Damages only apply to serious breaches causing loss and damage. Businesses are being warned that this can give affected parties more rights and remedies. In calculating the damages, feelings of humiliation will also be considered.
It is easy to understandable why the NDB Scheme was introduced. Large businesses need to appropriately own up to their mistakes and immediately notify their customers of any potential data breaches. This will in turn allow any and all affected individuals to take appropriate action for recourse, if and when required.
Commbank
The hot topic at the moment surrounding this issue relates to recent conduct of the Commonwealth Bank of Australia (‘CBA’). Firstly, CBA recently admitted that it had failed to disclose a potential data breach affecting its customers. In 2016, CBA instructed FujiXerox, now known as FujiFilm to destroy magnetic tape drives containing customer’s financial details. However, CBA failed to locate any record that the details had in fact been destroyed. At the time, the new NDB scheme had not been introduced, which meant that CBA had no obligation to disclose the breach to affected individuals when it became apparent that there was a potential breach.
The bank’s failure to disclose the potential breach of data pertaining to approximately 20 million customer accounts at the time that it occurred has received widespread criticism. CBA has now sent emails to its customers relating to the May 2016 incident informing them that no personal information had been compromised.
Unfortunately for CBA, this was not the end of the story. Only last week the bank confirmed that their staff had inadvertently sent emails that contained data of 10,000 customers to an overseas company. The staff had sent 651 internal emails to addresses with the domain name “cba.com” rather than the bank’s domain name of “cba.com.au”.
This time CBA was quick to address the issue, and released a statement on Friday 1 June to the effect:
“We want our customers to know that we are committed to being more transparent about data security and privacy matters…Our investigation confirmed that no customer data has been compromised as a result of this issue. We acknowledge, however, that customers want to be informed about data security and privacy issues and we have begun contacting affected customers”
Full credit to CBA for appropriately responding to the incident. Their statement was timely, concise and in line with their obligations under the new NDB scheme.
Key takeaways
- Make sure all your staff know your correct email address! If it CAN happen to the CBA, it CAN happen to any business;
- Be familiar with the NDB Scheme and your obligations as a business;
- Train your employees about the correct handling of personal information;
- Develop polices in line with the NDB Scheme, and seek legal advice to ensure that your business is appropriately compliant;
- Know what to do when there is a potential data breach, and how this may be handled through social media.
If you would like to receive our regular legal updates, please subscribe here. Alternatively, should you require any advice relating to data breaches and the NBD Scheme – please don’t hesitate to get in touch with:
