Two in three Australian companies leak data

Renews calls for mandatory data disclosure laws.

Two in three Australian organisations experienced a serious data breach in the last twelve months, according to a survey by the Ponemon Institute.

The Institute, commissioned by data encryption company PGP, paid 482 IT security professionals in Australia to answer questions around the protection of their data.

Some 69 percent of respondents said they experienced at least one data breach in the last 12 months, up from 56 percent in 2008.

One in four of those companies that experienced a data breach suffered five or more breaches in the 12 months, up 22 percent on 2008.

Of those organisations that did admit to losing data, 65 percent chose not to inform the public - a figure the report's authors said was "sure to add to the demand for Australia to adopt data breach notification laws similar to those in the United States."

The Federal Government has spent the last few months reviewing privacy laws, the first draft of which was due to be released to the public within a week.

But no timeline has been set for the introduction of mandatory data disclosure laws, as recommended by the Australian Law Reform Commission and the Office of the Privacy Commissioner.

In the interim, the Office of the Privacy Commissioner has produced a voluntary guide to managing data breaches.

The survey also revealed some interesting data on what motivates organisations to protect their data.

Of those organisations that use data encryption technology to protect against the leak of confidential data, only 15 percent said they did so for regulatory reasons (citing the Federal Privacy Act, National Privacy Principles and PCI DSS requirements) whereas 70 per cent used encryption to protect their brand and reputation.