Roxon raises mandatory data breach laws

Powered by SC Magazine

Law enforcement activities could be exempt.

Attorney-General Nicola Roxon has issued a discussion paper today on whether Australia should introduce a mandatory data breach regime.

Such laws would compel organisations to inform members of the public any time personal information about that customer falls into the wrong hands.

For Australian organisations today, the disclosure of such breaches is voluntary and subject to guidelines by the Federal Privacy Commissioner.

Roxon's discussion paper is the first step the Government has made towards a mandatory regime since the Australian Law Reform Commission recommended such a policy in 2008.

Roxon's discussion paper looks at how legislation might strengthen the protection of personal information as well as minimise damage when breaches occur.

The paper notes that there has been a 27 percent increase in data breaches reported to the Privacy Commissioner and mounting public concern over the impact of these breaches.

It notes that mandatory data breach notification schemes are in place or under consideration in the United States, the European Union, the United Kingdom and Ireland. 

The case for more regulation is found on giving the public a legal basis for “resecuring” their information following a data breach.

Such laws could act to improve data security, especially among companies where adverse publicity could have consequences for their share prices.

It would also provide better information to government and the public on the scope and frequency of data breaches, the paper argues.

Finally it suggests mandatory data breach notification may bolster public confidence that the Government is taking individual privacy rights seriously.  

The main issues

The paper canvasses questions such as

  • Should there be a mandatory data breach provision;
  • What constitutes a data breach and what should trigger a notification;
  • Who should be notified e.g. the Privacy Commissioner and/or affected consumers;
  • Who should decide on whether to notify;
  • What should be reported and by when;
  • What penalties might be appropriate for failing to notify;
  • Which organisations should be subject to such laws.

With half an eye on the issues involved in the Government’s current data retention proposals, the paper also raises the question of whether there should be an exemption for law enforcement activities.

In some cases, notification of a data breach by an agency could compromise its law enforcement activities, the paper states.

Submissions on the issues raised in this paper are sought by 23 November 2012. 

How do you feel about mandatory data breach notification laws? Have your say below...

Copyright © . All rights reserved.

Roxon raises mandatory data breach laws
Will Nicola Roxon finally introduce data breach notification laws?
Top Stories
How hard do you hack back?
[Blog post] Taking the offensive could have unintended consequences.
Five zero-cost ways to improve MySQL performance
How to easily boost MySQL throughput by up to 5x.
The big winners from Defence’s back-office IT refresh
Updated: The full list of subcontractors.
Will Nicola Roxon finally introduce data breach notification laws?
Sign up to receive iTnews email bulletins
Latest Comments
Which is the most prevalent cyber attack method your organisation faces?

   |   View results
Phishing and social engineering
Advanced persistent threats
Unpatched or unsupported software vulnerabilities
Denial of service attacks
Insider threats