Why you should oppose a data breach notification law

Powered by SC Magazine
 

Opinion: Data breach notification was a good idea - a decade ago.

Dear Attorney-General, please get on with it, and submit a Bill to create a privacy right of action.

Added to that, we need criminal offences on the statute books for serious and/or repeated failures to implement security safeguards commensurate with the sensitivity of the data.

But all that mandatory data breach notification – raised in your Discussion Paper this week – does is expose the fact that organisations are culpably cavalier with sensitive data, and fail to implement well-understood security safeguards.

And, um, we know that already.

Privacy advocates and security specialists alike are opposed to mandatory data breach reporting. The reason is that it's being used as an excuse to hold off what is now clearly necessary.

Consider what it took for mandatory data breach notification to get to where it is today.

In 2003, California passed a Security Breach Notification Law, requiring that Californian consumers be notified when sensitive personal data about them is illegitimately obtained from a server or database.

A total of 34 states adopted similar laws by 2006, prompting Australia's Privacy Commissioner at the time to recommend such a law be passed in Australia.

By 2012, the Australian Law Reform Commission had studied the question for 2 years, the government had cogitated for 4 years, and, just this week, the Attorney-General took "decisive action" by releasing a Discussion Paper.

So it looks like we can expect a draft bill by 2014, assuming the Government is re-elected and the initiative doesn't get lost somewhere.

The bill will likely pass in 2015 and come in to force in 2016. But it won't be until 2019, perhaps, that the Privacy Commissioner is embarrassed into dropping its established practice of warning miscreants to actually impose sanctions.

Data breach notification was a good idea – a decade ago.

Roger Clarke is Principal of Xamax Consultancy Pty Ltd, a Visiting Professor in at UNSW and ANU, Chair of the Australian Privacy Foundation and a Director of the Internet Society of Australia.

Copyright © iTnews.com.au . All rights reserved.


Why you should oppose a data breach notification law
 
 
 
Top Stories
Coalition's NBN cost-benefit study finds in favour of MTM
FTTP costs too much, would take too long.
 
Telcos finally briefed on data retention details
Update: AGD offers list of data to be stored.
 
Qld Health hires short-term CIO, CTO
Ray Brown leaves after five years at IT helm.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  67%
 
Advanced persistent threats
  3%
 
Unpatched or unsupported software vulnerabilities
  12%
 
Denial of service attacks
  7%
 
Insider threats
  12%
TOTAL VOTES: 561

Vote