Why you should oppose a data breach notification law

Powered by SC Magazine

Opinion: Data breach notification was a good idea - a decade ago.

Dear Attorney-General, please get on with it, and submit a Bill to create a privacy right of action.

Added to that, we need criminal offences on the statute books for serious and/or repeated failures to implement security safeguards commensurate with the sensitivity of the data.

But all that mandatory data breach notification – raised in your Discussion Paper this week – does is expose the fact that organisations are culpably cavalier with sensitive data, and fail to implement well-understood security safeguards.

And, um, we know that already.

Privacy advocates and security specialists alike are opposed to mandatory data breach reporting. The reason is that it's being used as an excuse to hold off what is now clearly necessary.

Consider what it took for mandatory data breach notification to get to where it is today.

In 2003, California passed a Security Breach Notification Law, requiring that Californian consumers be notified when sensitive personal data about them is illegitimately obtained from a server or database.

A total of 34 states adopted similar laws by 2006, prompting Australia's Privacy Commissioner at the time to recommend such a law be passed in Australia.

By 2012, the Australian Law Reform Commission had studied the question for 2 years, the government had cogitated for 4 years, and, just this week, the Attorney-General took "decisive action" by releasing a Discussion Paper.

So it looks like we can expect a draft bill by 2014, assuming the Government is re-elected and the initiative doesn't get lost somewhere.

The bill will likely pass in 2015 and come in to force in 2016. But it won't be until 2019, perhaps, that the Privacy Commissioner is embarrassed into dropping its established practice of warning miscreants to actually impose sanctions.

Data breach notification was a good idea – a decade ago.

Roger Clarke is Principal of Xamax Consultancy Pty Ltd, a Visiting Professor in at UNSW and ANU, Chair of the Australian Privacy Foundation and a Director of the Internet Society of Australia.

Copyright © iTnews.com.au . All rights reserved.

Why you should oppose a data breach notification law
Top Stories
Content, cost & constant innovation: How Foxtel plans to take on Netflix
Nell Payne inhabits the “brave new world of blue strings and networking”. Just don't ask her to put a TV screen on your microwave.
Sending in the drones
Margins are getting tighter in the industrial services industry, so Transfield Services' Stephen Phillips looks offshore - and to the skies - for the solutions he needs to keep pace.
Westpac fires starting pistol on core banking upgrade
St George readies itself for move to Celeriti.
Sign up to receive iTnews email bulletins
Latest Comments
Should Optus make a bid for iiNet?

   |   View results