Why you should oppose a data breach notification law

Powered by SC Magazine
 

Opinion: Data breach notification was a good idea - a decade ago.

Dear Attorney-General, please get on with it, and submit a Bill to create a privacy right of action.

Added to that, we need criminal offences on the statute books for serious and/or repeated failures to implement security safeguards commensurate with the sensitivity of the data.

But all that mandatory data breach notification – raised in your Discussion Paper this week – does is expose the fact that organisations are culpably cavalier with sensitive data, and fail to implement well-understood security safeguards.

And, um, we know that already.

Privacy advocates and security specialists alike are opposed to mandatory data breach reporting. The reason is that it's being used as an excuse to hold off what is now clearly necessary.

Consider what it took for mandatory data breach notification to get to where it is today.

In 2003, California passed a Security Breach Notification Law, requiring that Californian consumers be notified when sensitive personal data about them is illegitimately obtained from a server or database.

A total of 34 states adopted similar laws by 2006, prompting Australia's Privacy Commissioner at the time to recommend such a law be passed in Australia.

By 2012, the Australian Law Reform Commission had studied the question for 2 years, the government had cogitated for 4 years, and, just this week, the Attorney-General took "decisive action" by releasing a Discussion Paper.

So it looks like we can expect a draft bill by 2014, assuming the Government is re-elected and the initiative doesn't get lost somewhere.

The bill will likely pass in 2015 and come in to force in 2016. But it won't be until 2019, perhaps, that the Privacy Commissioner is embarrassed into dropping its established practice of warning miscreants to actually impose sanctions.

Data breach notification was a good idea – a decade ago.

Roger Clarke is Principal of Xamax Consultancy Pty Ltd, a Visiting Professor in at UNSW and ANU, Chair of the Australian Privacy Foundation and a Director of the Internet Society of Australia.

Copyright © iTnews.com.au . All rights reserved.


Why you should oppose a data breach notification law
 
 
 
Top Stories
Meet FABACUS, Westpac's first computer
GE225 operators celebrate gold anniversary.
 
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  26%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  22%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  25%
TOTAL VOTES: 346

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  58%
 
No
  42%
TOTAL VOTES: 144

Vote