Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Data breaches and the law

Why mandatory reporting of data breaches is crucial

As a society, we’re sharing more information electronically and transacting more in the digital world than ever before. Personal information is being collected and stored in ways that was never previously possible, whether it’s Facebook photos shared by friends or medical records that are kept electronically. That information has the capacity to live on long after we die. Therefore, laws making it mandatory to report data security breaches are crucial to protecting confidential information in the 21st century.

In October, Attorney-General Nicola Roxon issued a discussion paper entitled Australian Privacy Breach Notification, which looks at the notification requirements that government agencies and large private-sector organisations should have in place when they suffer a data breach. The ICT industry has been calling for laws around mandatory data breach reporting for some time, and a conversation at government level is long overdue.

There are currently no mandatory requirements under Australian law to report data breaches. While companies are encouraged to disclose the details of a data breach, it’s not compulsory. Statistics tell us that many breaches go unreported and therefore unnoticed. This makes it easy for breached data to be misused. If reporting were mandatory, those whose data had been breached would have a better chance of taking steps to mitigate the effects of the breach. For example, by changing their password or cancelling their credit card if those details had been stolen.

However, there should be express exemptions to mandatory reporting if the breached data was adequately encrypted. If data is encrypted properly, using the right algorithm, then it really isn’t at risk if it is illegally accessed or used; it will be computationally infeasible to ‘break’ the encryption and all you need to do to destroy that data is to destroy the encryption key associated with it.

Experience in places like the US has shown that mandatory data breach disclosure laws that include an express exemption for encrypted data also spur on the ICT security industry and create a real incentive for organisations to invest in network and data security systems, dramatically reducing the overall impact of breaches. With some areas of the economy now softening, it makes sense for the government to enact laws which encourage growth in other areas, like the ICT sector.

While there are arguments both for and against mandatory reporting, the sheer amount of data that is stored electronically means that laws around data breaches are essential to ensure that organisations are accountable for protecting the data they hold.

The discussion paper has called for consultation and discussion on a number of key areas, including:

  • Which privacy breaches should be reported? Should ‘minor breaches’ be exempted and, if so, how should a minor breach be measured?
  • Who should decide on whether the breach should be disclosed – the affected organisation or the regulator?
  • How soon should the breach be reported and what should the penalties be?

The paper has the potential to lead to the introduction of a regime ensuring responsible data management across Australia. Privacy is no doubt a major issue and we absolutely need laws which properly address it.

Hayden Delaney is a senior associate with law firm HopgoodGanim.

Related Articles

  1. From CMO to CEO: Anametrix’s Pelin Thorogood

    CMO

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

Comments are now closed.
Related Whitepapers
Latest Stories
Community Comments
Latest Blog Posts
Whitepapers
  • Protecting Your Data, Intellectual Property, and Brand from Cyber Attacks
    Enterprises and government agencies are under virtually constant attack today. It is clear that the cybercriminals, nation-states, and hacker activists waging these attacks are growing increasingly sophisticated and more effective in their efforts to steal and sabotage. Why are today’s security defenses failing? In this battle, your security teams are using outdated arsenal - download now to learn more.
    Learn more »
  • Building a Better Mousetrap in Anti-Malware
    This story is becoming frustratingly old. Cyber threats are continuously advancing in their adaptability speed, sophistication, and degree of stealthiness. At the same time, the exposed footprint is expanding. More business operations are moving online and end-user devices—corporate-issued and user-owned—are expanding in number and variety. A reasonable question asked by executives responsible for making decisions on their organisations’ security budgets is whether their money and resources are being spent wisely. Are their businesses buying and using the best mix of security technologies to meet their needs and obligations? Read on.
    Learn more »
  • How Web Security Improves Productivity and Compliance
    In this white paper, we will look at how secure web gateways, one type of information security technology, can provide benefits to many departments within any business or government agency. Download now.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments