Preparing for mandatory data breach notification

With the Privacy Amendments (Privacy Alerts) Bill 2013 likely to become law following a standing committee report, now is a good time to start looking at security systems, says K&L Gates partner Cameron Abbott.

If passed, the bill will require government agencies and businesses to notify customers of serious data breaches in relation to personal, credit reporting, credit eligibility or tax file number information.

A Senate Standing Committee on Legal and Constitutional Affairs urged the Senate to pass the bill, stating that mandatory data breach notifications would benefit both Australian consumers and industry stakeholders.

Abbott told Computerworld Australia that the bill will force companies to prioritise security systems.

“Executives should be engaging with the IT department about their systems so the people that understand this bill and what’s at stake can communicate that to the people who are making cost benefit decisions on the degree of security,” he said.

“One of the practical ways to breach the divide between those who understand the legal risks and the people making the budget decisions is to create a privacy impact statement for these projects.”

According to Abbott, the bill will also affect cloud service providers as they will need to make some “serious commitments” about the security of the data they have been entrusted with.

“To date, there has been a tendency to accept the cloud providers terms and conditions which don’t promise much,” he said.

“Companies should also be looking at the serious ramifications of not getting their security right. If you have a data breach you are going to have to tell all of your customers that you’ve stuffed up and you can’t be trusted.”

Abbot said that this will crystallise brand value far faster than any other consequence that comes out of the legislation.

He added that mandatory reporting of serious data breaches will act as a far greater motivator for companies than fines.

“Sony was fined 250,000 pounds in the UK by the privacy officer following the PlayStation Network breach but it is rumoured to have spent over $150 million to rectify its security issues after the event,” Abbott said.

This article and the comments within it should not be construed as legal advice

Follow Hamish Barwick on Twitter: @HamishBarwick

Follow Computerworld Australia on Twitter: @ComputerworldAU, or take part in the Computerworld conversation on LinkedIn: Computerworld Australia