It’s increasingly likely New Zealand will introduce data-breach disclosure measures as Australia edges closer to doing so — perhaps as early as next year.
New Zealand Privacy Commissioner Marie Shroff told Computerworld in June her office was preparing recommendations for government that could force organisations subject to breaches of personal data to notify individuals affected by the breach.
Shroff said she was studying what was happening overseas and that surveys conducted by her office had detected rising concern over the issue of data privacy and security. This pointed in the direction of recommending that “something needs to be done”.
Shroff’s Australian equivalent, Federal Privacy Commissioner Karen Curtis, supports mandatory reporting of breaches, especially if it involves a lot of customer data and a lot of money.
“We are out of step if we don’t look at it,” she says. “Customers should be notified. But it is still early days on how we can do it, but I certainly think it is worthwhile looking at,” she says.
“I think it is good business to notify customers, although I don’t think notification is appropriate under all circumstances. It really depends on the level of damage created by the breach.”
The push for data-disclosure laws in Australia is the result of a review of the Privacy Act being undertaken by the Australian Law Reform Commission (ALRC) which began early this year.
A discussion paper, recommending the introduction of laws which would force organisations to notify customers of security breaches, will be released next month, with the final report to be delivered to the Federal Attorney General, Philip Ruddock, in March 2008.
While a spokesperson for the Attorney General was unwilling to comment prior to the report’s release, federal government sources say the laws could be accommodated by amending the current Privacy Act, enabling their introduction by the end of 2008.
Similar legislation dealing with data breaches and disclosure laws are currently being introduced in the United States, with one law (Bill AB 779) even requiring retailers to be held responsible for the cost of a security breach. This law is scheduled to go before the Senate Appropriations Committee before August 31.
In Australia, Curtis says the ALRC’s recommendations, which will be put forward in the discussion paper in September, will lead to a wider review and more discussion.
“I think the introduction of these laws is a natural evolution of the act,” she adds.
Operations at the Office of the Privacy Commissioner have certainly been beefed-up since Curtis took the helm. Funding has more than doubled in three years, to assist with corporate compliance efforts and identify gaps in the legislation.
The push for the disclosure of data-breaches has been gaining momentum, especially after more than 100 HSBC Australia customers had their banking details exposed in a security breach, in March this year.
HSBC didn’t take any steps to notify customers, because there was no requirement for it to disclose the breach under current Australian laws.
— Additional reporting by Rob O’Neill