The Secure Times

An online forum of the ABA Section of Antitrust Law's Privacy and Information Security Committee

Australia issues draft voluntary data breach guidelines

Leave a comment

The Australian Office of the Privacy Commissioner has released a consultation draft of data breach response guidelines.

The guidelines recommend four steps in responding to a breach:

  1. Contain the breach and do a preliminary assessment.
  2. Evaluate the risks associated with the breach, for example, what information is involved, who and what caused the breach, who is affected, and what is the risk of harm to those affected.
  3. Consider and issue notification.
    • When to notify? Most importantly, the OPC has recommended a harm-based analysis for notification: "In general, if an information security breach creates a real risk of serious harm to the individual, those affected should be notified."
    • How to notify? Notification may be sent directly to the affected individuals, for example by phone, mail, in person or (notably) email. Indirect notification, for example, in the media or posted on a website, should occur only when direct notification could cause further harm, when costs are prohibitive, or when contact details for affected individuals cannot be determined.
    • What to notify? The draft recommends type of information involved, how the company has responded, what assistance is being provided to affected individuals or other sources of information available, company contact details, whether the regulator has been notified, and how a complaint may be lodged with the Privacy Commissioner.
  4. Prevent future breaches.

While the Privacy Commissioner has issued these voluntary guidelines, she has also recommended mandatory breach notification to be included in the coming rewrite of the Privacy Act. So this draft provides insight into how Australia might incorporate such a notification requirement.

Comments have been requested by June 16, 2008 and can be sent to

Author: ABA Antitrust

Learn more about the ABA Section of Antitrust Law:

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s