6 Key Facts You Need to Know About Australia’s Latest Data Breaches

Australian Data Breach Laws

Revelations from the OAIC data breach reports

On February 22, 2018, the Office of the Australian Information Commissioner (OAIC) introduced mandatory data breach notification laws. The legislation was backed by severe penalties for anyone who fails to adequately report and remedy data breaches on their networks. While this may sound draconian, the intention behind the legislation is to give the OAIC and Australian businesses a clear picture of the true causes of data breaches. 

Few people enjoy wading into the dry phraseology inherent to legislation and research reports. However, there are some powerful benefits to be gained from understanding the legislation and engaging with the OAIC’s reports. To save you time, we’ve condensed the relevant information into the following seven points.

Why track the OAIC data breach reports?

Twice yearly, the OAIC publishes a data breach report, revealing the main cybersecurity threats being faced by Australian businesses. In addition to offering an instant snapshot of the year’s data breaches, these reports are, over time, allowing for more and more in-depth analysis of emerging trends and issues.  

snapshot-all-in-one data breaches
Source: OAIC

While this data is valuable to regulating bodies, it also offers priceless information to business owners who are serious about protecting their systems and sensitive data from both malicious and error-based breaches. 

As Australian Privacy and Information Commissioner Timothy Pilgrim explained when the legislation was announced, 

“The new scheme will strengthen the protections afforded to everyone’s personal information and will improve transparency in the way that the public and private sectors respond to serious data breaches. It will also give individuals the opportunity to take steps to minimise the damage that can result from unauthorised use of their personal information.

Malicious attacks aren’t the only data breach causes

Data breaches caused by human error were down in the first half of 2021, accounting for 30% of the total compared to 34% the previous year. However, with 134 notifications stemming from mistakes made by employees and stakeholders, this is still a significant risk for business owners to be aware of.

Simple training around cybersecurity and IT best practices – both in the office and at home – can save a company millions in lost revenue if it prevents even a single data breach. Then, of course, there’s the benefit of avoiding the potential for a costly OAIC fine (more on this below).

What is an eligible data breach? 

The 2016 bill amends the Privacy Act (1988) “to introduce mandatory data breach notification provisions for agencies, organisations and certain other entities that are regulated by the Privacy Act.”  Under the amendments, organisations must report an “eligible data breach” to the OAIC and notify affected customers immediately.  

An eligible data breach occurs “where personal information held by an entity is subject to unauthorised access or unauthorised disclosure and a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the personal information relates.” (Privacy Amendment (Notifiable Data Breaches) Bill 2017)

There is an exception for situations where the entity takes remedial action before the access or disclosure results in serious harm. Other exceptions relate to law enforcement-related activities and the application of secrecy provisions in other laws. 

Does swift remedial action negate the need to report to the OAIC?

This depends on a number of factors, including the nature of the data that’s been compromised, the source of the breach, and the actions taken by the company. Sometimes, even the swiftest remedial action is not enough for the breach to count as an exception. 

If, for example, an email containing sensitive data is sent to a group of external parties, it is not sufficient to simply contact those parties and ask for them to delete the data. Unless you can confirm with absolute certainty that the data has not been accessed or copied, it is likely to still qualify as a reportable data breach. If in doubt, it’s best to contact your IT support provider or the OAIC.

What should your data breach response plan look like?

The bill specifies that your statement to the OAIC must include:

  1. A description of the data breach
  2. The nature of the information involved
  3. Recommendations for steps any affected parties should take in response to the incident 

The reason for step three is that you must notify all affected individuals of the contents of the statement. Business owners should also be aware that the OAIC may contact you before you’ve provided this statement if it believes an eligible data breach has occurred. If this happens, you must still write up a notification. 

If you fail to notify the OAIC of a data breach and it is found to constitute a serious interference with privacy under the Privacy Act (1988), you can be penalised with a fine of up to AU$360,000 for individuals and AU$1.8 million for organisations (about US$274,560 and US$1.37 million, respectively). 

Invotec Can Help You Comply with Data Breach Notification Laws

The best way to avoid getting on the wrong side of the OAIC is to protect your business from data breaches in the first place. Of course, the OAIC fines are just one of many pressing reasons why you need comprehensive, up-to-date cybersecurity measures in place to safeguard your systems and your data. 

Invotec provides total data protection to Melbourne businesses, covering every necessary angle with our on-point security tools, monitoring, and assessment-remedy procedures.

We’ll also help you stay in compliance with the data breach notification laws,  and we’re happy to help you better understand what constitutes proper reporting and notification to the OAIC.  

If you have any questions about your OAIC obligations or cybersecurity measures, feel free to call an Invotec representative at 1300 468 683 or email us at [email protected] for more information.

Share this post

Invotec Solutions IconInvotec Solutions

Unit 9/148 Chesterville Road, Cheltenham

5.0 7 reviews

  • Avatar Matt Wilde ★★★★★ 3 months ago
    Working with an education solutions expert such as Invotec has meant that we have had a collaborative partner every step of the way in the development of, not only our ICT network infrastructure, but also in determining how best to engage … More students, deliver content, and drive learning outcomes.
  • Avatar Daniel McNairn ★★★★★ 11 months ago
    Invotec Solutions is a great company. Working in the education field they have been great support when we have had technical issues that have needed high level solutions. I know they have worked throughout the Catholic Education system … More and have always delivered a high level of service and support. Very easy to deal with and friendly support.
  • Avatar Marcia Reynolds ★★★★★ 10 months ago
    Invotec were fantastic! Being a small business owner and IT illiterate, Invotec helped me to get up and operating without an issue.
    I now feel secure knowing that they are there to back me up.
  • Avatar Aaron Hawke ★★★★★ a year ago
    I had the pleasure of working with the Invotec Solutions Team for our Cyber Security requirements. They really know their stuff and my expectations were well exceeded. Thanks Guys, You made it easy!
  • Avatar Korin Roehm ★★★★★ 2 years ago
    Invotec has been a great partner to our company. They're very quick and responsive. If you talk to anyone there you know that they're very knowledgeable in the work that they do.
  • Avatar Jan Chapman ★★★★★ 2 years ago
    Invotec really know their stuff, a great company that want to provide the best service possible. I highly recommend them.

Get a Quote