Click your “e-John Hancock” onto that: COVID-19 helps the Australian Government clear the way for electronic execution under section 127(1) of the Corporations Act
3
Privacy Professionals download COVIDSafe App
4
It’s Trace Time! The COVIDSafe App is open for business – Part II
5
It’s Trace Time! The COVIDSafe App is open for business – Part I
6
“This is a public health app, it’s not a surveillance app”: Review finds “nothing particularly disturbing” about the Federal Government’s coronavirus tracing app
7
Privacy in the time of COVID-19
8
Uniformity of Law II: NSW Government pledges to introduce Mandatory Data Breach Reporting in respect to State Government Agencies
9
This is your digital life (of no consent or control): The Australian Information Commissioner takes Facebook to Court
10
You’ve got mail…and lots of it according to the latest OAIC report!
On the morning of 16 July 2020, in a significant decision of the Court of Justice of the European Union (CJEU), the Privacy Shield was held to be invalid.
Temporary amendments to the Australian Corporations Act2001 (Cth) (Corporations Act) took effect on 6 May 2020, making it easier to facilitate company meetings using remote technology, and providing some certainty as to companies’ execution of documents electronically under section 127(1) of the Corporations Act.
A number of legal professionals, with significant experience in the field of privacy law, have signed an open letter to encourage individuals to download the Commonwealth Government’s COVIDSafe App.
Among the privacy lawyers are members of K&L Gates own Australian privacy team (and the authors of this blog post) Cameron Abbott, Rob Pulham, Warwick Andersen, Michelle Aggromito and Allison Wallace.
The open letter is signed by members in their personal capacity, and signals that people who care about privacy a lot can still think that supporting the health and economic objectives of the App is more important at this time.
As at the date of this post, more than 5 million people have downloaded the App, with more needed to reach the Commonwealth Government’s target of 40% of the Australian population.
In Part I of this blog, we briefly touched on some of the safeguards that the Commonwealth Government has indicated that they will implement to address privacy concerns. Those proposed new safeguards are intended to satisfy many of the privacy concerns. However, there are additional safeguards that have been implemented in connection with the functionality of the App, which we focus on in Part II here.
The Commonwealth Government released its COVIDSafe App for download at 6.00pm AEST on Sunday 26 April, and it surpassed 1.13 million downloads within the first 12 hours. This was far greater than expectations, with Health Minister Greg Hunt commenting that, at best, the hope was that “we might get to 1 million in five days.”
The Federal Government’s coronavirus tracing app has raised some privacy concerns amongst the Australian public. Even some of our government Ministers have ruled out downloading the app due to such concerns! However, the independent cyber security body tasked with reviewing the app has said that it has found no major concerns with it.
Nothing can stop us from talking about privacy, including a pandemic! Yesterday, the Office of the Australian Information Commissioner (OAIC) issued guidance on the collection, use and disclosure of personal information during the COVID-19 pandemic (Guidance).
It mainly serves as a reminder to organisations that even in
these pressing times, they must comply with the Australian privacy regime.
However, it also highlights what organisations can collect and do with personal
information for the purposes of preventing and managing the spread of COVID-19.
Following
on from the consultation
opened by the NSW Government in July 2019 (the subject of a previous
blog), NSW Attorney-General Mark Speakman has committed to introducing a
mandatory data breach scheme, according to an article by ITNews.
At
present, neither NSW privacy laws nor the notifiable data breach scheme under
Part IIIC of the Privacy Act 1988 (Cth)
require public sector agencies in NSW to notify the NSW Privacy Commissioner
and affected individuals where a data breach creates a risk of serious harm.
This led to a consultation conducted by the Department of Communities and
Justice in late 2019, which revealed “overwhelming public support”
for the introduction of a mandatory data breach scheme in NSW, with the NSW
Government “sharing a view” that the relevant scheme should be
introduced.
In a first for Australia, the Australian Information
Commissioner (Commissioner) has
launched proceedings in the Federal Court of Australia, seeking penalties
against Facebook for serious and/or repeated interferences with privacy. The
contraventions relate to the conduct disclosed by the Cambridge Analytica
scandal, which involved the This is Your
Digital Life app (App). We’ve
previously blogged about the App here.
It is unclear how the penalties will be calculated in this
proceeding. The penalty rate applicable to the relevant period (being from
March 2014 to May 2015) is a maximum of $1.7 million. Some have suggested that
fines may be in the billions if the maximum rate is applied to each individual
affected as a single “contravention” (with possibly over 300,000
contraventions in total!). This may be fun to calculate, but highly unlikely to
be applied in reality.
With email being one of the most common forms of communication, it’s not surprising that inboxes these days accumulate thousands of emails that, perhaps, aren’t always electronically filed or deleted (not ours of course).
As the Office of the Australian Information Commissioner (OAIC) has indicated in its most recent report on notifications received under the Notifiable Data Breach (NBD) scheme, email accounts are frequently being used for storage, and this raises inherent risk. Yes it’s convenient, but using email to send personal information, such as copies of passports, bank account details and credit card information, can very quickly lose its appeal. If the email account is accessed by a malicious actor through a phishing attack or a rogue employee, the end result can be exploitation of that information for criminal gain.