Tag:privacy

1
Privacy Awareness Week Part V – Return of the Privacy Policy
2
Privacy Awareness Week Part IV – Privacy Priorities
3
Privacy Awareness Week Part III- The importance of being privacy prepared
4
Privacy Awareness Week Part II- Get in the know and get privacy right
5
Privacy Awareness Week Part I- The state of play
6
Proposed cyber ransom bans predicted to cause “catastrophic damage”
7
Optus faces the mother-of-all data breach class actions
8
Facebook’s face-off with the OAIC to proceed says High Court of Australia
9
Breaking Down the Privacy Act Review Report #3: Removal of the Small Business Exemption
10
Breaking Down the Privacy Act Review Report #2: Modifying the employee records exemption

Privacy Awareness Week Part V – Return of the Privacy Policy

By Cameron Abbott, Rob Pulham, Stephanie Mayhew and Dadar Ahmadi-Pirshahid

You’ve reached the end of a long week, riddled with proselytising about the importance of being privacy aware and privacy prepared. You get it! You lay your head to a well-earned rest…and like Kate McCallister wake screaming “Privacy Policy”! In true “back-to-basics” fashion, the privacy policy is getting a reboot!

Read More

Privacy Awareness Week Part IV – Privacy Priorities

By Cameron Abbott, Rob Pulham and Stephanie Mayhew

Given the current privacy reform and cyber threat environment, the question we get asked a lot is – what are the privacy risks that should be assessed in our organisation and how do we prioritise these? Unfortunately this isn’t always a ‘one size fits all’ answer but there are some basic matters you can check as to whether your organisation is considering privacy risks proactively.

Read More

Privacy Awareness Week Part III- The importance of being privacy prepared

By Cameron Abbott, Rob Pulham, Stephanie Mayhew and Dadar Ahmadi-Pirshahid

The APPs require organisations to “take reasonable steps to implement practices, procedures and systems that ensure compliance with the APPs”. Putting your mind to privacy after a data breach or complaint is very much shutting the stable door after Phar Lap has bolted (good luck getting him back!)

Good privacy management starts with a good privacy culture in your organisation. Recommended steps to develop this include:

Read More

Privacy Awareness Week Part II- Get in the know and get privacy right

By Cameron Abbott, Rob Pulham, and Stephanie Mayhew

With the cyber threat landscape significantly evolving, we are seeing companies – large and small – experience attacks. Recent high-profile attacks have shown that these breaches are alarming, targeting a range of sectors. With millions of Australians more concerned about their privacy than ever before, the federal government is making privacy a priority with the Attorney-General’s Department recently releasing 116 recommendations to amend the Privacy Act. The federal government has also made proposals to consider a new Cyber Security Act and strengthen existing laws around this space. 

Read More

Privacy Awareness Week Part I- The state of play

By Cameron Abbott, Rob Pulham, and Stephanie Mayhew

The theme of this year’s Privacy Awareness Week (PAW) is “back to basics”. It’s fitting to consider some lessons arising from recent high-profile breaches affecting millions of Australians, and the consistent messages we’ve been hearing from the Australian Information Commissioner in the midst of those incidents.

Data breaches can happen to anyone. We know cyberattacks can be big business, and sophisticated criminal networks make a good living from these. And if your organisation has taken reasonable steps to avoid or mitigate such breaches, the fact you’ve encountered one will not, of itself, be held against you.

Read More

Proposed cyber ransom bans predicted to cause “catastrophic damage”

By Cameron AbbottRob PulhamStephanie Mayhew and Dadar Ahmadi-Pirshahid

We saw last year how low hackers are willing to stoop to shame companies into paying ransoms, including leaking sensitive information aimed at embarrassing individuals affected by data breaches. As a result we also saw prominent calls for ransom payments to be ‘banned’, to reduce the financial incentives for hackers to target Australians’ personal information.

We are now hearing the flipside to that argument, with AGL Energy warning that a government-imposed ban on companies paying cyber ransoms to hackers could cause “catastrophic damage”.

Read More

Optus faces the mother-of-all data breach class actions

By Cameron Abbott, Rob Pulham, Stephanie Mayhew and Dadar Ahmadi-Pirshahid

The data breach that affected 9.8 million Australians and resulted in the personal information of 10,000 Optus customers being exposed on the dark web in September last year will be litigated in a class action lawsuit filed last Friday (21 April) in the Federal Court of Australia.

Read More

Facebook’s face-off with the OAIC to proceed says High Court of Australia

By Cameron Abbott, Rob Pulham, Stephanie Mayhew and Dadar Ahmadi-Pirshahid

Proceedings led by the Office of the Australian Information Commissioner (OAIC) against Facebook, Inc. (Facebook) for their role in the Cambridge Analytica scandal will finally proceed in the Federal Court of Australia.

Read More

Breaking Down the Privacy Act Review Report #3: Removal of the Small Business Exemption

By Cameron AbbottRob Pulham and Stephanie Mayhew

Currently, most small businesses (with some exceptions) are not covered by the Privacy Act – with the threshold shaping a small business being an annual turnover of $3 million or less. However the Attorney General’s Department recognises that Australians want their privacy protected and that small businesses shouldn’t be excepted from this.

In the long term, proposal 6.1 seeks to remove the small business exemption but only after:

  • an impact analysis has been undertaken
  • appropriate support is developed
  • in consultation with small businesses, the most appropriate way for small business to meet their obligations is determined (propionate to the risk) – e.g. through a code, and
  • small businesses are in a position to comply with these obligations.

Proposal 6.2, in the shorter term, seeks to ensure that small businesses comply with the Privacy Act in relation to the collection of biometric information and remove the exemption from the Privacy Act for small businesses that obtain consent to trade in personal information (trading in personal information will mean the Privacy Act applies).

Read More

Breaking Down the Privacy Act Review Report #2: Modifying the employee records exemption

By Cameron AbbottRob Pulham and Stephanie Mayhew

The section of the Report dealing with the employee records exemption highlighted significant debate and difference of opinion. Employers expressed a strong desire to retain or even strengthen the exemption; employee representatives consider reform is needed.

In that context the Report does not conclude how the changes should take effect, but proposals 7.1(a)-7.1(d) recommend stronger protection of private sector employee information, to:

  • enhance transparency over what employee information is collected and why
  • ensure employers have adequate flexibility to deal with employees’ information to administer the employment relationship (and addressing whether consent should be required to collect sensitive information)
  • ensure adequate security and destruction measures around employee personal information, and
  • notify employees and the OAIC of data breaches involving employee personal information.

What does this mean for my organisation?

Private sector employers who don’t yet have a good grasp of the breadth of information they collect and hold about their employees will need to stocktake their collection activities and sharpen their focus on why they collect such information; prepare appropriate collection notices and employee privacy policies (if not used already); and ensure employee information is appropriately covered in their security measures and considered in their data breach response plans.

Read More

Copyright © 2024, K&L Gates LLP. All Rights Reserved.