<
https://theconversation.com/after-the-optus-data-breach-australia-needs-mandatory-disclosure-laws-192612>
"The Optus data breach, which has affected close to 10 million Australians, has
sparked calls for changes to Australia’s privacy laws, placing limits on what
and for how long organisations can hold our personal data.
Equally important is to strengthen obligations for organisations to publicly
disclose data breaches. Optus made a public announcement about its breach, but
was not legally required to do so.
In fact, beyond the aggregated data produced by the Office of the Australian
Information Commissioner, the public is not made aware of the vast majority of
data breaches that occur in Australia every year.
Australia has had a “Notifiable Data Breaches” scheme since February 2018 that
requires all organisation to notify affected individuals as well as the Office
of the Australian Information Commissioner in the case a breach of personal
information likely to result in serious harm.
However, no notification is required if the organisation takes remedial action
to prevent harm. Most importantly, public disclosure is never required.
This gives a lot of discretion to organisations. They can make their own
assessment about the risks and decide not to disclose a breach at all.
Companies listed on the Australian Securities Exchange (ASX) are also obliged
to disclose any data breach expected to have a “material economic impact” on a
company’s share price. But it is notoriously difficult to measure material
economic impact. So these announcements are not a reliable source of
information for the public."
Cheers,
*** Xanni ***
--
mailto:xanni@xanadu.net Andrew Pam
http://xanadu.com.au/ Chief Scientist, Xanadu
https://glasswings.com.au/ Partner, Glass Wings
https://sericyb.com.au/ Manager, Serious Cybernetics
