Mandatory data breach laws vital in 21st century, warns technology lawyer

26 October 2012

Laws making it mandatory to report data security breaches are vital to protecting confidential information in the 21st century, says a leading Queensland intellectual property and technology lawyer.

Attorney-General Nicola Roxon last week issued a discussion paper entitled Australian Privacy Breach Notification, which looks at the notification requirements government agencies and large private-sector organisations should have to meet when they suffer a data breach.

HopgoodGanim senior associate Hayden Delaney says that the ICT industry has been calling for these laws for some time, and that a conversation at Government level is long overdue.

“As a society, we’re sharing more information electronically and transacting more in the digital world than ever before. For the first time in history, a child has a digital presence as soon as they are born, whether it’s Facebook photos shared by their parents or medical records that are kept electronically. Personal information is being collected and stored in a way that was never previously possible. That information has the capacity to live on long after we die.

Delaney says that there are currently no mandatory requirements under Australian law to report data breaches.

“While companies are encouraged to disclose the details of a data breach, it’s not compulsory. The statistics tell us that many breaches go unreported and therefore unnoticed.

“This makes it easy for breached data to be misused. If reporting was mandatory, those whose data had been breached would have a better chance of taking steps to mitigate the effects of the breach - for example, by changing their password or cancelling their credit card if those details had been stolen.

Delaney believes there should be express exemptions to mandatory reporting if the breached data was adequately encrypted.

“If data is encrypted properly, using the right algorithm, then it really isn’t at risk if it is illegally accessed or used - it will be computationally infeasible to ‘break’ the encryption and all you need to do to destroy that data is to destroy the encryption key associated with it.

“Experience in places like the US has shown that mandatory data breach disclosure laws that include an express exemption for encrypted data also spur on the ICT security industry and create a real incentive for organisations to invest in network and data security systems, dramatically reducing the overall impact of breaches. With some areas of the economy now softening, it makes sense for the Government to enact laws which encourage growth in other areas, like the ICT sector.

Delaney says that while there are arguments both for and against mandatory reporting, the sheer amount of data that is stored electronically means that laws around data breaches are essential to ensure that organisations are accountable for protecting the data they hold.

The paper has called for consultation and discussion on a number of key areas, including:

  • Which privacy breaches should be reported? Should ‘minor breaches’ be exempted and, if so, how should a minor breach be measured?
  • Who should decide on whether the breach should be disclosed? The affected organisation or the regulator?
  • How soon should the breach be reported and what should the penalties be?

“The Attorney-General’s discussion paper has the potential to lead to the introduction of a regime ensuring responsible data management across Australia, Delaney says. “Privacy is going to be a major issue in the 21st century, and we absolutely need laws which address it.

Delaney was recommended in Doyle’s Guide to Queensland’s Leading Telecommunications, Media and Technology Lawyers, 2012.

Esther Cohen, Senior Communications Advisor
Tel: 07 3024 0192