Latest news on Australian privacy and information security laws

Summary

In this Privacy Espresso episode, Kelly Dixon, a managing principal lawyer, discusses significant developments in Australian privacy law. She highlights two key consultations before parliament that aim to increase penalties and align privacy law with GDPR standards. Dixon also addresses a data breach involving New South Wales government and a case involving 7-Eleven's misuse of biometric data, emphasizing the importance of businesses understanding and implementing robust privacy policies. The discussion underscores the need for businesses to be proactive in privacy protection, especially as the OAIC shifts from education to enforcement.

Takeaways

• 📘 Australia is currently undergoing legislative developments in privacy law that could have significant impacts on businesses.
• 🔍 Two privacy consultations are before the Australian parliament, focusing on online and digital legislation, which may extend beyond just online platforms.
• 💰 Proposed changes include increasing privacy penalties to match those in consumer law, with fines potentially reaching up to 10 million dollars, three times the benefit of the contravention, or 10% of turnover.
• 🕵️‍♂️ The Australian Privacy Commissioner may be granted new investigative powers to enforce privacy laws more effectively.
• 📜 The second proposal aims to align Australia's privacy law more closely with GDPR standards, introducing rights such as direct action for individuals and more prescriptive notice and consent requirements.
• 🏥 A recent data breach in New South Wales exposed sensitive information, including defense sites and domestic violence shelters, highlighting the importance of data security.
• 🛑 The privacy breach was not officially classified as one by the Privacy Commissioner because the leaked data was considered business addresses, but it raised public concern.
• 🏪 The 7-Eleven case demonstrated the importance of obtaining proper consent and providing adequate notice when collecting personal information, especially biometric data.
• 📊 The OAIC's database report indicates a shift from education to enforcement in data breach management, emphasizing the need for businesses to have robust systems in place.
• ⏱ Australian businesses have a 30-day window to report data breaches, which is longer than the 72-hour period in some other jurisdictions, but prompt reporting is still expected.
• 🛡️ The key takeaway for businesses is to have privacy policies and procedures in place, train staff on data handling, and be prepared to respond to potential breaches.

Q & A

What is the main topic of discussion in the 'Privacy Espresso' episode featuring Kelly Dixon?

The main topic of discussion is the recent developments in Australian privacy law, including legislative changes and significant cases that have implications for businesses operating in Australia.

Why should businesses be aware of the current privacy law consultations in Australia?

Businesses should be aware of the privacy law consultations because the proposed legislation, although named as online or digital, could apply broadly to all sorts of businesses, potentially increasing penalties and introducing new privacy requirements similar to GDPR.

What are the two privacy consultations currently before the Australian Parliament?

The two consultations are a proposed Online Privacy Bill, which would create a code for social media platforms and increase privacy penalties, and a second proposal aimed at aligning Australia's privacy law more closely with GDPR, including a direct right of action for individuals and more prescriptive notice and consent requirements.

What was the significance of the data breach involving the New South Wales government?

The significance of the data breach was that it exposed sensitive information, including addresses of defense sites, domestic violence shelters, and infrastructure networks, raising concerns about the security of such data and the potential misuse of information by the public.

Why did the Privacy Commissioner determine that the New South Wales data breach was not a privacy breach as defined?

The Privacy Commissioner determined that it was not a privacy breach because the leaked data consisted of business addresses, which are not typically considered private under the current definitions.

What was the outcome of the 7-Eleven case in Australia regarding customer privacy?

The Australian Privacy Commissioner determined that 7-Eleven interfered with customer privacy by collecting biometric information through tablets in stores without adequate notice or consent, using it for demographic profiling, which was a breach of Australia's privacy principles.

What is one of the key takeaways from the recent database report by the Australian Information Commissioner?

A key takeaway is that after four years of Australia's data breach mechanism being in place, the Privacy Commissioner is moving from education to enforcement, expecting businesses to have robust data breach response systems in place.

What are some of the actions businesses should take in light of the data breach report findings?

Businesses should implement privacy policies, establish procedures for staff to follow in case of a breach, and provide training to staff on how to respond to potential incidents or breaches.

What is the reporting period for data breaches in Australia, and how does it compare to other jurisdictions?

The reporting period for data breaches in Australia is up to 30 days, which is longer than the 72-hour requirement in some other jurisdictions, giving businesses more time to investigate and respond to a breach.

What is the general advice for businesses regarding data collection and privacy considerations?

Businesses should consider what personal information they are collecting and why, ensuring that the impact on privacy is proportionate to their objectives and that they have the appropriate consent and disclosure in place.