Latest news on Australian privacy and information security laws

PrivacyRules

22 Mar 202209:58

Summary

TLDRIn this Privacy Espresso episode, Kelly Dixon, a managing principal lawyer, discusses significant developments in Australian privacy law. She highlights two key consultations before parliament that aim to increase penalties and align privacy law with GDPR standards. Dixon also addresses a data breach involving New South Wales government and a case involving 7-Eleven's misuse of biometric data, emphasizing the importance of businesses understanding and implementing robust privacy policies. The discussion underscores the need for businesses to be proactive in privacy protection, especially as the OAIC shifts from education to enforcement.

Takeaways

📘 Australia is currently undergoing legislative developments in privacy law that could have significant impacts on businesses.
🔍 Two privacy consultations are before the Australian parliament, focusing on online and digital legislation, which may extend beyond just online platforms.
💰 Proposed changes include increasing privacy penalties to match those in consumer law, with fines potentially reaching up to 10 million dollars, three times the benefit of the contravention, or 10% of turnover.
🕵️‍♂️ The Australian Privacy Commissioner may be granted new investigative powers to enforce privacy laws more effectively.
📜 The second proposal aims to align Australia's privacy law more closely with GDPR standards, introducing rights such as direct action for individuals and more prescriptive notice and consent requirements.
🏥 A recent data breach in New South Wales exposed sensitive information, including defense sites and domestic violence shelters, highlighting the importance of data security.
🛑 The privacy breach was not officially classified as one by the Privacy Commissioner because the leaked data was considered business addresses, but it raised public concern.
🏪 The 7-Eleven case demonstrated the importance of obtaining proper consent and providing adequate notice when collecting personal information, especially biometric data.
📊 The OAIC's database report indicates a shift from education to enforcement in data breach management, emphasizing the need for businesses to have robust systems in place.
⏱ Australian businesses have a 30-day window to report data breaches, which is longer than the 72-hour period in some other jurisdictions, but prompt reporting is still expected.
🛡️ The key takeaway for businesses is to have privacy policies and procedures in place, train staff on data handling, and be prepared to respond to potential breaches.

Q & A

What is the main topic of discussion in the 'Privacy Espresso' episode featuring Kelly Dixon?
-The main topic of discussion is the recent developments in Australian privacy law, including legislative changes and significant cases that have implications for businesses operating in Australia.
Why should businesses be aware of the current privacy law consultations in Australia?
-Businesses should be aware of the privacy law consultations because the proposed legislation, although named as online or digital, could apply broadly to all sorts of businesses, potentially increasing penalties and introducing new privacy requirements similar to GDPR.
What are the two privacy consultations currently before the Australian Parliament?
-The two consultations are a proposed Online Privacy Bill, which would create a code for social media platforms and increase privacy penalties, and a second proposal aimed at aligning Australia's privacy law more closely with GDPR, including a direct right of action for individuals and more prescriptive notice and consent requirements.
What was the significance of the data breach involving the New South Wales government?
-The significance of the data breach was that it exposed sensitive information, including addresses of defense sites, domestic violence shelters, and infrastructure networks, raising concerns about the security of such data and the potential misuse of information by the public.
Why did the Privacy Commissioner determine that the New South Wales data breach was not a privacy breach as defined?
-The Privacy Commissioner determined that it was not a privacy breach because the leaked data consisted of business addresses, which are not typically considered private under the current definitions.
What was the outcome of the 7-Eleven case in Australia regarding customer privacy?
-The Australian Privacy Commissioner determined that 7-Eleven interfered with customer privacy by collecting biometric information through tablets in stores without adequate notice or consent, using it for demographic profiling, which was a breach of Australia's privacy principles.
What is one of the key takeaways from the recent database report by the Australian Information Commissioner?
-A key takeaway is that after four years of Australia's data breach mechanism being in place, the Privacy Commissioner is moving from education to enforcement, expecting businesses to have robust data breach response systems in place.
What are some of the actions businesses should take in light of the data breach report findings?
-Businesses should implement privacy policies, establish procedures for staff to follow in case of a breach, and provide training to staff on how to respond to potential incidents or breaches.
What is the reporting period for data breaches in Australia, and how does it compare to other jurisdictions?
-The reporting period for data breaches in Australia is up to 30 days, which is longer than the 72-hour requirement in some other jurisdictions, giving businesses more time to investigate and respond to a breach.
What is the general advice for businesses regarding data collection and privacy considerations?
-Businesses should consider what personal information they are collecting and why, ensuring that the impact on privacy is proportionate to their objectives and that they have the appropriate consent and disclosure in place.

Outlines

00:00

📜 Australian Privacy Law Developments and Consultations

In this segment, Kelly Dixon, a managing principal lawyer at McPherson Kelly in Australia, introduces the topic of recent developments in Australian privacy law. She emphasizes the importance for all businesses to be aware of ongoing privacy law consultations before the parliament, as they could have far-reaching implications beyond just digital platforms. Two key consultations are highlighted: the proposed Online Privacy Bill, which aims to establish a code for social media platforms and increase privacy penalties, and a second proposal that aligns Australia's privacy law more closely with GDPR standards. Key aspects of the latter include a direct right of action for individuals, more prescriptive notice and consent requirements, standard contractual clauses, and rights to object and erasure. Dixon advises businesses to stay informed about these legislative changes, as they could significantly impact their operations.

05:02

🚨 Recent Privacy Breaches and Commissioner Determinations in Australia

This paragraph delves into notable privacy breaches and regulatory actions in Australia. A significant incident involved a data breach in New South Wales where approximately 500,000 addresses, including sensitive sites like defense locations and domestic violence shelters, were leaked. Although the Privacy Commissioner determined it was not a breach as defined by privacy laws, the incident raised public concern and prompted a review of QR check-in processes. Another case discussed involves 7-Eleven, which was found to have violated customer privacy by collecting biometric information through in-store tablets without proper consent or disclosure. The privacy commissioner's determination underscored the importance of adequate notice and the necessity of collection for the primary purpose. The segment concludes with advice from the Office of the Australian Information Commissioner (OAIC), urging businesses to implement robust data breach mechanisms and privacy policies, train staff, and have procedures in place to address potential breaches. The message is clear: after four years of the data breach mechanism being in place, businesses should be prepared to handle such incidents effectively.

Mindmap

Keywords

💡Privacy Law

Privacy Law refers to a set of legal regulations that govern the collection, use, and disclosure of personal information. In the context of the video, Privacy Law is central as it discusses the developments and implications of privacy legislation in Australia. The script mentions that there are two privacy consultations before the Australian parliament, indicating the evolving nature of these laws and their importance to businesses.

💡Online Privacy Bill

The Online Privacy Bill is a proposed legislation in Australia aimed at creating a code for social media platforms. It is mentioned in the script as a part of the legislative developments that could significantly impact businesses. The bill not only targets social media but also proposes to increase privacy penalties and grant new investigative powers to the Privacy Commissioner, emphasizing the need for businesses to be aware of such legislative changes.

💡Privacy Penalties

Privacy Penalties are fines or punishments imposed for violations of privacy laws. The script highlights a proposal to increase these penalties in Australia to align with consumer law penalties, which could include fines up to 10 million dollars, three times the benefit gained from the violation, or 10% of a company's turnover. This underscores the severe consequences businesses may face if they do not comply with privacy regulations.

💡Data Breach

A Data Breach occurs when unauthorized individuals gain access to sensitive information. The video script discusses a specific case in New South Wales, Australia, where 500,000 addresses were leaked, including those of defense sites and domestic violence shelters. This incident, although not legally considered a privacy breach, raised concerns about the security of sensitive data and the potential risks to vulnerable individuals.

💡QR Check-ins

QR Check-ins refer to a method of tracking and recording individuals' visits to venues using Quick Response codes, especially relevant during the COVID-19 pandemic. The script mentions the QR check-ins in relation to the data breach in New South Wales, highlighting the large amount of data collected by governments and the need for careful handling and consideration of privacy implications.

💡Biometric Information

Biometric Information includes unique biological characteristics such as fingerprints, facial patterns, or iris scans. In the context of the 7-Eleven case mentioned in the script, the company collected biometric information through photographs taken for survey purposes without proper consent, leading to a breach of privacy principles and emphasizing the importance of obtaining informed consent for such data collection.

💡Demographic Profiling

Demographic Profiling is the process of collecting and analyzing data about a person's demographic characteristics, such as age, gender, or ethnicity. The script refers to 7-Eleven using biometric information for demographic profiling without consent, which was found to be a breach of privacy, illustrating the need for transparency and consent when using personal data for such purposes.

💡Privacy Commissioner

The Privacy Commissioner is an official responsible for overseeing and enforcing privacy laws. In the script, the Privacy Commissioner of Australia is mentioned in relation to the proposed legislative changes, the data breach in New South Wales, and the 7-Eleven case. The role emphasizes the importance of having an authority to investigate and determine breaches, as well as to guide businesses on privacy compliance.

💡Data Breach Mechanism

A Data Breach Mechanism refers to the procedures and systems in place for identifying, reporting, and managing data breaches. The script discusses the four-year anniversary of Australia's data breach mechanism, indicating that businesses are expected to have such mechanisms in place and are moving from an educational phase to an enforcement phase, where non-compliance can lead to penalties.

💡Human Error

Human Error refers to mistakes made by individuals that can lead to unintended consequences, such as data breaches. The script points out that a significant number of data breaches are caused by human error, emphasizing the need for businesses to train their staff on privacy policies and procedures to prevent such incidents.

💡Privacy Principles

Privacy Principles are a set of guidelines that outline how personal information should be handled in accordance with privacy laws. The script refers to a breach of Australia's privacy principles in the 7-Eleven case, where the collection of biometric information without adequate notice and consent violated these principles, highlighting the importance of adhering to these guidelines for businesses.

Highlights

Kelly Dixon, managing principal lawyer of the Danderon office of McPherson Kelly in Australia, discusses recent developments in Australian privacy law.

There are two privacy consultations before the Australian parliament, focusing on online and digital legislation with broad implications for businesses.

The proposed Online Privacy Bill aims to create a code for social media platforms and increase privacy penalties to match consumer law penalties.

New investigative powers are proposed for the Privacy Commissioner under the Online Privacy Bill.

The second proposal seeks to align Australian privacy law more closely with GDPR, introducing direct rights of action for individuals.

Legislation proposes more prescriptive notice and consent requirements, and standard contractual clauses for the first time in Australia.

Changes to default privacy settings and new rights to object and erasure are being considered, similar to GDPR jurisdictions.

A data breach in New South Wales exposed 500,000 addresses, including sensitive sites like defense locations and domestic violence shelters.

The Privacy Commissioner determined the New South Wales data leak was not a privacy breach due to the nature of the leaked data.

The data breach raised concerns about the security of sensitive sites and the public's trust in data handling.

The incident prompted a review of Australia's QR check-in process in light of the amount of data shared with the government during the pandemic.

7-Eleven in Australia was found to have interfered with customer privacy by collecting biometric information without consent.

The privacy breach by 7-Eleven involved using collected biometric data for demographic profiling without proper disclosure.

The OAIC's database report indicates a shift from education to enforcement, expecting businesses to have data breach mechanisms in place.

The report emphasizes the need for businesses to have privacy policies and procedures, and to train staff on incident response.

Most data breaches are due to malicious hacks and human error, highlighting the importance of robust privacy practices.

Australian businesses have a 30-day window to report data breaches, which is longer than the 72-hour period in some jurisdictions.