When does a data breach have to be reported to the OAIC?
Promptly, once the organisation has reasonable grounds to believe an eligible data breach has occurred: unauthorised access, disclosure or loss of personal information likely to result in serious harm that remedial action has not prevented. A suspected breach must be assessed, taking all reasonable steps to finish within 30 days.
In detail
The Notifiable Data Breaches scheme in the Privacy Act 1988 has three tests. There is unauthorised access to, disclosure of, or loss of personal information the entity holds; this is likely to result in serious harm to one or more individuals; and the entity has not been able to prevent the likely risk of serious harm with remedial action.
Suspicion starts the clock. An entity aware of reasonable grounds to suspect an eligible data breach must carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 calendar days (s 26WH). The Commissioner expects entities to treat 30 days as a maximum, as the risk of serious harm often increases with time.
Once the entity has reasonable grounds to believe the breach is eligible, it must promptly notify any individual at risk of serious harm, and notify the OAIC, which asks entities to use its online form. The notification carries the entity's name and contact details, a description of the breach, the kinds of information involved and the steps individuals should take.
- Contain the incident and record what was accessed, disclosed or lost.
- Decide whether personal information the entity holds is involved.
- Work out whether serious harm to any individual is likely.
- Take remedial action where it can prevent the likely harm, and document the assessment process and outcome.
- If serious harm remains likely, notify the individuals at risk and the OAIC.
Remedial action matters. If the entity takes remedial action such that the breach would not be likely to result in serious harm, it is not an eligible data breach for that entity or for any other (s 26WF). Where an assessment cannot reasonably be completed within 30 days, the Commissioner recommends documenting the reasons for the delay.
Four exceptions apply: a breach already notified by another entity that holds the same information, an enforcement body's activities (s 26WN), a Commonwealth secrecy provision (s 26WP) and a declaration by the Commissioner (s 26WQ). A breach notified under s 75 of the My Health Records Act needs no second notification under the scheme (s 26WD).
For an Australian organisation
The scheme applies to entities with Privacy Act security obligations: Australian Government agencies, businesses and not-for-profit organisations with annual turnover of more than $3 million, private sector health service providers, credit reporting bodies, credit providers, entities that trade in personal information and tax file number recipients.
A small business operator, one without annual turnover of more than $3 million in any financial year since 2001, generally has no obligations under the APPs unless an exception applies, including a health service holding health information, a related APP entity, trading in personal information, credit reporting, Consumer Data Right accreditation or opting in under s 6EA.
A small business operator is also covered for personal information it holds for reporting under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, for Commonwealth contracts or for running a residential tenancy database.
Go deeper
