Notifiable Data Breaches Scheme

The main point of the NDB scheme is not to protect the company that was breached, but to protect the people whose personal information has been released without their authority. Not advising potentially affected victims of a data breach prevents individuals from being able to act to take proactive measure to protect their data, or seek compensation from the companies.

The NDB scheme will apply to all ‘APP entities’. APP entities are entities that are required to comply with the Australian Privacy Principles under the Privacy Act.

‘APP entities’ includes all businesses with an annual turnover of more than $3 million. However, be advised that ‘APP entities’ also includes small businesses (i.e. businesses with turnovers of less than $3 million) if they are:

• Private sector health service providers (including medical practitioners, pharmacists, gyms and weight loss clinics)
• Complementary therapists, such as chiropractors or psychologists
• Childcare centres, private schools and private tertiary educational institutions
• Businesses that sell or purchase personal information
• Credit reporting bodies
• Related to a business that is an APP entity

If you’re covered under the NDB scheme, you must report any breach of personal information that is “likely to result in serious harm”.

Whilst some may consider the term “serious harm” vague, it can include:

• Physical harm
• Financial/economic harm
• Emotional harm (e.g. embarrassment and humiliation)
• Psychological harm (e.g. marginalisation and bullying)
• Reputational harm

To determine whether a data breach is likely to cause ‘serious harm’ (and is therefore a Notifiable Data Breach), you should consider factors such as:

• The type of information breached
• Whether the information is protected by other security measures and the probability that someone can overcome those measures
• The people who may have access to the information as a result of the breach
• The nature of the harm that might arise from the breach

A ‘data breach’ is defined generally as a situation where ‘personal information held by an agency or organisation is lost or subjected to unauthorised access, modification, disclosure or other misuse or interference’.

A ‘Notifiable Data Breach’ arises if:

• • There has been an unauthorised access or disclosure of information and it is reasonable to believe that it could result in serious harm to individuals (e.g. if your database has been accessed, compromised or hacked); or
  • If information is lost where an unauthorised access is likely and it is reasonable to believe that it could result in serious harm to individuals (e.g. if your employee forgot a folder with clients’ personal information in a public place).

If an APP entity suspects that a data breach has occurred, it must carry out an assessment within 30 days to verify whether the breach occurred and ascertain whether it is a Notifiable Data Breach.

The breach must also be notified to the affected individuals using any reasonable direct method of communication (e.g. phone call, email, SMS, letter in the mail or via your company website).

A notification of a Notifiable Data Breach must include the following information:

• The identity and contact details of the APP entity
• A description of the breach
• The types of information exposed by the breach
• Recommendations about the steps that people should take in response to the breach