Key points

• During the most recent reporting period (July to December 2022) the Office of the Australian Information Commissioner (OAIC) has reported:

• A 41% increase in malicious or criminal cyber-attacks.
• Malicious or criminal attacks account for 70% of all data breach notifications to the OAIC.
• The Health Care sector reported the greatest number of data breaches of any sector.

• On average, a cybercrime report is made to the Australian Cyber Security Centre once every 7 minutes.
• Significant privacy law reforms came into effect on 12 December 2022 to increase the powers of the OAIC and civil penalties for breaches of privacy law.
• The Attorney-General’s Department has issued a Privacy Act Review Report (Report) which contained 116 proposals for reforming the Privacy Act 1988 (Cth) (Privacy Act).
• It is important for Not-for-Profits, including Health Care Providers, Disability Service Providers and Aged Care Providers, to “cyber-ready” their organisations.

This update outlines some of the key principles under the Privacy Act in relation to data breaches that Not-for-Profits and Charities should be aware of in order to ensure that their organisation is “cyber-ready”.

Step 1 – Understand your legal obligations

What is the Privacy Act?

The Privacy Act is the key federal law regulating the collection, use, disclosure and storage of personal information and sensitive information. States and territories also have their own privacy laws and there are laws which govern certain types of information, activities or industries (i.e. specific laws relating to surveillance activities or medical records).

Certain organisations are obliged to comply with the Privacy Act. This includes a wide range of organisations, for example:

• organisations with an annual income of over AU$3 million;
• organisations providing a health service to a person; or
• contract services providers (i.e. aged care providers or disability service providers) under a Commonwealth agreement.

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, for example their name, contact details, credit information and sensitive information.

Sensitive information includes information about an individual’s race, ethnicity, religion, philosophical beliefs, political opinions or associations, professional or trade association or trade union memberships, health information, genetic information, sexual orientation, criminal record and biometric information or templates.

The Privacy Act contains various obligations relating to personal information. A higher level of protection applies in relation to sensitive information.

The Privacy Act includes a notifiable data breach regime which applies in relation to data breaches.

What is the Notifiable Data Breach (NDB) regime?

Under the NDB scheme, organisations must notify the OAIC and impacted individuals in the event of an Eligible Data Breach.

An Eligible Data Breach occurs when the following criteria are met:

• there is unauthorised access to, or disclosure of, personal information held by an entity (or information is lost in circumstances where unauthorised access or disclosure is likely to occur);
• this is likely to result in serious harm to any of the individuals to whom the information relates; and
• the entity has been unable to prevent the likely risk of serious harm with remedial action.

Serious harm could include serious physical, psychological, emotional, financial or reputational harm.

Who do you notify is there has been an Eligible Data Breach?

If there has been an Eligible Data Breach you must notify the OAIC (see: Data breaches | OAIC) and the impacted individuals.

In addition to the OAIC you should also consider whether you are required, or it is advisable, to notify:

• the Australian Charities and Not for Profits Commission;
• industry regulators such as the NDIS Quality and Safeguard Commission and Aged Care Quality and Safety Commission;
• state and territory health authorities; and
• suppliers, contractors, customers and other third parties where the terms of the contract mandate reporting of a data breach.

What are the penalties if things go wrong?

Previously, the maximum penalty for a serious or repeated interference with the privacy of an individual was capped at AU$2.22 million.

As of December 2022, the maximum civil penalty has been increased to the greater of:

• AU$50 million;
• three times the value of any benefit obtained through the contravention; or
• if the benefit cannot be determined, 30% of the organisation’s domestic turnover in the ‘breach turnover period’.

Step 2 – Review your Data Breach Response Plan

A data breach response plan sets out the procedures that your organisation should follow in the event of a data breach or suspected data breach.

The OAIC recommends that all organisations have a plan which includes:

• a clear definition of what constitutes a data breach;
• strategies for managing data breaches;
• escalation protocols;
• procedures to notify individuals, regulators and third parties;
• record-keeping policies; and
• post-breach review procedures.

Step 3 – Review your Privacy Policies and Practices

Organisations should ensure that their privacy policies and practices comply with the requirements of the Privacy Act and other applicable privacy laws.

The Privacy Act requires organisations to, amongst other obligations:

• take reasonable steps to implement practices, procedures and systems that will ensure the organisation complies with the Australian Privacy Principles (as contained in the Privacy Act) and is able to deal with related inquiries and complaints.
• have a clearly expressed and up-to-date Privacy Policy about how the organisation manages personal information.
• take reasonable steps to make its Privacy Policy available free of charge in an appropriate form and, upon request, in a particular form.

It is important that an organisation also has the internal practices and procedures in place to ensure it handles personal information as described in its Privacy Policy.

Step 4 – Consider obtaining cyber liability insurance

A cyber liability insurance policy may protect an organisation against internet related risks, including computer and network hacking, fraud, data breaches and cyber extortion.

When reviewing your cyber liability cover, you must ensure that the policy covers not only the organisation, but also its directors, employees, officers, and volunteers.

You should also check that the policy covers acts that occur before the policy was taken out, as cyber breaches are frequently detected after they occur.

Step 5 – Keep up with the changes in the law

Following the Attorney General’s Privacy Act Review, reforms to privacy laws are expected in the non-too-distant-future. Whilst the Report did not include draft legislation and the specific reforms are not known, we nonetheless have a clearer picture of the likely reforms to the Privacy Act. Accordingly, organisations should commence preparing for law reform in this area and they should stay on top of the proposed changes.

As part of this preparation, organisations should ensure that they undertake data mapping and data audit activities so that they are aware of what information they collect, use and disclose and how that information is stored and managed.

Step 6 – Reach out for expert assistance

If you:

• have any concerns;
• would like our assistance in understanding your obligations under the relevant privacy laws or in preparing a data breach response plan; or
• in relation to any other privacy matter,

please feel free to reach out to us for a confidential discussion about your organisation’s circumstances.

Meet the Dentons’ Not-for-Profit Advisory team:

• Caroline Snow, Brisbane
  • Email: caroline.snow@dentons.com
  • Tel: +61 7 3074 1169
• Campbell Hudson, Sydney
  • Email: campbell.hudson@dentons.com
  • Tel: +61 2 9931 4957