Understanding Data Breaches

A data breach is any event or situation where confidential data is accessed, disclosed, or falls under the control of an unauthorized individual or organisation. Although data breaches are usually digital in nature, they can also involve physical data such as paper forms, printed documents, or physical records. In the digital context, a data breach represents a data protection failure that can have serious legal, financial, and reputational consequences.

In Australia, a data breach that releases confidential personal information likely to result in serious harm to individuals is classified as a Notifiable Data Breach under the Privacy Act 1988. These breaches must be reported to the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and affected individuals must be notified.

What Constitutes a Notifiable Data Breach

Not every loss of personal information requires notification. The key threshold is whether the breach is likely to result in serious harm to affected individuals. This could include identity theft, financial loss, physical harm, psychological harm, humiliation, damage to reputation, or loss of business opportunities.

A common and important example: if a device such as a phone, tablet, or laptop contains confidential personal information that could result in serious harm if exposed, is lost or stolen, and it is possible for the data be accessed by a third party person (i.e., it's not encrypted), then this loss of the device constitutes a notifiable data breach – even if there's no evidence anyone has accessed the data. The potential for harm is sufficient to trigger notification requirements. To find out more, visit the OAIC guidance website: https://www.oaic.gov.au/privacy/notifiable-data-breaches/about-the-notifiable-data-breaches-scheme). This website is the foundation of all Data Breach information in Australia.

Types of Personal Information

Personal information under Australian privacy law includes:

Identifying information: Names, signatures, addresses, phone numbers, email addresses, or dates of birth
Employment information: Employee records, performance reviews, or workplace documentation
Biometric information: Photographs, fingerprints, or voice recordings
Financial information: Bank account details, credit card numbers, tax file numbers, or financial records
Location data: GPS coordinates, movement tracking, or location history
Sensitive information: This category receives special protection and includes:
- Health information and medical records
- Racial or ethnic origin
- Political opinions or associations
- Religious beliefs or affiliations
- Sexual orientation or practices
- Criminal records
- Membership of professional or trade associations or unions

Unauthorized disclosure or loss of any of these types of data may require a data breach notification if it's likely to result in serious harm (we are repeating this statement a number of times in this lesson to help get it front and centre in your understanding of data breaches). This means such information should be carefully protected whether in the office, at home, or while traveling.

Under Australian privacy law, "serious harm" is the threshold that determines whether a data breach must be reported to the OAIC and affected individuals. However, the legislation deliberately doesn't provide an exhaustive definition because what constitutes serious harm depends on the specific circumstances of each breach.

The OAIC provides guidance that serious harm can include, but is not limited to: Physical Harm, Psychological or Emotional Harm, Financial Loss or Economic Harm, Reputation Damage, or Discrimination.

Factors that increase likelihood of Serious Harm include the Sensitivity of Information (like those listed above), who accessed the information, volume and combination of data and context and/or circumstances. These are discussed further at the OAIC website linked to above.

Prevention Through Awareness

Data breach prevention requires that every person associated with a business understands:

What type of data is being handled – Can you identify personal information? Is it sensitive information requiring extra protection?
The implications if that data is released – Whether intentionally or accidentally, what harm could result?
User responsibilities – What security measures must be followed? What actions should be taken if a data breach is suspected?

Prevention is always better than notification. Simple measures like encrypting devices, using strong passwords, enabling remote wipe capabilities, and never leaving devices unattended in public can prevent many common breaches.

Governance and Reporting Responsibilities

The process of assessing and completing a data breach notification is part of the management duties of business owners, executives, and senior management. This responsibility forms part of a business's CyberSecurity Governance framework, which establishes who is responsible for identifying, reporting, and responding to data breaches. Effective governance ensures that breaches are detected quickly, assessed accurately, and reported appropriately within the required time frames.

Businesses should have, and employees be aware of:

Clear procedures for identifying and reporting potential breaches
Designated personnel responsible for breach assessment and notification
Documentation of data holdings and their sensitivity
Incident response plans that include breach notification procedures

These governance requirements will be discussed in greater detail in the CyberSecurity Governance Starter modules specifically targeted at business management and compliance.

Key Takeaway

Data Breaches are serious events with significant consequences. Understanding what constitutes a breach, recognizing the types of information that requires protection, and knowing when notification is required are essential for everyone who handles personal information. When in doubt about whether a breach has occurred or requires notification, consult with your organization's privacy officer, legal counsel, or contact the OAIC for guidance.

Lesson 5 – Data Breaches