of Serious Data Breaches) Bill 2015 (Bill), Explanatory Memorandum and the accompanying Early Assessment Regulatory Impact Statement. Microsoft is supportive of the new Bill and its intention improve the privacy of Australians ‘to without placing an unreasonable regulatory burden on business’, and encourages the introduction of the Bill into Parliament in 2016. We believe the Bill strikes an appropriate balance between protecting the privacy of individuals, without imposing an overly administrative burden on Australian Privacy Principal Entities. Microsoft looks forward to guidance from the Office of Australian Information Commissioner (OAIC) on the Bill. We encourage the AGD to continue to work in close consultation with industry with regards to both the development of future guidance and regulations, and we welcome any opportunity to be engaged. We also encourage the AGD to provide further clarifications and guidelines on the types of incidents that trigger notification obligations, with a view to avoid over-reporting that may occur when organisations are unsure of what constitutes a serious data breach, as well as the notification fatigue and administrative burden that would accompany it. Microsoft’s approach to privacy Protecting and maintaining customer privacy is an utmost priority for Microsoft. We understand that data breaches put consumers at risk of and identity theft, and jeopardise the trust relationship between consumers and business. One of the ways organisations can give customers confidence that their data will be handled appropriately is to ensure that in the event there is a serious security breach that gives rise to a real risk of serious harm, they will be notified as soon as practicable. For almost 20 Microsoft has been a leader in developing industry leading privacy policies, compliance programs and security measures that we apply across our online and cloud services. Our commitment to the privacy of our customer data is backed by the Microsoft Online Services Privacy Statement, which describes the specific privacy policy and practices covering customer data in the Microsoft Cloud. Today, Microsoft’s services are used by over a billion customers around the globe. Microsoft understands that data protection and privacy is a truly international issue. Microsoft adheres to existing standards and regulations internationally, and seeks to anticipate and comply with any developments as they arise. We were the first major cloud provider to adopt the first international code of practice for cloud privacy, ISO/IEC 27018. This standard requires that providers comply with legislative requirements to disclose privacy breaches where they exist. Further, the passing of this legislation could see Australia rise on the BSA Global Cloud Computing Scorecard from its already high ranking of 2 out of 24 countries. The only negative
of Serious Data Breaches) Bill 2015 (Bill), Explanatory Memorandum and the accompanying Early Assessment Regulatory Impact Statement. Microsoft is supportive of the new Bill and its intention ‘to improve the privacy of Australians without placing an unreasonable regulatory burden on business’, and encourages the introduction of the Bill into Parliament in 2016. We believe the Bill strikes an appropriate balance between protecting the privacy of individuals, without imposing an overly administrative burden on Australian Privacy Principal Entities. Microsoft looks forward to guidance from the Office of Australian Information Commissioner (OAIC) on the Bill. We encourage the AGD to continue to work in close consultation with industry with regards to both the development of future guidance and regulations, and we welcome any opportunity to be engaged. We also encourage the AGD to provide further clarifications and guidelines on the types of incidents that trigger notification obligations, with a view to avoid over-reporting that may occur when organisations are unsure of what constitutes a serious data breach, as well as the notification fatigue and administrative burden that would accompany it. Microsoft’s approach to privacy Protecting and maintaining customer privacy is an utmost priority for Microsoft. We understand that data breaches put consumers at risk of and identity theft, and jeopardise the trust relationship between consumers and business. One of the ways organisations can give customers confidence that their data will be handled appropriately is to ensure that in the event there is a serious security breach that gives rise to a real risk of serious harm, they will be notified as soon as practicable. For almost 20 Microsoft has been a leader in developing industry leading privacy policies, compliance programs and security measures that we apply across our online and cloud services. Our commitment to the privacy of our customer data is backed by the Microsoft Online Services Privacy Statement, which describes the specific privacy policy and practices covering customer data in the Microsoft Cloud. Today, Microsoft’s services are used by over a billion customers around the globe. Microsoft understands that data protection and privacy is a truly international issue. Microsoft adheres to existing standards and regulations internationally, and seeks to anticipate and comply with any developments as they arise. We were the first major cloud provider to adopt the first international code of practice for cloud privacy, ISO/IEC 27018. This standard requires that providers comply with legislative requirements to disclose privacy breaches where they exist. Further, the passing of this legislation could see Australia rise on the BSA Global Cloud Computing Scorecard from its already high ranking of 2 out of 24 countries. The only negative
Microsoft.DOCX