2. Liability for The Bill incorporates a concept that an entity is subject to the We would like to see further clarification and guidance Unconfirmed Breaches notification regime even it is not sure that a serious data provided on the threshold for reasonable awareness, breach has occurred ie a view that there are either via changes to the Bill or in appropriate guidance “reasonable grounds” that a serious data breach has occurred is notes. This should include guidance on the model sufficient. minimum standard to which entities should be held accountable. We note our concerns that: What constitutes grounds” will vary depending “reasonable on the circumstances and could be determined retrospectively by the Commissioner; It is unclear whether the grounds’ test is a ‘reasonable person’ test or one perhaps tailored to the ‘reasonable complexity and resources of the entity in question; and There is no indication as to when the “reasonable awareness” should arise, for example is a failure to have – a certain standard tools and technologies that might allow for such reasonable awareness considered in this? 3 Information Pursuant to s26WD(1), the Commissioner may mandate We appreciate from discussions with the Department that Commissioner’s Role notification by an entity. the mandated notification provisions were intended to be used only in limited situations involving a high degree of Section provides that an entity must comply with a risk to a data subject. We understand and accept that in mandated notification as soon as practicable after the direction such very limited circumstances, immediate mandated is given. There is no equivalent in s26WD(1) to the provisions notification may be appropriate. in s26WC(1) - which by virtue of s26WC(2) in effect define ‘as soon as reasonably’ practicable’ as being within a 30 day However, there is nothing in the wording of s26WD(1) that timeframe. suggests the mandated notification right is limited to particularly high risk circumstances. The language for the The effect of this is to give the Commissioner the power to most part simply mirrors the grounds’ ‘reasonable mandate immediate notification without the entity having an language in the s26WC(1) notification provision. We opportunity to investigate the issue or have a right of reply to suggest that: the Commissioner. either the language of s26WD(1) be tightened to limit the kinds of situations where mandated notification can occur; or if s26WD(1) is not tightened in the manner suggested, entities should be given some time to investigate the matter and respond to the
2. Liability for Unconfirmed Breaches The Bill incorporates a concept that an entity is subject to the notification regime even it is not sure that a serious data breach has occurred ie a view that there are “reasonable grounds” that a serious data breach has occurred is sufficient. We note our concerns that: What constitutes “reasonable grounds” will vary depending on the circumstances and could be determined retrospectively by the Commissioner; It is unclear whether the ‘reasonable grounds’ test is a ‘reasonable person’ test or one perhaps tailored to the complexity and resources of the entity in question; and There is no indication as to when the “reasonable awareness” should arise, for example – is a failure to have a certain standard tools and technologies that might allow for such reasonable awareness considered in this? We would like to see further clarification and guidance provided on the threshold for reasonable awareness, either via changes to the Bill or in appropriate guidance notes. This should include guidance on the model minimum standard to which entities should be held accountable. 3 Information Commissioner’s Role Pursuant to s26WD(1), the Commissioner may mandate notification by an entity. Section provides that an entity must comply with a mandated notification as soon as practicable after the direction is given. There is no equivalent in s26WD(1) to the provisions in s26WC(1) - which by virtue of s26WC(2) in effect define ‘as soon as reasonably’ practicable’ as being within a 30 day timeframe. The effect of this is to give the Commissioner the power to mandate immediate notification without the entity having an opportunity to investigate the issue or have a right of reply to the Commissioner. We appreciate from discussions with the Department that the mandated notification provisions were intended to be used only in limited situations involving a high degree of risk to a data subject. We understand and accept that in such very limited circumstances, immediate mandated notification may be appropriate. However, there is nothing in the wording of s26WD(1) that suggests the mandated notification right is limited to particularly high risk circumstances. The language for the most part simply mirrors the ‘reasonable grounds’ language in the s26WC(1) notification provision. We suggest that: either the language of s26WD(1) be tightened to limit the kinds of situations where mandated notification can occur; or if s26WD(1) is not tightened in the manner suggested, entities should be given some time to investigate the matter and respond to the
Telstra-Annexure-A.DOCX