Table 1: Summary international comparison mandatory data breach notification schemes – Country Relevant Notification threshold and Kind of information Consequences for Standard law/instrument/other details recipient/s non-compliance (compared to draft Bill) Australia Exposure Draft Privacy Notify the Information Personal information, Risk of enforcement N/A — — proposed Amendment (Notification of Commissioner and affected credit reporting action, including scheme Serious Data Breaches) individuals of all data information, credit potential civil Bill 2015 breaches creating a real risk eligibility information penalties for serious of serious harm and tax file number or repeated information, as defined infringements in the Privacy Act Canada Digital Privacy Act Notify the Privacy Personal information, Risk of fines for Similar — scheme passed Commissioner and affected defined as information knowing or wilful into law in June individuals of all data an identifiable failure to report a 2015 but is yet breaches creating a real risk individual breach to the to commence of significant harm Commissioner, to notify an individual or to maintain records in specified circumstances European Union Commission Regulation (EU) Notify a national authority Personal data, defined so Judicial remedies and Lower No 611/2013 of all data that the notification penalties in relevant notification ‘personal breaches’ requirement applies only Member State laws threshold, but to providers of publicly (for example, in the applies to a Notify both a national available electronic United Kingdom, narrower range authority and individuals communication services monetary penalties of information where the data breach is may apply under the likely to adversely affect the Two-tier Privacy and Electronic individuals’ personal data or notification Communications (EC privacy system Directive) Regulations 2003 or the Data Protection Act 1988)
Table 1: Summary international comparison – mandatory data breach notification schemes Country Relevant law/instrument/other details Notification threshold and recipient/s Kind of information Consequences for non-compliance Standard (compared to draft Bill) Australia — proposed scheme Exposure Draft — Privacy Amendment (Notification of Serious Data Breaches) Bill 2015 Notify the Information Commissioner and affected individuals of all data breaches creating a real risk of serious harm Personal information, credit reporting information, credit eligibility information and tax file number information, as defined in the Privacy Act Risk of enforcement action, including potential civil penalties for serious or repeated infringements N/A Canada — scheme passed into law in June 2015 but is yet to commence Digital Privacy Act Notify the Privacy Commissioner and affected individuals of all data breaches creating a real risk of significant harm Personal information, defined as information an identifiable individual Risk of fines for knowing or wilful failure to report a breach to the Commissioner, to notify an individual or to maintain records in specified circumstances Similar European Union Commission Regulation (EU) No 611/2013 Notify a national authority of all ‘personal data breaches’ Notify both a national authority and individuals where the data breach is likely to adversely affect the individuals’ personal data or privacy Personal data, defined so that the notification requirement applies only to providers of publicly available electronic communication services Judicial remedies and penalties in relevant Member State laws (for example, in the United Kingdom, monetary penalties may apply under the Privacy and Electronic Communications (EC Directive) Regulations 2003 or the Data Protection Act 1988) Lower notification threshold, but applies to a narrower range of information Two-tier notification system
Consultation-draft-data-breach-notification-2015-discussion-paper.DOCX