Australia's data breach notification law arrives at last

Australian companies in control of personal information will soon have to notify the public if their systems are compromised or private data is leaked, under a bill introduced in federal parliament today.

Data breach notification has been under debate in this country for a couple of years, but the wheels of legislation have moved slowly (compared, for example, to parties agreeing to give themselves more electoral funding, something which manages to fly through parliament on the nod in ninety seconds or so).

Where organisations – or incidents – fall under the data breach notification proposals, they will have to notify individuals that a breach has occurred with a description of the breach, the kind of information compromised in the breach, and recommendations about the steps individuals should take in response to the breach.

Where individuals can't be notified, the bill states, a public announcement will be required.

The bill – the Privacy Amendment (Privacy Alerts) Bill 2013, here, gives the privacy commissioner scope to waive the need for notification or publication should there be a strong enough public interest case to do so.

On the other hand, someone trying to keep the lid on a breach could find themselves caught up by the other side of the act: the commissioner will also have the power to order disclosure by a company, particularly if a breach includes information such as personal information, credit reporting or eligibility information, tax file numbers and so on.

Would it surprise readers of Vulture South to learn that exemptions are being built into the legislation for law enforcement? We thought not. ®