LexisNexis Practical Guidance®

An organisation can seek to prevent or minimise a personal data security breach occurring by implementing an effective organisational data security compliance framework.

An effective organisational data security compliance framework can avoid or minimise the risk of an organisation and individuals within it breaching personal data security obligations.

Such a framework should usually include:

• •regular audits of the organisation’s IT security policies, systems, controls, processes and practices;
• •effective IT security policies, systems, controls, processes and practices;
• •staff training and awareness of data security obligations;
• •a positive and strong compliance culture; and
• •ongoing governance oversight.

An organisation should conduct regular audits of the organisation’s IT security systems, processes, practices and policies.

An organisation should develop and maintain effective IT security policies, systems, controls, processes and practices to prevent or minimise the risk of breach of data security obligations.

Employees should receive regular training on compliance with data security requirements.

The main objective of the training should be to build and maintain a good level of current awareness of how to comply with, and avoid breaching, data security obligations.

Employees of an organisation whose roles involve performing services for the organisation’s customers should be familiar with any contractual obligations that the organisation has to the customer concerning data security requirements.

Organisations should develop and maintain a positive and strong compliance culture in relation to data security obligations.

A positive and strong compliance culture can embed best practice with respect to data security awareness and compliance within the values of an organisation and the values and behaviours of its staff.

An organisation should also implement effective internal governance processes and oversight of data security issues.

Internal governance processes should enable the timely and accurate reporting of data security compliance issues and breaches to relevant internal stakeholders.

See Best practice before a breach occurs.

To determine how to respond to a data security breach involving the personal information of one or more individuals, the organisation should determine:

• •what is the nature of the data security breach;
• •what is/are the cause(s) of the data security breach;
• •who is affected by the data security breach; and
• •what are the potential consequences for the organisation and those affected by the data security breach.

An organisation should have one or more decision-makers (ie a response team) who are responsible for:

• •assessing the nature and cause(s) of a data security breach;
• •identifying who is affected and what the potential consequences are; and
• •deciding upon an appropriate course of action for the organisation in relation to a data security breach.

It is important for an organisation to first identify the nature of a data security breach, to help it determine and plan an appropriate response.

It is also important for an organisation to identify the actual and potential consequence(s) of a data security breach.

This will help the organisation to prepare an appropriate response to the data security breach, including what actions and organisational resources are required to achieve an appropriate response.

Promptly upon becoming aware of a data security breach, an organisation should ensure that key internal stakeholders are:

• •alerted to the occurrence of the data security breach; and
• •given sufficient information in relation to the data security breach as soon as possible to enable them to assess the potential impacts of the occurrence.

An organisation may need to develop a different response depending on whether it is at fault or whether another organisation or person is at fault.

Such response should take into account a range of considerations, including complying with any relevant contracts with affected parties and communications with affected parties.

See Responding to a data security breach as it occurs.

Once an organisation has responded to and resolved a data security breach issue, it should:

• •conduct an internal audit to determine the root cause(s) of the data security breach;
• •determine what remediation measures are required to prevent or minimise the possibility of any recurrence of the data security breach; and
• •implement the necessary remediation measures and monitor their effectiveness.

Consideration should be given to whether offshore data transfers comply with APP 8 and whether an offshore data transfer agreement is required.

See Compliance after a data security breach has occurred.

A service provider is an organisation or person that provides any form of service to another organisation or individual.

Most service providers will have access to, use or store data or information in relation to providing a service that could be involved in a data security breach.

Such data or information may include personal information, confidential financial information or trade secrets, intellectual property and government official information.

A data security breach may arise whenever data or information of a service provider is accessed or used in any manner without permission, or is stolen, lost, corrupted, damaged or destroyed.

This may occur through the deployment of malicious code, by the acts or omissions of the service provider’s employees or contractors, and through unauthorised access to and use of a service provider’s data, or information by theft of data or information, or theft of IT devices on which such data or information is stored.

If a service provider does not maintain effective data security, it may be exposed to a number of risks, in particular, legal, financial and reputational risks.

Where a service provider subcontracts or outsources services or tasks to another party, it should ensure that the security posture of the other party is at least as effective as the security posture of the service provider.

The service provider should also consider whether the jurisdiction in which such other party is located would enable the service provider to effectively enforce contractual obligations in relation to data security against the other party.

See Types of service providers.

A service provider can seek to prevent or minimise data security breaches from occurring by implementing an effective organisational data security compliance framework.

An effective organisational data security compliance framework can avoid or minimise the risk of an organisation and individuals within it breaching data security obligations.

The specific details of what comprises an effective organisational data security compliance framework will vary between organisations, and will depend on a range of factors including a service provider’s level of compliance with data security obligations, the types of data it has access to, its structure, size, resources, industry sector, regulatory environment and the compliance issues facing the organisation.

A service provider should conduct regular audits of its IT security systems, processes, practices and policies.

The audits should be undertaken by the service provider’s IT security staff with appropriate skills and experience or by an external IT security specialist.

The findings of such audits will enable the service provider to determine what actions are required to remediate any adverse audit findings, including in relation to its IT security policies, systems, controls, processes and practices.

A service provider’s employees and contractors should receive regular training on compliance with data security requirements.

Service providers should develop and maintain a positive and strong compliance culture in relation to data security obligations.

Service providers should also implement effective internal governance processes and oversight of data security issues.

See Preventative measures for service providers in relation to data security.

To determine how to respond to a data security breach, a service provider should determine:

• •what is the nature of the data security breach;
• •what is/are the cause(s) of the data security breach;
• •who is the perpetrator of the breach:
• •who is affected by the data security breach; and
• •what are the potential consequences for the service provider and those affected by the data security breach.

A service provider should have one or more decision-makers (ie a response team) who are responsible for:

• •assessing the nature and cause(s) of a data security breach;
• •who is the perpetrator of the breach;
• •identifying who is affected and what the potential consequences are; and
• •deciding upon an appropriate course of action for the service provider in relation to a data security breach.

It is important for a service provider to first identify the nature of a data security breach, to help it determine and plan an appropriate response.

It is also important for a service provider to identify the cause(s) of a data security breach, to help it determine an appropriate response.

Once a service provider has identified the nature and cause(s) of the data security breach, it can:

• •prepare its response plan; and
• •implement remedial measures to seek to avoid any recurrences of the data security breach.

The nature of a data security breach, eg a breach of the Privacy Act 1988 (Cth) or a breach of a commercial contract in relation to privacy or data security, may require notification to affected parties or regulators within specified periods of time, and may also require a level of cooperation and disclosure in relation to subsequent investigations. See Overview — The data breach notification regime.

It is also important for a service provider to identify the actual and potential consequence(s) of a data security breach.

Promptly upon becoming aware of a data security breach, a service provider should ensure that key internal stakeholders are:

• •alerted to the occurrence of the data security breach; and
• •given sufficient information in relation to the data security breach as soon as possible to enable them to assess the potential impacts of the occurrence.

There is a range of issues for a service provider to consider when responding to a data security breach where the service provider is at fault, including breach notification requirements and communications with affected parties.

There is also a range of issues for a service provider to consider when it is affected by a data security breach by another organisation.

See Obligations to respond appropriately to data breaches.

The concept of disaster recovery usually refers to the ability of an organisation to resume or continue its normal operations or provision or services following the occurrence of an unforeseen, serious incident that caused interruption to its normal operations or provision of services.

Most organisations maintain some form of disaster recovery plan and business continuity plan.

There are a number of international standards relating to business continuity. There are a number of issues for an organisation to consider when preparing a disaster recovery plan and a business continuity plan.

See Managing disaster recovery and business continuity.

Data security is frequently an issue of critical importance in commercial contracts between both public and private sector customers and their respective suppliers.

Under commercial agreements, a supplier may have access to, or be responsible for managing or hosting, confidential business information, personal information or government official information of the customer or the customer’s end-users.

The issue of data security tends to be addressed in commercial contracts with an ever-increasing level of sophistication and detail, as technological developments continue to rapidly advance and the risk of data security breaches is ever-present.

Data security obligations in commercial contracts are often addressed under three topics:

• •data security;
• •privacy; and
• •confidentiality.

Data security obligations in commercial contracts can cover a number of aspects of data security, including compliance with a customer’s data security policies, the prevention of malicious code, application or system development in compliance with a customer’s security requirements, prescriptive technical requirements for security requirements, data sovereignty requirements, controls on suppliers’ personnel, and system access and monitoring requirements.

Commercial contracts also usually contain a range of privacy and confidentiality obligations.

See Negotiating and drafting data security obligations in commercial transactions.

Managing data security obligations in commercial transactions usually requires both the customer and supplier to allocate appropriate personnel and IT systems, develop contract management manuals, and implement a range of operational processes.

Both customers and suppliers have concerns in relation to managing data security obligations.

Both customers and suppliers should ensure that they assign appropriate personnel and resources to managing their contractual obligations relating to data security.

A service provider should conduct regular audits of its IT security systems, processes, practices and policies.

There are a number of key contract management issues in relation to data security that customers and suppliers should be aware of.

See Managing data security obligations in commercial transactions.

Cybersecurity insurance provides an organisation with the ability to insure itself against certain cybersecurity risks.

By obtaining cybersecurity insurance, an organisation seeks to transfer the risk of financial loss associated with a cybersecurity incident to the insurer.

Cybersecurity insurance policies vary in the nature and extent of the risks covered. They also vary in the nature and extent of the exclusions from insurance coverage.

If an organisation does not have cybersecurity insurance, it may be required to pay the costs associated with cybersecurity incidents itself that it may otherwise have been able to claim under the insurance policy.

An organisation may seek to limit or exclude its liability for breaches of data security by entering into a contract with another organisation or person that contains provisions that limit or exclude the organisation’s liability for breaches of data security.

See Cybersecurity liability and insurance.

The term “big data” is often defined with reference to the characteristics of the volume, variety and velocity of data (the “three V’s”).

The characteristic of “volume” refers to the quantity or magnitude of data. “Variety” refers to the range of different types of data. “Velocity” refers to the speed at which data is generated, processed or analysed.

Other features of big data that have been identified are veracity, variability and complexity. The characteristic of “veracity” refers to the unreliability or imprecision of certain data. “Variability” refers to variability in the rate or velocity of data flow. “Complexity” refers to the multiple sources from which data may be generated.

Big data is created, transferred, stored, hosted, used and processed daily in virtually all industry and community sectors, including by government, the private sector and other community organisations.

Certain types of data may require specific consents, approvals, licences, or agreements in order to permit an organisation to perform certain acts in relation to such data.

Big data may consist of personal information, data protected by copyright, data protected by moral rights, confidential information, and government official information.

Where an organisation enters into a commercial agreement with another organisation that involves the capture, receipt, transfer, hosting, processing or management of big data, there are a number of issues to consider, including which party is responsible for obtaining necessary consents, what contractual obligations will apply in relation to the big data, and technical, functional and performance specifications in relation to dealing with big data.

See Dealing with “big data”.

Big data can be collected by an organisation from a large number of sources.

An organisation may seek to leverage big data using data analytics for a range of purposes.

Big data often constitutes personal information if any individuals to whom it relates are identifiable from the big data.

Data analytics often involves the collection and analysis by an organisation of big data that comprises the personal information of various individuals.

As it may not be possible or viable for an organisation to obtain the required consents from each individual whose personal information is being collected or analysed, the organisation may decide to utilise data anonymisation (or personal information “de-identification”) methods or techniques, to enable the organisation to collect, analyse and process big data that comprises personal information without breaching the Privacy Act 1988 (Cth) (Privacy Act) or confidentiality.

See Collecting and using big data.

Managing big data in a secure manner requires an organisation to implement an effective organisational data security compliance framework.

Such a framework should usually include:

• •regular audits of the organisation’s IT security policies, systems, controls, processes and practices;
• •effective IT security policies, systems, controls, processes and practices;
• •staff training and awareness of data security obligations;
• •a positive and strong compliance culture; and
• •ongoing governance oversight.

An organisation that stores or uses big data should also ensure that its data security compliance framework is consistent with the legal and contractual obligations the organisation has to other parties with respect to how it stores and uses the big data.

Organisations that store and use big data should develop and maintain effective IT security policies, systems, controls, processes and practices to prevent or minimise the risk of breach of data security obligations.

An organisation that stores or uses big data should conduct regular audits of its IT security systems, processes, practices and policies.

An organisation’s employees and contractors should receive regular training on compliance with data security requirements.

Organisations that store or use big data should develop and maintain a positive and strong compliance culture in relation to data security obligations.

Organisations that store or use big data should also implement effective internal governance processes and oversight of data security issues.

See Preventative measures.