Privacy & Data Protection

January 15, 2018 by Susan Bennett

Australia’s Notifiable Data Breaches (NDB) scheme comes into effect from 22 February 2018. This article explains what a Notifiable Data Breach is and when to notify the Australian Information Commissioner and individuals whose personal information has been subject to a data breach likely to result in serious harm. Importantly, organisations need to be prepared and ensure that data breach response plans are up to date with an appropriate assessment process for suspected eligible data breaches to comply with the NDB scheme.

Notifiable Data Breaches Scheme – comes into effect 22 February 2018

The Privacy Amendment (Notifiable Data Breaches) Act 2017 (NDB Act) established the Notifiable Data Breaches scheme in Australia. It requires organisations to notify individuals whose personal information is involved in a data breach that is likely to result in serious harm and the Australian Information Commissioner. The NDB scheme comes into effect from 22 February 2018.

The NDB Act and Privacy Act 1988 (Cth) applies to all Australian government agencies, businesses and not-for-profits with an annual revenue of $3 million or more per annum and all health service providers, credit providers, credit reporting bodies, entities that trade in personal information and tax file number recipients.

Monetary penalties and investigation for non-compliance

A failure to comply with the notification requirements is subject to the penalty regime under the Privacy Act, which allows for monetary penalties of up to $1.8 million for organisations and $360,000 for individuals for serious or repeated breaches. A failure to comply can also result in affected individuals filing a complaint with the Commissioner or the Commissioner investigating without a complaint being made. Pursuant to section 52 of the Privacy Act, following an investigation the Commissioner may issue a determination requiring the organisation to:

Pay compensation for any loss or damage to affected individuals; and/or
Perform any reasonable act or course of conduct to redress any loss or damage suffered by affected individuals; and/or
Take specified steps to ensure that an organisation’s conduct is not repeated or continued.

What to do about Eligible Data breaches

The NDB scheme applies to data breaches involving personal information that are likely to result in serious harm to any individual affected, which are referred to as ‘eligible data breaches’. Once an organisation is aware that there are reasonable grounds to believe that there has been an eligible data breach it must promptly notify affected individuals and the Commissioner about the breach.

Criteria for determining eligible data breaches

The Office of the Australian Information Commission (OAIC) sets out on its Eligible data breach webpage that an eligible data breach arises when the following three criteria are satisfied:

There is unauthorised access to or unauthorised disclosure of personal information, or a loss of personal information, that an entity holds;
This is likely to result in serious harm to one or more individuals; and
The entity has not been able to prevent the likely risk of serious harm with remedial action.

In respect of criteria 2, ‘serious harm’ is not defined in the Privacy Act. The OAIC sets out in Eligible data breach that organisations ‘should assess the risk of serious harm holistically, having regard to the likelihood of the harm eventuating for individuals whose personal information was part of the data breach and the consequences of the harm.’ The NDB scheme includes a non-exhaustive list of ‘relevant matters’ set out in section 26WG. One of those matters includes whether security technology was used and designed to make the information unintelligible or meaningless to unauthorised persons.

In respect of criteria 3 above, if an organisation takes remedial action so that the data breach would not be likely to result in serious harm, then the breach is not an eligible data breach (see section 26WF(1)-(3)) and notification is unnecessary.

If an organisation has reasonable grounds to believe that it has experienced an eligible data breach, it must promptly notify individuals and the Commissioner about the data breach.

Think you’ve got an eligible data breach?

In the situation where an organisation suspects that it may have experienced an eligible data breach, it must quickly assess the situation to decide whether or not there has been an eligible data breach and notification is required. OAIC sets out in Assessing a suspected data breach the ‘assessment must be reasonable and expeditious, and entities may develop their own procedures for assessing a suspected data breach.’

Timing is critical: assessment within 30 days

An organisation must take all reasonable steps to complete the assessment within 30 calendar days after the day it became aware of the grounds that caused it to suspect an eligible data breach (see section 26WH(2)). The OAIC sets out in Assessing a suspected data breach:

‘[t]he Commissioner expects that wherever possible entities treat 30 days as a maximum time limit for completing an assessment, and endeavour to complete the assessment in a much shorter timeframe, as the risk of serious harm to individuals often increases with time. Where an entity cannot reasonably complete an assessment within 30 days, the Commissioner recommends that it should document this, so that it is able demonstrate:

that all reasonable steps have been taken to complete the assessment within 30 days
the reasons for the delay
that the assessment was reasonable and expeditious.’

Notifications to individuals and Commissioner

The NDB scheme requires an agency or organisation that has reasonable grounds to believe an eligible data breach has occurred to promptly notify individuals at likely risk of serious harm and the Australian Information Commissioner (Commissioner). The notification must include: the identity and contact details of the notifying organisation; a description of the data breach; the kinds of information concerned; and recommendations about the steps individuals should take in response to the data breach (see section 26WK(3)).

What must be included in the notifying statement

OAIC sets out it ‘expects that the statement will include sufficient information about the data breach to allow affected individuals the opportunity to properly assess the possible consequences of the data breach for them, and to take protective action in response’. Information describing the eligible data breach may include:

the date of the unauthorised access or disclosure
the date the entity detected the data breach
the circumstances of the data breach
who has obtained or is likely to have obtained access to the information
relevant information about the steps the entity has taken to contain the breach.

Individuals

Where serious harm cannot be mitigated through remedial action, the agency of organisation must notify individuals involved in an eligible data breach that is likely to result in serious harm. If it is not practicable to notify each affected individual then the organisation must publish a copy of the statement on the organisation’s website (for at least 6 months) and take reasonable steps to publicise the contents of the statements (see section 26WL(2)). The notification must include recommendations about the steps individuals should take in response to the breach to mitigate the serious harm or likelihood of serious harm from the data breach.

OAIC – Commissioner

Notify the Commissioner of eligible data breaches by completing online the Notifiable Data Breach statement — Form or downloading the Word document form [108 KB DOCX].

Where an eligible data breach applies to multiple organisations, only one organisation needs to notify the Commissioner and the individuals at risk of serious harm, and it is up to the organisations to decide who makes the notifications.

Checkpoint

Update Data Breach Response Plan

Your organisation’s data breach response plan needs to incorporate the requirements of the NDB scheme for assessing suspected eligible data breaches. OAIC has available on its website a Guide for developing a data breach response plan, which includes a useful data breach response checklist. This is important, because [t]‘the Commissioner expects that an entity’s approach to data breach management, including its data breach response plan, will incorporate the requirements of the NDB scheme for assessing suspected eligible data breaches.

Health Care Providers

If a data breach is required to be notified under s 75 of the My Health Records Act, the NDB scheme does not apply (see section 26WD). This exception is intended to avoid duplication of notices under the NDB scheme and the data breach notification requirements in the My Health Record system. For further about data breach notification requirements of the My Health Records Act see OAIC’s Guide to mandatory data breach notification in the My Health Record system.

Notifying other Regulators

Organisations may also need to consider reporting a data breach incident to other authorities and regulators, such as: ASIC, APRA, ATO, The Australian Cyber Security Centre, law enforcement, professional bodies, financial services provider etc.

Organisations that operate in multiple jurisdictions may have notification obligations under other breach notification schemes, such as the EU General Data Protection Regulation (GDPR) – see my article GDPR: Change to European privacy laws and its impact on Australian businesses.

Key take outs and actions

Ensure your data breach response plan is up to date and complies with the NDB Scheme, including the requirements for assessing suspected eligible data breaches.
Prompt notification to affected individuals and the Commissioner is required unless remedial action is taken so that the data breach would not be likely to result in serious harm.
Assessments must be done as quickly as possible and within 30 days.
Is your organisation ready to conduct a quick assessment of a suspected data breach to determine whether it is likely to result in serious harm to affected individuals, and if so, is it ready to make notifications to individuals and the Commissioner? Key considerations include: who is your internal team; do you have sufficient internal or known external resources to deal with a potential significant data breach of personal information, including resources to manage communications to notify affected individuals?
In the event of a data breach, consider whether your organisation is required to report the data breach to any other authority or regulator or professional body.
Have you reviewed contracts with service providers to ensure they contain privacy and data breach notification obligations on them that will allow your organisation to comply with the Privacy Act and the NDB Scheme? Who has the obligation to notify affected individuals and the Commissioner?
Does your organisation have adequate cyber insurance? Have you reviewed the terms and coverage of current policies to assess whether they are adequate, and include cover for liabilities and losses including monetary penalties?
Does your organisation have a strong privacy culture? Are privacy impact assessments being carried out? Is privacy-by-design being built into systems and processes? Are you able to quickly respond to suspected data breaches and to learn from potential or actual eligible breaches?
Does your data breach response plan and privacy ecosystem align with a unified information governance framework to ensure the value of information throughout the organisation is maximised and risks and costs of holding information are minimised?

Susan Bennett LLM(Hons), MBA
Principal of Sibenco Legal & Advisory and co-founder of Information Governance ANZ.

If you would like assistance with your Data Breach Response Plan or Information Governance ecosystem, please contact Susan on +61 2 8226 8682 or email susan.bennett@sibenco.com.

This article is for reference purposes only and does not constitute legal advice.

Further Resources

The Office of the Australian Information Commission (OAIC) has resources available on its website including:

May 6, 2015 by Susan Bennett

Preventing data privacy breaches is becoming increasingly important, with the increasing costs of dealing with cyber attacks, IT security breaches, and the subsequent legal actions and regulatory investigations. Strong IG, including privacy governance, is the most effective way to put in place robust systems to prevent and minimise privacy breaches, as well as respond to any privacy breaches that may occur.

Cyber attacks and privacy breaches

There is general awareness of the increase in cyber security attacks on organisations, and the significant risks that this poses to enterprise information security, legal and regulatory obligations, as well as the significant costs and reputational issues that result.

It is regularly reported that cyber attacks and data breaches are on the rise. The Identify Theft Resource Center Breach reported that US data breaches hit a record high of 783 in 2014, which was a 27.5% increase over the previous year, with over 85 million records exposed.[i]

Telstra’s Cyber Security Report[ii] states ‘nearly a quarter of all the organisations we surveyed had suffered some kind of business interruption due to an IT security breach during the last 12 months. When that time frame was stretched to five years the figure climbed to nearly 60%. … The majority of Australian organisations we surveyed reported that they detected some sort of attempt to breach their IT security on a weekly or monthly basis.’

High-profile cyber security attack incidents include:

Anthem – in February 2015 the second-largest health insurer in the US reported that stolen data included names, addresses, dates of birth, social security numbers and employment and histories of 80 million current and former customers;
Sony Pictures cyber attack in late 2014, in which vast amounts of data was stolen, including personal information of employees, such as salaries, social security numbers, birth dates, medical records; emails; contracts; copies of unreleased films; and reports that hard drives were wiped leading to the shut down of Sony’s computer systems for more than a week[iii]. The attack was condemned by the US, Australian and other governments;
JP Morgan Chase – in late 2014 the names, addresses, phone numbers and email addresses of 83 million households and small business accounts were stolen;
Home Depot – in 2014 the theft of 56 million customer email addresses and payment card details;
Adobe – in late 2013 the theft of 153 million customer records; and
Target – in late 2013 the malware attack that compromised 70 million Target customer accounts and 40 million credit cards at its point of sale systems.

Costs of privacy breaches

The costs of a data breach will depend upon on its type and scale. However, for some large-scale breaches, the costs may run into hundreds of millions of dollars.

The direct costs of data breaches include the following:

cost of investigating the breach;
cost of wages through overtime and/or increased number of staff to deal with IT issues around security breach identification and remediation;
costs of external advisors, such as IT security experts and lawyers;
business interruption costs, particularly where access to computer systems is limited, either because of damage to systems or systems being shut down for remediation;
costs of dealing with breaches – e.g., new replacements credit cards being issued where customer details of credit cards are stolen, and legal claims and pay-outs for data breaches; and
costs of new IT and new processes and systems to prevent future privacy and data breaches.

There are also the indirect costs arising from data breaches, such as loss of reputation and potential loss of future customers, due to a lack of trust that customers’ personal information will be kept safe.

Direct cost – case examples

In the US, Target reported in late 2014 that it had incurred $248 million in data-breach-related expenses and would receive $90 million from insurance policies.[iv] This included costs for defending or settling more than 100 legal actions against it. Independent sources estimated that fraudulent charges ranged from $240 million to $2.2 billion. [v] In March 2015 a US court gave preliminary approval to a $10 million settlement of a class action to enable customers affected by the breach to be awarded up to $10,000 each in damages.[vi] In April 2015, Target announced it had reached agreement with Mastercard to fund up to $19 million in payments to Mastercard issuers affected by the data breach, conditional on at least 90% of card issuers accepting the offer.[vii]

Home Depot reported it had paid $43 million in data-breach-related expenses and anticipated $15 million in insurance payments, and that at least 44 legal actions had been filed in the US and Canada.[viii]

Regulatory sanctions

Globally regulators are imposing stiff sanctions and fines for data and privacy breaches. In addition to fines, regulators often impose requirements for organisations to conduct reviews, audits and provide ongoing compliance reports to the regulator. This can be a substantial ongoing cost, particularly where it may involve the unbudgeted expense of new or improved IT, increased cost of appropriately qualified personnel, particularly privacy experts and/or independent third-party audits, and ongoing compliance reporting.

United States

In the US, in April 2015, AT&T was fined $25 million for a data breach by the Federal Communication’s Commission in its ‘largest privacy and data security enforcement action to date’.[ix The data breaches involved the unauthorised disclosure of almost 280,000 of customer names, full or partial security numbers, due to employees accessing without authorisation customer records at AT&T call centres in Mexico, Colombia and the Philippines. Under the terms of settlement, AT&T is required to appoint a senior compliance manager, who is a certified privacy professional, to conduct a privacy risk assessment, implement an information security program and provide regular training to employee’s on AT&T’s privacy policies. AT&T is required to file regular compliance reports with the FCC.

United Kingdom

In the UK in 2012, the Brighton and Sussex University Hospitals NHS Trust received the largest-ever fine imposed by the Information Commissioner’s Office (ICO), of £325,000. A contractor had been retained to destroy data on around 1000 computer hard drives containing confidential patient information. An individual sub-contractor removed some of the hard drives and without wiping the drives sold them on eBay.

In 2013, the ICO imposed a fine of £250,000 on Sony Computer Entertainment Europe, following a cyber attack on the Sony PlayStation Network Platform in April 2011 that compromised the personal information of millions of customers.

In 2013/2014 the ICO issued £1.97 million civil monetary fines.[x] The fines levied in the UK are set to increase once the new EU General Data Protection Regulations are enacted.

European Union

The draft Data Protection Regulation was issued in 2012, and the EU’s European Council is aiming for its adoption in late 2015 or early 2016. After a transition period of two years, it will have immediate effect on all EU member states.

The draft EU Data Protection Regulation provides for sanctions and fines as follows:

a written warning of cases of first and non-intentional non-compliance;
regular periodic data protection audits; and
fines of up to 5% of annual global revenue or €100 million, whichever is greater.[xi]

Australia

The powers of the Office of the Australian Information Commissioner (OAIC) include:

conducting assessments of privacy compliance;
accepting enforceable undertakings; and
seeking civil penalties, in the case of serious or repeated breaches of privacy, of up to $340,000 for individuals and $1.7 million for organisations.

The first enforceable undertaking under the new privacy laws that came into effect in Australia in March 2014 was entered into by Optus in March 2015, following a lengthy investigation by the OAIC. It was concerned that Optus did not have reasonable steps in place to safeguard the personal information held in its systems at the time the three significant incidents occurred, and as required by Australian Privacy Principle (APP) 11. The three incidents were:

a change made to Optus’s website, resulting in the names, addresses and mobile numbers of 122,000 of its customers who had elected not to have their details listed in a telephone directory being published in the White Pages;
Optus made a change to its network that meant customers using the relevant modems it had provided who did not change the default user name and password were vulnerable, potentially allowing a person to make and charge calls as though they were the Optus customer; and
a flaw in Optus’s security processes led to certain customers whose voicemail was not password protected being vulnerable to ‘spoofing’ attacks, including accessing and using customer voicemail account messages, and preferences and settings being changed.

The Privacy Commissioner referred to the positive way in which Optus worked with the OAIC to address the incidents, and considered ‘the enforceable undertaking was an appropriate outcome that will ensure Optus takes steps to strengthen its privacy controls and meet its security obligations under the Privacy Act’.[xii] The enforceable undertaking required Optus to:[xiii]

Engage a qualified independent third party to complete specified reviews and certifications. This included, for example,

‘a. review of the additional security measures Optus adopted in response to the Privacy Incidents (‘Review A’). These additional security measures include:

Enhancing Optus’s monitoring program of change management that has the potential to affect the security of its customers’ personal and sensitive information;
Enhancing Optus’s penetration testing: for fixed and mobile services; on all major IT projects as part of Optus’s Security Risk Assessment process; and as part of its annual monitoring program.
a review of Optus’s vulnerability detection processes across the organisation concerning the security of personal information;’

provide copies of those reviews and certifications to the OAIC;
implement any recommendations and rectify deficiencies identified in those reviews and certifications; and
provide a report by an independent third party to the OAIC certifying that the specified actions had been completed.

Privacy governance framework

In light of the costs and time involved in responding to data breaches and the subsequent ongoing consequences and expense, there is a strong incentive for organisations to ensure they have an appropriate privacy framework in place, both to prevent privacy breaches and to respond to any data and privacy breaches that may occur. As part of good corporate governance to manage risk, the privacy framework should be part of a robust overall information governance framework to manage all information and data throughout an organisation.

The New South Wales Information and Privacy Commission, which covers state public sector agencies, has published a Privacy Governance Framework.[xiv] The framework enables a holistic organisational approach to the management of personal information, draws upon the ‘privacy by design’ principles, and consists of five elements (as shown in the diagram below): setting leadership and governance; planning and strategy; program and service delivery; complaint incident management; and evaluation and reporting.

Privacy by design – the seven principles

The objectives of ‘privacy by design’, developed by Dr Ann Cavoukian, former Information and Privacy Commissioner in Ontario, are aimed at ensuring privacy and gaining personal control over one’s information, and, for organisations, gaining a sustainable competitive advantage. The benefits of the ‘privacy by design’ approach has been recognised by information and privacy regulators, including in the United Kingdom and Australia. The seven foundation principles are: [xv]

Proactive, not reactive

The privacy by design approach is about proactive, rather than reactive, measures. It anticipates and prevents privacy-invasive events.

Privacy as the default setting

It seeks to deliver maximum privacy, by ensuring that personal data is automatically protected in any IT system or business practice. No action is required by an individual to protect their privacy – it is built into the system, by default.

Privacy embedded in design

Privacy is embedded in the design and architecture of IT systems and business practices, rather than being an add-on. Therefore, it is an essential component of the functionality.

Full functionality – positive-sum, not zero-sum

Privacy by design seeks to accommodate all legitimate interests and objectives in a positive-sum ‘win-win’ manner, not through a zero-sum approach, with unnecessary trade-offs. It demonstrates it’s possible to have both privacy and security.

End-to-end security

Having been embedded in the system before the first element of information being collected, privacy by design extends throughout the entire lifecycle of the relevant data. This ensures that at the end of the process, all data is securely and quickly destroyed.

Visibility

Privacy by design means that, whatever business practice or technology is involved, it is operating according to the stated promises and objectives, subject to independent verification. Its components and operations remain visible to users and providers alike.

Keeping user privacy user-centric

Architects and operators are required to keep individuals’ interests uppermost, by offering, e.g., strong privacy defaults, appropriate notice, and user-friendly options.

Benefits of ‘privacy by design’

The ICO has set out the benefits of designing projects, processes, products or systems with privacy as a consideration at the outset:[xvi]

Potential problems are identified at an early stage, when addressing them will often be simpler and less costly.
There is increased awareness of privacy and data protection across organisations.
Organisations are more likely to meet their legal obligations, being less likely to breach relevant legislation or regulations, such as the Data Protection Act 1988 (UK), the Privacy Amendment Act 2012 (Aus)(C’th) or the EU’s Data Protection Directive.
Actions are less likely to be privacy intrusive and have a negative impact on individuals.

Privacy at the outset

It is clear that the most efficient way to ensure privacy protection is for it to be included and embedded in the early stages of any project or new product or service, and for this to continue throughout its lifecycle. The ICO recommends that privacy and data protection be considered when: [xvii]

building new IT systems for storing or accessing personal data;
developing legislation, policy or strategies that have privacy implications;
embarking on a data sharing initiative; or
using data for new purposes.

Privacy as part of IG

While it is important to have a strong privacy framework, it needs to be supported by robust information management and governance throughout the organisation. The NSW Privacy Commissioner states, ‘[p]rivacy is easiest when it is the organisation’s standard mode of operation and monitoring is mainstreamed through existing governance mechanisms such as the Board, Executive of Senior Management meetings. Monitoring and review can be achieved through existing mechanisms such as the Audit and Risk Committee or Customer or other Advisory Committees.’[xviii]

The Information Governance Initiative describes IG as a co-ordinating list of information activities, including information security, compliance, data governance, risk management and privacy.[xix] IG is defined as: ‘the activities and technologies that organisations employ to maximise the value of their information while minimising associated risks and costs’.[xx]

The Information Governance Reference Model (IGRM) provides a framework for defining a unified governance approach to information, including privacy[xxi]. It shows information is a cross functional challenge, requiring collaboration between the various stakeholders within an organisation (i.e., privacy, information technology, legal, records management and business units), and highlights the intersection and dependence across these stakeholders.

Benefits of IG

The benefits of a holistic approach to IG, including privacy governance, are:

senior-executive-level engagement and decision-making on important strategic opportunities and risk mitigation issues concerning organisational information, including privacy considerations;
improved management of data, with more efficient retrievability of data retained;
defensible destruction of redundant, outdated and trivial data/information, with an audit trail that can be relied upon in litigation. In the privacy context, it means old or outdated customer records are disposed of and are no longer held by an organisation;
improved selection and return on investment on new technology, appropriate to the organisation’s legal, compliance and business needs. This means technology investment is a strategic priority, with appropriate budgets and investment plans leading to long-term cost efficiencies. This is in contrast to a reactive unplanned expensive plug to a data and privacy breach crisis, with the consequent legal and IT costs of responding to a data breach, as well as increased costs of ongoing compliance that may be imposed by a regulator;
comprehensive and aligned policies, processes, people and response plans. This includes comprehensive ICT security and privacy breach response plans, as well as awareness training of policies and processes, and training to deal with a cyber attack and privacy and data breaches; and
reduced costs and increased efficiencies arising from the implementation of an aligned strategy and policies, in contrast to the inefficiencies of the traditional fragmented siloed approach. A good example in the privacy context is including ‘privacy by design’ principles at the outset of projects, new processes, new products or services, or when using data for new purposes.

Conclusion

Having a strong privacy and information governance framework properly embedded in an organisation should prevent and minimise privacy and data breaches. To have robust governance, consider:

reviewing current privacy and information governance frameworks and assessing whether they are aligned to achieving organisational objectives and meeting best practice standards in information management, including data and privacy protection;
reviewing and updating privacy policies and processes;
embedding ‘privacy by design’ for projects, processes, new products and services;
embedding privacy and data protection when developing new IT systems for storing or accessing personal information;
developing or reviewing privacy and data breach incident response plans to ensure they are current, including notification processes to regulators – such as, the OAIC Data Breach Notification Guide; and
training of relevant personnel to enable the organisation to respond adequately in the event of privacy and data breach – this will include IT, communications, privacy and legal personnel.

If you would like assistance reviewing your current privacy and information governance ecosystem, please contact Susan Bennett, Principal, on +61 2 8226 8682 or email susan.bennett@sibenco.com.

Download a pdf of this article here

__________________
Follow us to receive updates on LinkedIn

__________________

This article is for reference purposes only and does not constitute legal advice.

__________________

[i] Data Breach Reports, Identify Theft Resource Center, 31 December 2014.

[ii] Telstra’s Cyber Security Report, December 2014, p30.

[iii] ‘US investigators suspect North Korea hired hackers for Sony hack’, The Age, 31 December 2014.

[iv] Weiss, Miller, ‘The Target and Other Financial Data Breaches: Frequently Asked Questions’, Congressional Research Service Report, 4 February 2015, p6.

[v] Weiss, Miller, ‘The Target and Other Financial Data Breaches: Frequently Asked Questions’, Congressional Research Service Report, 4 February 2015, p6

[vi] Tabuchi, ‘$10 million Settlement in Target Data Breach Gets Preliminary Approval’, The New York Times, 19 March 2015.

[vii] ‘Target Announces Settlement Agreement with MasterCard; Estimated Costs Already Reflected in Previously Reported Results’, media release, 15 April 2015.

[viii] Weiss, Miller, ‘The Target and Other Financial Data Breaches: Frequently Asked Questions’, Congressional Research Service Report, 4 February 2015, p7.

[ix] ‘AT&T to Pay $25 Million to Settle Consumer Privacy Investigation’, Federal Communications Commission media release, 8 April 2015.

[x] Information Commissioner’s Officer Annual Report and Financial Statements 2014/14, p24.

[xi] Article 79 of Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), Inofficial consolidated version GDPR, Rapporteur Jan Albrecht, October 2013.

[xii] Office of the Australian Information Privacy Commission media release, 27 March 2015.

[xiii] Singtel Optus: enforceable undertaking, Office of the Australian Information Privacy Commission, Enforceable Undertakings www.oaic.gov.au

xiv] Privacy Governance Framework Resources, www.ipc.nsw.gov.au

[xv] Dr Ann Cavoukaian, ‘Privacy by Design, The 7 Foundational Principles’, revised January 2011 www.privacybydesign.ca

[xvi] Information Commissioner’s Office, Guide to Data Protection, www.ico.org.uk

[xvii] Information Commissioner’s Office, Guide to Data Protection, www.ico.org.uk

[xviii] Dr Elizabeth Coombs, NSW Privacy Commissioner, ‘Why Privacy Governance?’, Privacy Governance Framework Resources, www.ipc.nsw.gov.au

[xix] Information Governance Initiative Annual Report 2014, p13.

[xx] Information Governance Initiative Annual Report 2014.

[xxi] Information Governance Reference Model (IGRM) Guide, E.D.R.M, www.edrm.net

February 26, 2015 by Susan Bennett

Organisations globally are struggling to manage both the opportunities and risks posed by the explosion of data they hold, which is increasing at an exponential rate each year. Strong information governance is an effective way to maximise the opportunities arising from data mining and extract value from the data held. As well, effective implementation of clear policies and processes to minimise the risks arising from information held will result in cost efficiencies.

Where do the risks and costs arise?

The vast amounts of data held pose increased risks and costs to organisations, arising from:

legal and compliance, particularly in relation to privacy obligations, with the growing focus on privacy arising from high-profile cyberattacks and thefts of customer records;
information communication and technology (ICT) systems that prevent privacy and ICT security breaches;
the cost of production of documents in litigation and regulatory investigations; and
record and information management (RIM) complying with legal and business requirements, where data is increasing exponentially, and retention policies may not be keeping pace with business operations and legal requirements.

Who is responsible?

Typically, an organisation’s data and information is managed by various ‘owners’ – for example:

compliance – risk and compliance director or chief risk officer;
eDiscovery/document production – eDiscovery counsel or general counsel;
ICT security – chief technology officer or chief information officer;
legal – general counsel;
privacy – chief privacy officer or general counsel; and
records and information management (RIM) – RIM manager.

What is information governance?

Information governance (IG) is defined as:

The activities and technologies that organisations employ to maximise the value of their information while minimising associated risks and costs. [i]

IG – a critical foundation for effective governance

The key to addressing and managing information/data throughout the organisation is to take a holistic approach that is driven from the board/CEO/C-suite level down.

A sound IG framework is the critical foundation that then enables organisations properly to govern and manage the information held. The benefits of a holistic approach to IG are:

senior-executive-level engagement and decision-making on important strategic opportunities and risk mitigation issues concerning organisational information;
improved management of data with more efficient retrievability of data retained;
defensible destruction of redundant, outdated and trivial data/information with an audit trail that can be relied upon in litigation;
improved selection and return on investment (ROI) on new technology, appropriate to the organisation’s legal, compliance and business needs;
comprehensive and aligned policies, processes and response plans – including comprehensive ICT security and privacy breach response plans; and
reduced costs and increased efficiencies arising from the implementation of an aligned strategy and policies, in contrast to the inefficiencies of the traditional fragmented siloed approach.

Technology – tool and solution?

While the proliferation of data has been caused by technology, it is also technology that is providing rapidly evolving tools to manage the exponentially increasing data. However, technology is only part of the solution, as IG strategy, policies, processes, people and technology all need to be aligned, to deliver on the objective of maximising the value of the information and minimising risks and costs.

There is a rapidly growing market for technology solutions in the IG sphere for the wide spectrum of information management needs. And there are many technology options for managing ICT security, eDiscovery, RIM and compliance, etc. Types of technology that are dramatically changing the ways in which information is managed within organisations include:

Auto-classification technology, enabling automatic identification, classification, retrieval, archival and disposal of information, based on an organisation’s classification rules. This type of technology enables defensible disposal of data and should enable better adherence to IG policies.
Analytic technology, which identifies relevant data and data patterns from large data sets. Analytics can be used across a number of the traditionally siloed areas within organisations. For example, analytics and relevance ranking are used extensively in discovery for litigation, and provide substantial cost and time savings. Analytics is used with traditional RIM as well as increasingly being used to better understand customers, so as to tailor products, and/or develop new products, with the ultimate aim of increasing profits.
eDiscovery technology is increasingly being brought in-house by major organisations, as a way to increase efficiency and reduce costs by:
- pre-litigation review of information, early case assessment and managing responses to regulatory investigations in-house; and
- maintaining control over the data, preserving confidentiality and ensuring sensitive data is not removed from the organisation’s network.

Technologies such as those outlined above should be selected and implemented within the context of the overarching IG strategy, policies and priorities.

Technology and privacy

One of the greatest challenges and risks facing organisations is dealing with privacy issues concerning data containing personally identifiable information, medical records and other sensitive details. Some organisations are proactively addressing privacy by embedding:

privacy controls and mechanisms in ICT systems before they are implemented within an organisation – i.e., ensuring there is compliance with core organisational values and privacy obligations prior to implementation, which, in the longer term, is more cost efficient; and
privacy lawyers in new product development teams, so that products not only meet legal obligations but are designed to meet the growing concerns about privacy and enable customers/users more control over the use of their information – e.g., with online social media products, allowing users to determine the level of privacy, which they may vary from time to time.

IG – is your organisation achieving best practice?

Whether information management achieves best practice, so that risks are minimised and the opportunities and value of information are maximised, comes down to four factors. Ask yourself:

Are your leaders embedding IG as a foundation of good corporate governance?
Do you have a clear and comprehensive IG framework with current policies and processes in place?
Are those responsible for information management able to work collaboratively across functions to ensure that IG strategic objectives are met and achieve best practice with resulting efficiencies?
Is data being used effectively for multiple business-value-creating purposes?

If the answer to any of these questions is ‘no’, there is probably an opportunity for greater alignment of the IG framework, policies, processes and people.

If you would like assistance reviewing your current IG ecosystem, please contact Susan Bennett, Principal, on +61 2 8226 8682 or email susan.bennett@sibenco.com.

Click here for the pdf version of this article

__________________
Follow us to receive updates on LinkedIn

__________________

This article is for reference purposes only and does not constitute legal advice.

__________________

i Information Governance Initiative Annual Report 2014.

Services

Contact

Let’s Connect

Privacy & Data Protection

Footer

Services

Contact

Let’s Connect