Show/Hide Tags

Australia: Failure to notify customers of data beach may result in investigation's Tags

Tags related to this article

Cyber & Data Risk
Law Jurisdiction

Australia: Failure to notify customers of data beach may result in investigation

Published 10 diciembre 2014

Australian travel insurer, Aussie Travel Cover (ATC) has recently revealed that it was the subject of a cyber-attack in December of last year which compromised 770,000 pieces of personal data.

Although it notified the Australian Information Commissioner soon after it became aware of the attack, Australia currently has no laws requiring companies to disclose data breaches, regardless of size, so ATC was under no obligation and chose not to inform its policyholders of the breach.

However, the Commissioner has the regulatory power to investigate any alleged breach of the Privacy Act, which it may do following a complaint or of its own volition.

Unfortunately ATC's decision not to inform its policyholders of the breach, many of whom found out about the breach through the media, is likely to result in complaints to the Commissioner therefore making it more likely to commence an investigation.

If the Commissioner does decide to commence an investigation and finds that reasonable steps were not taken by ATC to protect its customers' data it may be subject to a range of civil sanctions.

A news report on the attack is available here.

Authors

Hans Allnutt

London - Walbrook

+44 (0) 20 7894 6925

hallnutt@dacbeachcroft.com

Jade Kowalski

London - Walbrook

+44(0)20 7894 6744

jkowalski@dacbeachcroft.com

Australia: Failure to notify customers of data beach may result in investigation

Authors

Hans Allnutt

Jade Kowalski

Cyber Newsletter - November 2022

How Secure is Secure? What do recent ICO penalty notices tell us about GDPR security requirements?

NIS breaches, the national cybersecurity strategy and law enforcement engagement

Cyber and Employment Law

Supply Chain Breaches

Understanding Privacy-Enhancing Technologies (PETs)

The EU Data Package

UK Legislative Developments and the Impact on Cyber

Developments in Canadian Privacy Law

Recent Australian Cyber and Privacy Developments (July-September 2022)

American Data Privacy Protection Act (“ADPPA”): Is the U.S. Finally Getting Federal Data Privacy Protection?

Cyber Newsletter - September 2022

The Data Protection and Digital Information Bill: An Overview

Data And Cyber Bulletin - August 2022

2022 ENISA Report Finds Ransomware Attacks Continue to Dominate the Global Cybersecurity Landscape

A new Task Force report on Confronting Reality in Cyber Space has been published by the Council for Foreign Relations

Former NHS employee prosecuted and fined after illegally accessing patient records without a valid legal reason

Online Safety Bill at a standstill pending appointment of a new Prime Minister

When European data regulators disagree: EDPB steps in to resolve a dispute between French and Polish Data Protection Authorities

Data And Cyber Bulletin - July 2022