APP 11 · NDB scheme
A break-in is not a disclosure. It can still be your breach.
A break-in is not a disclosure by the entity; it can still be the entity’s breach, where APP 11’s reasonable steps were not taken, and an eligible data breach only where serious harm is likely. This guide sets out the assessment clock, who notifies when two entities hold the records, and the round that starts with the customer.
General information about Australian privacy law, not legal advice. The OAIC’s guidance on the Notifiable Data Breach scheme is at oaic.gov.au.
What a break-in is not
The OAIC is direct about the first half: “An APP entity is not taken to have disclosed personal information where a third party intentionally exploits the entity’s security measures and gains unauthorised access to the personal information.”
Its securing guidance sets that in context: “‘Unauthorised access’ is a separate concept from ‘disclosure’”, because the entity did not hand the information over.
The conditions on what it still is. The entity “may breach its security obligations under APP 11 if it did not take reasonable steps to protect the personal information from unauthorised access”; and a data breach is eligible “if it is likely to result in serious harm to any of the individuals to whom the information relates”. Both conditions belong with the sentence that a break-in can still be your breach, and neither is assumed.
The assessment clock
The Notifiable Data Breaches scheme has been part of the Privacy Act since 22 February 2018, as the Attorney-General’s Department sets out. Entities covered by the Act have obligations under it: a data breach of personal information that is likely to result in serious harm to affected individuals must be notified to those individuals and to the OAIC.
- Day one. A suspected eligible data breach starts the assessment: the entity must carry out “a reasonable and expeditious assessment of whether there are reasonable grounds to believe that the relevant circumstances amount to an eligible data breach”.
- The 30-day limit. The entity must take all reasonable steps to ensure that the assessment is completed within 30 days after it becomes aware of the suspected breach.
- The statement. Once the entity is aware that there are reasonable grounds to believe there has been an eligible data breach, it must prepare a statement as the Act requires (s 26WK) and give a copy to the Commissioner as soon as practicable.
- Notifying individuals. Under the scheme the entity must, subject to some exceptions, notify individuals who are likely to suffer serious harm as a result of an eligible data breach.
Who notifies when two entities hold it
Where the information is held jointly, the Act allocates the assessment. The OAIC’s reading of s 26WJ: “if a data breach affects one or more other entities that jointly hold personal information, and one entity has assessed the suspected breach, the other entities are not required to also assess the breach”; and “if no assessment is conducted, depending on the circumstances, each entity that holds the information may be found to be in breach of the assessment requirements”.
And only one needs to notify: “only one entity needs to notify individuals and the Commissioner (s 26WM) if there is an eligible data breach involving personal information jointly held by more than one entity”; if none of the entities notify, all of them “may be found to have breached the notification requirements of the NDB scheme (s 26WL(2))”.
Who does the work is left to the entities. The scheme “does not prescribe which entity should conduct an assessment of a suspected data breach, nor which entity should notify”, which lets entities tailor their arrangements to their contractual and customer relationships; the Commissioner suggests the entity with the most direct relationship with the individuals at risk may be best placed to notify them; and the OAIC recommends establishing clear procedures when entering into service agreements, covering communication of suspected breaches, assessment processes, and responsibility for containment, remediation and notification.
The Act’s own exceptions do the same work: where an entity complies with the assessment section in relation to an eligible data breach of the entity, that section “does not apply in relation to those eligible data breaches of those other entities” (s 26WJ), and the same structure applies to the notification sections (s 26WM).
If the asset is critical infrastructure
The round starts with the customer. The Act puts the duty on the responsible entity for a critical infrastructure asset: once it becomes aware that a data storage or processing service is provided to it on a commercial basis and relates to business critical data, it must take reasonable steps to inform the provider that it has become aware of both of those things, as soon as practicable (s 12F(3)).
That is where the provider’s own obligations begin, and not before. An asset is a critical data storage or processing asset where, among the Act’s other conditions, it is owned or operated by a data storage or processing provider, is used wholly or primarily to provide a data storage or processing service to an end-user that is the responsible entity for a critical infrastructure asset, relates to business critical data, and the provider knows that the asset is used that way (s 12F(2)). The provider is then the asset’s responsible entity (s 12L(4)).
The Application Rules carry the asset into the incident-reporting Part of the Act: they specify a critical data storage or processing asset among the assets Part 2B applies to, other than any asset those rules exclude in subsections (3) and (4).