Your Last Warning - The Data Breach Penalty Regime Is Now Operational And Coming For You!

This appeared last week and carries a rather ominous warning…

Data breach law: 60% of businesses 'unaware of basics'

• 20 February 2018
• Written by  Sam Varghese

Nearly 60% of Australian businesses are not aware of the details of the data breach law that takes effect on Thursday, a survey by GfK Australia for imaging solutions provider Canon claims.

Additionally, the survey, named the Business Readiness Index, found that small businesses, in particular, were seen to be least concerned about data security, stemming from a lack of awareness where only one in five (19%) were conscious of, and prepared for, the new regulations.

The survey was conducted in January and gathered insights from 400 key decision-makers from the business and IT communities. It aimed to gauge Australian businesses' existing information security practices, and determine their preparedness and ability to comply with the Data Breach Notification obligations.

“Third-party suppliers present a cyber security blind spot for many businesses. A business’ security posture doesn’t solely depend on its own efforts," said Gavin Gomes, director of Canon Business Services.

Internally, a business could be a fortress, but the walls could come crashing down if a supplier’s security measures aren’t as robust – this should be number one on every boardroom’s agenda at the moment."

Gomes pointed out that small businesses were seen as the engines of Australia’s economy.

"The fact that one in two are only ‘slightly’ or ‘not at all’ concerned about potential upcoming breaches is in itself a red flag," he said.

"In the short run, this makes them the ideal backdoor entry point for cyber criminals angling for prized data and revenue from larger enterprises. Longer term, the implications can include missed opportunities worth millions – be it lost contracts or irreversible reputational damage."

Other key findings of the survey:

• Across the board, technology was seen as the biggest vulnerability, with 44% of risk attributed. Larger businesses had a more balanced view of their risks, but small businesses attributed 53% of the risk to technology, and only 25% to people and 22% to policies and processes.
• Only 40% of the businesses surveyed had implemented six or more of the Australian Signals Directorate Essential 8 and just 18% reported implementing all of these steps. Twelve percent of small businesses had no strategies in place.
• Average days that organisations took to detect a data breach was 24.7.
• Daily back-up of important data was the most widely implemented cyber-risk mitigation strategy, but print security was often neglected.
• The top five security incidences that occurred in Australia in the last 12 months were: viruses, spam, malware/spyware, phishing, ransomware.
• Where there’s room for improvement:
  • Only 56% have been assessed for security risk management;
  • Only 40% have their printers secured;
  • Only 56% have a cyber security policy; and
  • Only 55% invest in security training.
• Half thought their data security spend would increase once the new legislation took effect.

"When it comes to ovrall security, ignorance is no longer bliss. According to the Index, it reportedly takes nearly a month (24.7 days) on average for a security breach to even be detected – whether it’s seemingly innocuous spam, or insidious ransomware," said Sop Chen, general manager of Managed IT and Security Services at Harbour IT, a Canon Group company.

More here:

https://www.itwire.com/security/81816-data-breach-law-60-of-businesses-unaware-of-basics.html

All individuals who handle health information, no matter what their size, fall under the legislation.

There is a primer here:

Data breach preparation and response

19 Feb 2018

Office of the Australian Information Commissioner

Government of Australia

Description

Strong data management is integral to the operation of businesses and government agencies worldwide. Digital platforms and technologies that utilise user data to provide personalised products or services have proliferated across communities and industries. At the same time, data analysis has been widely recognised for its value as fuel for innovation that can benefit the community in unprecedented ways, including identifying gaps in services, revealing needs for new or different products, and enabling better-informed policy-making.

In this environment, the success of an organisation that handles personal information or a project that involves personal information depends on trust. People have to trust that their privacy is protected, and be confident that personal information will be handled in line with their expectations.

As we’ve found in our long-running national community attitudes to privacy survey, if an organisation does not demonstrate a commitment to privacy, people will look for alternative suppliers, products, and services.

One of the biggest risks organisations face in this context is a data breach. A data breach involving personal information can put affected individuals at risk of serious harm and consequently damage an organisation’s reputation as a data custodian.

However, it is important to recognise that consumer and community trust is not necessarily extinguished immediately after a data breach occurs. After all, history has shown us that even organisations with great information security can fall victim to a data breach, due to the rapid evolution of data security threats and the difficulty of removing the risk of human error in large and complex organisations.

When a data breach occurs, a quick and effective response can have a positive impact on people’s perceptions of an organisation’s trustworthiness. That is why being prepared for a data breach is important for all organisations that handle personal information.

By an ‘effective’ response to a data breach, I mean a response that successfully reduces or removes the risk of harm to individuals, and which aligns with legislative requirements and community expectations.

This guide aims to assist you in developing and implementing an effective data breach response. It outlines the requirements relating to data breaches in the Privacy Act 1988 (Cth) (Privacy Act), including personal information security requirements and the mandatory data breach reporting obligations of the Notifiable Data Breaches (NDB) scheme. The guide also covers other key considerations in developing a robust data breach response strategy, including the key steps to take when a breach occurs, the capabilities of staff, and governance processes.

While this guide is primarily for Australian Government agencies and private sector organisations with obligations under the Privacy Act, the information provided is useful to any organisation operating in Australia. Taken holistically, the information provided in this guide provides a framework for meeting expectations for accountability and transparency in data breach prevention and management, which is key to maintaining and building consumer and community trust.

Publication Details

Copyright: Office of the Australian Information Commissioner (OAIC) 2018

Language: English

License Type: CC BY

Subtitle: A guide to managing data breaches in accordance with the Privacy Act 1988 (Cth)

Published year only: 2018

Here is the link:

http://apo.org.au/node/133696

Here is a GP orientated immediate action plan.

There's been a data breach — here are your next four steps

Georgie Haysom

Kate Gillman

21 February 2018

SMART PRACTICE

Mandatory data breach notification is finally here. All private sector organisations holding health information, regardless of their size, will be affected by these changes to the privacy legislation that come into force on 22 February.

Maintaining the privacy of health information has always been central to the relationship of trust and confidence between doctor and patient. In addition, there can be significant penalties for breach, as well as the potential for negative publicity and damage to a person’s reputation. Unfortunately, as the Australian Red Cross Blood Service discovered in 2016, data breaches can still happen in the best organisations and despite your best efforts, you may experience a breach.

While it is hoped you will never find your patients’ details on a public website, even a single breach of patient privacy has the potential to cause serious harm and may be notifiable. You do need to think about how you would respond if, for example, you discovered patient details had accidentally been disclosed; results had been sent to the wrong person; or a staff member had inappropriately accessed patient records.

Responding to a data breach involves four steps, which do not necessarily occur in order. You need to:

1. Contain the breach and make a preliminary assessment
2. Evaluate the risks and likelihood of harm
3. Notify as necessary
4. Prevent future breaches

The details are here:

https://www.medicalobserver.com.au/professional-news/theres-been-a-data-breach-here-are-your-next-four-steps

You have been warned!

David.