The Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 (the Bill) [1] was introduced to the Parliament on 26 October 2022 as part of the Australian Government's immediate response to the recent high-profile data breach disclosed by Optus and Medibank. It brings to head the contentious business policy of data retention, which I examined in my recent article "Data Retention Dilemma" [2]. The key proposed changes in the Bill include (thanks to the analysis from James Cole) [3]:
50 million dollars; 3 times the value of the benefit obtained through misuse of data; or 30% of a company’s annual turnover in the relevant period.
The second proposed change above is clearly designed to discourage the habit of data hoarding. Public consultation for the Bill was closed on 7th Nov 2022 [4], receiving 31 published submissions [5].
A number of these submissions expressed concern about the financial impact of the proposed maximum regulatory fine of up to $50M. However, some of the submissions examined the more complex question of the data retention policy. For example, the Business Council of Australia (BCA) 's submission [6] recommends applying Section 80U(1) 'tiering' of penalties where the courts are required to consider whether an organisation can show they were not negligent or reckless. Perhaps a business policy to retain data for future monetisation (beyond immediate business needs or regulatory compellation) might be considered to be a reckless act? The Tech Council of Australia 's submission [7] also recommends a tiered penalty regime to be proportionately applied.
The Australian Institute of Company Directors ' (AICD) submission [8] recommends the Bill be paused until the Privacy Act Review has made its recommendations and the Government has responded. 澳洲国民银行 's submission [9] drew attention to the current mandated regulatory data retention burden of seven years after the banking relationship had concluded. NAB asserts that this mandated retention period is much longer than it would otherwise require and significantly increases its risk profile.
Attorney-General Mark Dreyfus signalled that businesses could be forced to purge millions of Australians’ identification records and ordered to stop hoarding a treasure trove of customers’ personal data under an overhaul of privacy laws [10]. Mark is not questioning the regulatory burden on data retention. He is questioning the commercial motive behind the data retention policy.
The FAIR Institute community recommends quantifying Privacy Risk as a structured and scalable way to inform data retention policy. It might be an oversimplification to assert that the only data retention policy option is to delete the entire data set upon the expiry timeframe. NAB's submission might have alluded to the possibility of applying different data retention periods for different data elements, akin to the longer-term retention of metadata in telecommunications.
“... For too long we have had companies solely looking at data as an asset they can use commercially ... When that information is no longer required, they must take reasonable steps to destroy or de-identify the personal information they hold ...” Mark DreyfusI echo the caution from ACID in not jumping the gun and losing sight of the imminent conclusion of the review of the Australian Privacy Act by the Attorney General's Department [11]. My presentation, "Quantifying Privacy Risk of Technical Data" at the Australian Information Security Association (AISA) CyberCon Melbourne 2022 drew attention to the proposed inclusion of Technical Data in the definition of Privacy Data. This proposed change is foreshadowed in the Discussion Paper [12]. My recent article, "Privacy risks of technical data", published in the Cyber Today Magazine (Edition 2 2022) [13], provides some useful background information on this presentation.
My presentation also walkthrough of two examples of quantifying Privacy Risk from the recently published Open Group article "Calculating Reserves for Cyber Risk Vetting Cyber Risk Models" [14]. The paper is co-authored by Mike Jerbic and Bob Mark. These examples use the "OPEN GROUP OPEN FAIR™ RISK ANALYSIS TOOL" [15] to perform the calculation.
My presentation deck is available for download here:
I want to thank Dennis R. for assisting me with running the OPEN GROUP OPEN FAIR™ RISK ANALYSIS TOOL during the presentation.
Walk through the Privacy Risk Quantification examples using the OPEN GROUP OPEN FAIR™ RISK ANALYSIS TOOLWe also want to thank the delegates for the great turnout and many excellent follow-up discussions:
领英推荐 The EU-US Data Privacy Framework: ALL YOU NEED TO KNOW Paakhhi G. 2 年前 Privacy vs. Data Protection - What Do They Really Mean? Luka Shakhkulashvili 8 个月前 👀 Privacy from the US Gov? Osano 1 年前Thanks to Craig Ford as the room monitor and for taking these photos.
[1]https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r6940
[2]http://linkedin.zhutiblog.com/com/pulse/data-retention-dilemma-denny-wan/
[4]https://www.aph.gov.au/Parliamentary_Business/Committees/Senate/Legal_and_Constitutional_Affairs/PrivacyEnforcement2022
[5]https://www.aph.gov.au/Parliamentary_Business/Committees/Senate/Legal_and_Constitutional_Affairs/PrivacyEnforcement2022/Submissions
[6]https://www.aph.gov.au/DocumentStore.ashx?id=6ea85962-12b7-40a6-bbcc-a43e9c05085d&subId=725158
[7]https://www.aph.gov.au/DocumentStore.ashx?id=59579211-b271-4401-8064-b3d94ab2355e&subId=725156
[8]https://www.aph.gov.au/DocumentStore.ashx?id=77773af8-3e4f-4f2c-9ee8-11449efd0b2b&subId=725154
[9]https://www.aph.gov.au/DocumentStore.ashx?id=93faed62-0d6b-439c-8a13-61fa77e3247a&subId=725329
[10]https://www.afr.com/politics/federal/customer-data-should-not-be-a-corporate-asset-dreyfus-20220929-p5blvy
[11]https://www.ag.gov.au/integrity/consultations/review-privacy-act-1988
[12]https://consultations.ag.gov.au/rights-and-protections/privacy-act-review-discussion-paper/
[13]https://cybertoday.partica.online/cyber-today/edition-1-2022/flipbook
[14]https://publications.opengroup.org/w221
[15]https://blog.opengroup.org/2018/03/29/introducing-the-open-group-open-fair-risk-analysis-tool/