Australia's Mandatory Data Breach Notification Bill Revealed

← Back to Stories (view on slashdot.org)

Australia's Mandatory Data Breach Notification Bill Revealed

Posted by samzenpus on Wednesday May 1, 2013 @11:16AM from the just-so-you-know dept.

mask.of.sanity writes "Australia's plans for a data breach notification scheme have been revealed which will force organizations to report serious breaches to affected victims. The plans, which are still in a draft form, show that the country's privacy commissioner could force businesses to inform press if the breaches are bad enough, pursue fines of up to $1.7 million for organizations that are repeatedly breached and force businesses to adopt stronger security controls."

40 comments

Min score:

Reason:

Sort:

Good plan. by Mitreya · 2013-05-01 11:35 · Score: 5, Insightful

I know I am restating the obvious, but I find it interesting how no one is ever responsible for the security breach...
Just got a note from LivingSocial -- they inform me of the fact and tell me to reset my password. Almost like this is a force of nature event and not a screw up on their part for having been breached. Perhaps at least repeat offenders should be held responsible?
1. Re:Good plan. by Agent+ME · 2013-05-01 13:04 · Score: 1
  
  I think a better analogy would be someone falling for a scam. Is it the victim's fault the 4th time they've sent $10,000 to a Nigerian prince?
2. Re:Good plan. by c0lo · 2013-05-01 13:09 · Score: 2
  
  I know I am restating the obvious, but I find it interesting how no one is ever responsible for the security breach...
  Once the lack of adequate security will start hurting enough the operators of the breach-able system, they'll start acting very responsible (and responsive) instead of sweeping the dust under the carpet.
  "Anti-hacking" laws are cost externalization, as they allow the operators to relax on the security side, on the expense of tax-payers (who pay for the policing, investigations, suits and possibly the sustenance of an offender in jail). Mind you, as a tax payer, you get to pay those cost even if you aren't using the un-secured system.
  
  --
  Questions raise, answers kill. Raise questions to stay alive.
3. Re:Good plan. by Cryacin · 2013-05-01 14:27 · Score: 3, Insightful
  
  Let's put all of the strawmen arguments aside. What we are talking about is a situation where there is an advised duty of care, with something that is valuable to us to be kept secret. The provision of our information. This is more analogous to a bank. There is an implied expectation of security when we put money into its security box, that only we can access it.
  
  Imagine if you had the expectation of your secure documents being in a bank vault, with limited access, multiple keys, so that bank employees can't just access your goods etc is in place. Instead, you have a set of shoe boxes, stored in a garden shed with a screen door flapping in the breeze.
  
  If a bank heist happens, and your documents are stolen, and the bank has done everything that they can do, then the breach should not be punished, if, however, a second heist occurs, and the bank has fallen for the same trap again, you would think that the bank should be held accountable, no?
  
  --
  Science advances one funeral at a time- Max Planck
4. Re:Good plan. by Dexter+Herbivore · 2013-05-01 16:45 · Score: 2
  
  From the summary "...pursue fines of up to $1.7 million for organizations that are repeatedly breached...", this act covers that eventuality.
5. Re:Good plan. by davester666 · 2013-05-01 17:56 · Score: 1
  
  Yes.
  But jokes aside, this kind of legislation needs a different kind of 'maximum' fine. Something along the lines of "X percent of your revenue" [not in-country profit, as that is gamed to get to zero by the big companies].
  
  --
  Sleep your way to a whiter smile...date a dentist!
6. Re:Good plan. by AmiMoJo · 2013-05-01 19:41 · Score: 1
  
  This is more analogous to a bank.
  In that case maybe companies that handle private data should be required to insure themselves like banks do. If a bank gets robbed the customers don't lose their money, there is a fund that all banks pay in to which covers it.
  
  --
  const int one = 65536; (Silvermoon, Texture.cs)
  SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Reasonable Steps by Zaelath · 2013-05-01 11:35 · Score: 2

I know summaries are meant to be hyperbolic, but given you only have to take "reasonable steps" to secure customer data, there's not going to be too many $1.7 million repeat-offender fines meted out.
1. Re:Reasonable Steps by Mitreya · 2013-05-01 11:38 · Score: 2
  
  given you only have to take "reasonable steps" to secure customer data, there's not going to be too many $1.7 million repeat-offender fines meted out.
  You also need higher penalties for not reporting the breach.
  Or Australians will simply never hear about any data losses ever again...
2. Re:Reasonable Steps by AHuxley · 2013-05-01 12:26 · Score: 1
  
  Just thinking about very basic random issues in Australia:
  I would expect a person in charge to be listed, a 24/7 contact on call, a person with the task to look after data given the size of the fines.
  Some attempt to understand version drift, major exploits by staff and shown to be mapped out/some attempt to be blocked.
  Upgrading to or using some "good" password-based key derivation function.
  Making sure any common MS infection in ~admin staff areas does not get to move data out in bulk.
  Making sure data cannot be shared on "any" web browser with the 'one' correct 'vaild for many many weeks' password.
  Police checks and background interviews for cleared staff are still valid.
  Sadly many Australian systems are turn key software that just works for 2-5-10 years.
  If something goes wrong with the frozen in time backend turn key software over the years, they dump in new turn key hardware.
  
  --
  Domestic spying is now "Benign Information Gathering"
3. Re:Reasonable Steps by Anonymous Coward · 2013-05-01 19:02 · Score: 0
  
  Australia is a small country (population wise), their are not many consumer companies here that would consider $1.7 million a small fine compared to the revenue they make. still I think it should be cripplingly higher as while their a valid excuses for suffering a security breach there are no excuses for not following notification requirements.
4. Re:Reasonable Steps by Electricity+Likes+Me · 2013-05-02 08:10 · Score: 1
  
  given you only have to take "reasonable steps" to secure customer data, there's not going to be too many $1.7 million repeat-offender fines meted out.
  You also need higher penalties for not reporting the breach.
  Or Australians will simply never hear about any data losses ever again...
  The point of the law is to shutdown the "notified of security flaw, did nothing" issue which shows up on /. repeatedly often in relation to things like banks.
  You notify the company, if they do nothing you notify the government, who in turn now have the power to fine the company if they get breached. Cue companies actually reacting to security-flaw notifications rather then ignoring them till something happens.
The most surprising thing by icebike · 2013-05-01 11:36 · Score: 4, Insightful

The most surprising thing is that Australia has a Privacy Commissioner.
From what I read in the press that is the exact opposite of what I would expect from that government.

--
Sig Battery depleted. Reverting to safe mode.
1. Re:The most surprising thing by Bremic · 2013-05-01 12:59 · Score: 1
  
  This is especially true as the current version of the tax software that pretty much everyone has to use to submit their End of Financial Year tax data only works with Internet Explorer, and has troubles with IE 8+.
  As I don't have a machine capable of running IE 6-8 I spoke to an accountant, who told me they collect the data and submit it using IE 7.
  I looked, and it is all submitted using http (not https), so there is absolutely no concern about even the minimum amount of security on peoples TAX data. This includes everything from income, dependants, name, address, TFN, phone contacts... the lot. All submitted using http in IE.
  Fun times people. Fun times.
2. Re:The most surprising thing by Anonymous Coward · 2013-05-01 14:03 · Score: 0
  
  This is absolute bull shit. There are a number of submission methods possible and I have never run into issues filing tax returns using Firefox or the Windows application in Linux (WINE).
3. Re:The most surprising thing by chihowa · 2013-05-01 15:11 · Score: 1
  
  The most surprising thing is that Australia has a Privacy Commissioner.
  From what I read in the press that is the exact opposite of what I would expect from that government.
  Maybe it's like the Drug Czar in the US. I used to think that job sounded awesome when I was a teenager.
  
  --
  If you want a vision of the future, imagine a youtube comments section scrolling - forever.
4. Re:The most surprising thing by Anonymous Coward · 2013-05-01 15:35 · Score: 0
  
  What application are you talking about? The most widely used one is surely the ATO's e-Tax application which is a Windows-only application, and it doesn't use Internet Explorer anywhere that I've seen.
5. Re:The most surprising thing by Anonymous Coward · 2013-05-01 19:33 · Score: 1
  
  I know Slashdot has mentioned Australia's proposed internet filter, proposed legal snooping of all telecommunications, etc... Every government has people who suggest stupid things. They don't actually get implemented, and Australia isn't actually an Orwellian dictatorship or anything.
6. Re:The most surprising thing by Anonymous Coward · 2013-05-01 19:53 · Score: 0
  
  ... it is all submitted using http ....
  
  When on-line tax returns first appeared, one had to get a session certificate first. That disappeared and now I hope the e-tax software does the encryption.
7. Re:The most surprising thing by sd4f · 2013-05-01 23:45 · Score: 1
  
  It's a bread and circus er ship, whatever you call that. We have some world leading corrupt parliamentarians.
8. Re:The most surprising thing by Electricity+Likes+Me · 2013-05-02 08:12 · Score: 1
  
  ... it is all submitted using http ....
  When on-line tax returns first appeared, one had to get a session certificate first. That disappeared and now I hope the e-tax software does the encryption.
  HTTP submission is pretty common, since it's structurally easier to manage then SSL. You just use RSA encrypted payloads instead.
9. Re:The most surprising thing by NoMaster · 2013-05-02 09:08 · Score: 1
  
  From what I read in the press ...
  
  Well there's your problem right there...
  
  --
  What part of "a well regulated militia" do you not understand?
What a load of hooie by OhANameWhatName · 2013-05-01 11:41 · Score: 4, Insightful

It appears to take a conservative approach in its demand for data breaches to be reported, with only classifications of serious data breaches considered
Australian privacy regulations are a total joke. The privacy commissioner is a bureaucrat with no power. Businesses take, steal, trade, share, sell and harvest personal details willy nilly and there's no oversight or punishment whatsoever. How do they accomplish this? They set up shell companies which they use to harvest, trade and purchase personal data then shut down the companies after they've 'purchased' the data from them. "No Mr privacy commissioner, it wasn't us. It was company ABC which unfortunately .. is now a defunct corporation so there's no way to know how they got those private details. But before they closed up business in the floor below us, they assured us that everything was perfectly legal. Honest to goodness sir, there's simply nothing we can do!"

Privacy isn't even a remotely important priority. Anything that's raised as a bill is going to be full of loopholes like swiss cheese, because the political representatives in Australia include people with (how shall I put this gently) .. 'ties' to large marketing companies. Banks track purchases for the police (with no oversite or warrant), personal details are sold straight out of ATO records, supermarkets track every single purchase a person makes throughout their lives trading this to whomever they consider a 'business partner' and the consumer (if they manage to discover a company has their details) doesn't even have the right to have those details removed from the company's database.

BTW .. the content in this post is not assumption or guess work, I've personally experienced everything listed here.
weird that this isn't already the case by Trepidity · 2013-05-01 12:03 · Score: 3, Insightful

I'm not sure what black-magic software companies and webservice providers incanted to manage to exempt themselves from traditional product-liability law. If you sell a widget and your design was shit in a way that causes monetary damages, traditionally you are liable. If you sell a widget and your design sucks so bad that it doesn't even work (even without causing real damages), then people are at least entitled to a refund. But software somehow avoids this: your design can be buggy as hell and somehow you are not liable for shipping a shit product that didn't fulfill its advertised purpose and may have actually actively harmed people.
This bill seems to just take one small step towards restoring some minimal degree of responsibility for your product.

--
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
1. Re:weird that this isn't already the case by Trepidity · 2013-05-01 12:39 · Score: 2
  
  "Why not leave it to the market to decide?" is one of those Poe's Law sort of questions.
  
  --
  10 PRINT CHR$(205.5+RND(1)); : GOTO 10
2. Re:weird that this isn't already the case by mark-t · 2013-05-01 12:41 · Score: 1
  Not a bad idea... but I can think of four immediately obvious cases where I can see managing privacy not being entirely in one's own hands:
  
  Their employer.
  
  Their medical health professional.
  
  Their school
  
  And their government.
  --
  File under 'M' for 'Manic ranting'
3. Re:weird that this isn't already the case by centipedes.in.my.vag · 2013-05-01 12:53 · Score: 1
  
  Most issues with software are PEBKAC; that's why. There's a reason that checklists in tech support take care of 80% of calls.
  
  --
  Only on /. can I lose karma with 2x "5, Funny" posts.
4. Re:weird that this isn't already the case by Trepidity · 2013-05-01 13:13 · Score: 1
  
  Even accounting for that, though, software providers get away with providing stuff that really is catastrophically buggy, without incurring liability, on the basis of some shrinkwrap EULAs that wouldn't fly in any other field.
  
  --
  10 PRINT CHR$(205.5+RND(1)); : GOTO 10
5. Re:weird that this isn't already the case by Anonymous Coward · 2013-05-01 13:34 · Score: 0
  
  Ah - but that EULA is why you never really bought anything but the right to use the buggy product in the first place. Your right to use wasn't bad - what you had the right to use was, and there was no guarantee on that.
6. Re:weird that this isn't already the case by Trepidity · 2013-05-01 13:53 · Score: 2
  
  So can I sell you some chicken with an EULA which covers me from liability in the event that the chicken actually contains high levels of Salmonella? No, I can't.
  
  --
  10 PRINT CHR$(205.5+RND(1)); : GOTO 10
7. Re:weird that this isn't already the case by Anonymous Coward · 2013-05-01 20:58 · Score: 1
  
  Most issues with software are PEBKAC; that's why. There's a reason that checklists in tech support take care of 80% of calls.
  No, PEBKAC is usually an excuse mediocre programmers use to cover up their own inadequacies. A checklist is a way of covering common problems. Why is that problem common?
  Software is a tool that is supposedly designed for users and if the target audience are unable to use that tool quickly and efficiently with a minimum of fuss then it's the fault of the tool designer and nobody else. Mediocre programmers often expect their users to be mind readers, robots and/or have time to waste.
8. Re:weird that this isn't already the case by centipedes.in.my.vag · 2013-05-03 02:16 · Score: 1
  
  But you can. Go order a rare steak -- you'll be reminded that raw meat is raw, and that's a EULA in form of legal waiver.
  
  --
  Only on /. can I lose karma with 2x "5, Funny" posts.
Missed a word by Anonymous Coward · 2013-05-01 13:56 · Score: 0

I misread the title. The meaning is quite different with the word "Bill" removed.
$1.7 million? by Alex+Belits · 2013-05-01 15:47 · Score: 0

fines of up to $1.7 million
or all change in the CEO's pocket, whatever is greater?

--
Contrary to the popular belief, there indeed is no God.
1. Re:$1.7 million? by smash · 2013-05-01 16:11 · Score: 1
  
  They're aussie dollars, so by the time the law is ratified it will likely be the equivalent of about 100 million $us.
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Re:Once more by Dexter+Herbivore · 2013-05-01 16:43 · Score: 0

Parent has been modded troll? It wasn't OT, it wasn't a "frist post" although it did lack meaningful content... but most jokes or attempts at them do. I'm surprised by the modding on this occasion.
Snoopers by CuteSteveJobs · 2013-05-02 21:25 · Score: 1

Is this bill PR to divert attention? The government has given itself permission to breach privacy anyways: http://www.news.com.au/technology/nicola-roxon-backflip-gives-green-light-for-online-spying/story-e6frfro0-1226464553027 http://www.theaustralian.com.au/australian-it/government/data-retention-laws-risky-canberra-told/story-fn4htb9o-1226465841909