Privacy Amendment (Notifiable Data Breaches) Act 2017
An Act to amend the Privacy Act 1988, and for related purposes
1 Short title
privacy-amendment-notifiable-data-breaches-act-2017.pdf, p.5
The Act is the Privacy Amendment (Notifiable Data Breaches) Act 2017.
2 Commencement
privacy-amendment-notifiable-data-breaches-act-2017.pdf, p.6
1 Section 1
22 February
2 Section 2
3 Schedules
Legislation in schedules is amended or repealed according to its terms.
1 Subsection 6(1)
privacy-amendment-notifiable-data-breaches-act-2017.pdf, p.7
2 After subsection 13(4)
Entity must notify eligible data breaches
3 After Part IIIB
26WA Simplified outline of this Part
An entity must give a notification if it has reasonable grounds to believe that an eligible data breach has happened or is directed to do so by the Commissioner.
Reasonable grounds to believe data breach has happened
Entity must give notification if directed by Commissioner
26WB Entity
Defines entity for purposes of this Part.
privacy-amendment-notifiable-data-breaches-act-2017.pdf, p.8
26WC Deemed holding of information
26WC(1) Deemed holding of information
The APP entity is required to hold the personal information.
Requirement to hold personal information
the APP entity were required under section 15 not to do an act, or engage in a practice, that breaches Australian Privacy Principle 11.1 in relation to the personal information.
Temporal relationship between disclosure and holding
(a) an APP entity has disclosed personal information about one or more individuals to an overseas recipient;
and (c) the overseas recipient holds the personal information;
Prohibition on disclosure of personal information
(b) Australian Privacy Principle 8.1 applied to the disclosure of the personal information;
Prohibition on act or practice that breaches Australian Privacy Principle 11.1
(e) the APP entity were required under section 15 not to do an act, or engage in a practice, that breaches Australian Privacy Principle 11.1 in relation to the personal information.
and (d) the personal information were held by the APP entity;
26WC(2) Deemed holding of information
Credit provider must comply with subsection 21S(1) in relation to credit eligibility information.
the credit provider were required to comply with subsection 21S(1) in relation to the credit eligibility information.
26WD Exception—notification under the My Health Records Act
Notification under My Health Records Act exempts from this Part
privacy-amendment-notifiable-data-breaches-act-2017.pdf, p.9
26WE Eligible data breach
26WE(1) Eligible data breach
Eligible data breach: APP entity must comply with section 15 not to do an act that breaches Australian Privacy Principle 11.1.
Obligation to comply with section 15 not to do an act that breaches Australian Privacy Principle 11.1.
(1) This section applies if: ... (i) an APP entity holds personal information relating to one or more individuals; and (ii) the APP entity is required under section 15 not to do an act, or engage in a practice, that breaches Australian Privacy Principle 11.1 in relation to the personal information;
Temporal interval for when data breach occurs.
Recurring trace for when data breach occurs.
Obligation for APP entity to comply with section 15 not to do an act that breaches Australian Privacy Principle 11.1.
(b) both: (i) a credit reporting body holds credit reporting information relating to one or more individuals; and (ii) the credit reporting body is required to comply with section 20Q in relation to the credit reporting information;
26WE(2) Eligible data breach
26WE(3) Eligible data breach
Conditional commencement of subsection (2) subject to section 26WF.
26WF Exception—remedial action
privacy-amendment-notifiable-data-breaches-act-2017.pdf, p.11
26WF(1) Exception—remedial action
Take remedial action before access or disclosure results in serious harm
action taken before access or disclosure results in serious harm
26WF(2) Exception—remedial action
No notification required if action taken before access/disclosure results in serious harm
26WF(3) Exception—remedial action
Action required before unauthorized access or disclosure
26WF(4) Exception—remedial action
No eligible data breach after action taken in response to loss of information
the loss is not, and is taken never to have been: an eligible data breach...
Temporal interval for action taken in response to loss of information
(c) the APP entity, credit reporting body, credit provider or file number recipient, as the case may be, does so:
...before the access or disclosure results in serious harm to any of the individuals to whom the information relates;
Recurring trace for action taken in response to loss of information
(d) as a result of the action, a reasonable person would conclude...
...that the access or disclosure would not be likely to result in serious harm to any of those individuals;
Obligation to take action in response to loss of information
(b) the APP entity, credit reporting body, credit provider or file number recipient, as the case may be, takes action...
...the access or disclosure results in serious harm to any of the individuals to whom the information relates;
26WF(5) Exception—remedial action
Exemption from notification requirement for certain entities taking action in relation to loss of information.
26WG Whether access or disclosure would be likely, or would not be
Determine likelihood of serious harm from access or disclosure of information
privacy-amendment-notifiable-data-breaches-act-2017.pdf, p.14
Information is protected by security measures
Consider security measures effectiveness
Likelihood that security measures can be overcome
Harm likelihood is high if measures fail
26WH Assessment of suspected eligible data breach
privacy-amendment-notifiable-data-breaches-act-2017.pdf, p.15
26WH(1) Assessment of suspected eligible data breach
Entity must assess suspected eligible data breach
Assessment must occur between awareness and lack of belief in data breach
(b) the entity is not aware that there are reasonable grounds to believe that the relevant circumstances amount to an eligible data breach of the entity.
26WH(2) Assessment of suspected eligible data breach
Entity must carry out assessment and take steps to ensure completion within 30 days.
Entity must carry out assessment and take steps.
26WJ Exception—eligible data breaches of other entities
Compliance with section 26WH exempts eligible data breaches of other entities from this Act.
26WK Statement about eligible data breach
privacy-amendment-notifiable-data-breaches-act-2017.pdf, p.16
26WK(1) Statement about eligible data breach
Entity must report data breach if reasonable grounds exist.
Temporal interval for reporting data breach
(1) This section applies if an entity is aware that there are reasonable grounds to believe that there has been an eligible data breach of the entity.
Reporting data breach implies awareness of data breach
Awareness of data breach spreads to reporting requirement
26WK(2) Statement about eligible data breach
Entity must prepare statement and give copy to Commissioner upon becoming aware of data breach.
26WK(3) Statement about eligible data breach
Entity must provide statement about eligible data breach.
26WK(4) Statement about eligible data breach
Entity must report other affected entities in data breach statement.
Entity must report other affected entities.
26WL Entity must notify eligible data breach
26WL(1) Entity must notify eligible data breach
Entity must notify eligible data breach upon reasonable grounds to believe a breach has occurred.
Notification statement complying with subsection 26WK(3)
26WL(2) Entity must notify eligible data breach
Notification of data breach to individuals and/or public
26WL(3) Entity must notify eligible data breach
Notify eligible data breach upon completion of statement preparation
Method of providing a statement to an individual
26WL(4) Entity must notify eligible data breach
Entity must notify eligible data breach using the same method used for communication.
Entity must notify eligible data breach.
26WM Exception—eligible data breaches of other entities
Exemption for eligible data breaches of other entities
privacy-amendment-notifiable-data-breaches-act-2017.pdf, p.18
26WN Exception—enforcement related activities
Exception for enforcement related activities
26WP Exception—inconsistency with secrecy provisions
26WP(1) Exception—inconsistency with secrecy provisions
26WP(2) Exception—inconsistency with secrecy provisions
Entity exempted from subsection 26WK(2) if compliance with secrecy provision is inconsistent.
Compliance with secrecy provision is inconsistent
26WP(3) Exception—inconsistency with secrecy provisions
Exemption from section 26WL if secrecy provisions are inconsistent
Granting permission to entities from section 26WL
26WP(4) Exception—inconsistency with secrecy provisions
Prescribed secrecy provision means a secrecy provision specified in the regulations.
26WP(5) Exception—inconsistency with secrecy provisions
Exempts certain provisions from secrecy requirements.
Exempts specified provisions from secrecy requirements.
26WP(6) Exception—inconsistency with secrecy provisions
Entity exempted from secrecy provision if compliance with another provision would be inconsistent.
Entity exempted from secrecy provision if it overlaps with the exemption in time.
Entity exempted from secrecy provision if the information flows through it.
Entity exempted from secrecy provision if it is represented in a knowledge base.
26WP(7) Exception—inconsistency with secrecy provisions
Entity exemption from section 26WL if secrecy provision is inconsistent.
Section 26WL does not apply to the entity in relation to the statement.
Exemption overlaps with secrecy provisions.
Section 26WL does not apply to the entity in relation to the statement if compliance would be inconsistent with a prescribed secrecy provision.
Exemption applies until inconsistency resolved.
Exemption diffuses to related statements.
26WQ Exception—declaration by Commissioner
privacy-amendment-notifiable-data-breaches-act-2017.pdf, p.19
26WQ(1) Exception—declaration by Commissioner
Commissioner may declare sections 26WK and 26WL do not apply to an eligible data breach.
Commissioner may declare sections 26WK and 26WL do not apply.
26WQ(2) Exception—declaration by Commissioner
Commissioner's power to extend time for compliance with subsection 26WL(2)
Commissioner's power to extend time for compliance
26WQ(3) Exception—declaration by Commissioner
The Commissioner must make a declaration only if it is reasonable in the circumstances.
The Commissioner must make a declaration.
The Commissioner's decision is based on relevant advice and public interest.
The declaration must be repeated if the circumstances change.
26WQ(4) Exception—declaration by Commissioner
Commissioner may have regard for certain advice
Commissioner's obligation to consider advice
26WQ(5) Exception—declaration by Commissioner
Commissioner may give notice of declaration to entity on own initiative or application.
26WQ(6) Exception—declaration by Commissioner
Application for declaration by Commissioner
26WQ(7) Exception—declaration by Commissioner
Commissioner must give written notice of refusal to entity applying under paragraph (5)(b)
26WQ(8) Exception—declaration by Commissioner
Commissioner's declaration takes effect if application nominates a period and Commissioner specifies different period.
(8) If: an application for a paragraph (1)(d) declaration nominates a period to be specified in the declaration; and the Commissioner makes the declaration, but specifies a different period in the declaration;
the Commissioner is taken not to have refused the application.
Commissioner's declaration takes effect during the nominated period.
Commissioner is taken not to have refused the application if it nominates a period.
26WQ(9) Exception—declaration by Commissioner
Exemption from sections 26WK and 26WL for eligible data breach declarations
26WQ(10) Exception—declaration by Commissioner
Entity cannot apply for data breach compensation if another entity has already applied.
26WQ(11) Exception—declaration by Commissioner
Commissioner may extend period specified in declaration
26WR Commissioner may direct entity to notify eligible data breach
privacy-amendment-notifiable-data-breaches-act-2017.pdf, p.22
26WR(1) Commissioner may direct entity to notify eligible data breach
Commissioner may direct entity to prepare a statement and give it to the Commissioner.
26WR(2) Commissioner may direct entity to notify eligible data breach
Notification of data breach to individuals and public
26WR(3) Commissioner may direct entity to notify eligible data breach
Entity must notify eligible data breach upon request from Commissioner.
Submission to the Commissioner within a specified period.
26WR(4) Commissioner may direct entity to notify eligible data breach
Statement with entity details, data breach description, and response recommendations.
26WR(5) Commissioner may direct entity to notify eligible data breach
Commissioner may direct entity to notify eligible data breach
specified information relating to the eligible data breach
26WR(6) Commissioner may direct entity to notify eligible data breach
Commissioner must consider certain advice and submissions when deciding whether to direct an entity to notify a data breach.
26WR(7) Commissioner may direct entity to notify eligible data breach
26WR(8) Commissioner may direct entity to notify eligible data breach
Entity must notify eligible data breach and provide additional information if required by the Commissioner.
26WR(9) Commissioner may direct entity to notify eligible data breach
Entity must comply with direction to notify eligible data breach
26WR(10) Commissioner may direct entity to notify eligible data breach
Entity must comply with direction on data breach notification
Entity has a duty to comply with the direction
26WS Exception—enforcement related activities
Entity exempt from direction under subsection 26WR(1) if chief executive officer believes compliance would prejudice enforcement activities.
privacy-amendment-notifiable-data-breaches-act-2017.pdf, p.24
Entity exempt from direction under subsection 26WR(1)
Chief executive officer believes compliance would prejudice enforcement activities.
26WT Exception—inconsistency with secrecy provisions
26WT(1) Exception—inconsistency with secrecy provisions
Prohibition on disclosure of information from other laws
Prohibits the use or disclosure of information
(a) is a provision of a law of the Commonwealth (other than this Act)
(1) For the purposes of this section, secrecy provision means a provision that...
Defines secrecy provision as a provision of another law
...secrecy provision means a provision that...
Regulates the use or disclosure of information from other laws
(b) prohibits or regulates the use or disclosure of information
...provides a provision that regulates the use or disclosure of information
Applies to provisions regulating secrecy during this Act's effective period
...provides a provision that regulates the use or disclosure of information during this Act's effective period
Prohibits the use or disclosure of information from other laws
...provides a provision that forbids the use or disclosure of information
26WT(2) Exception—inconsistency with secrecy provisions
Entity exempt from secrecy provisions if compliance with other provisions would be inconsistent.
Compliance with other provisions would be inconsistent.
26WT(3) Exception—inconsistency with secrecy provisions
Indicates a relationship between two concepts.
Describes the conditions under which a secrecy provision is prescribed.
26WT(4) Exception—inconsistency with secrecy provisions
Exempts secrecy provisions from requiring or authorizing the use or disclosure of information.
26WT(5) Exception—inconsistency with secrecy provisions
Entity exempted from secrecy provisions if compliance with other provisions would be inconsistent.
Entity exempted from secrecy provisions.
Does not apply to the entity in relation to the statement.
4 After paragraph 96(1)(b)
Decisions under certain subsections to refuse or make declarations.
privacy-amendment-notifiable-data-breaches-act-2017.pdf, p.25
5 After subsection 96(2)
5(2A) After subsection 96(2)
Entity that made the application for a declaration or another entity affected by the decision to refuse the application may make an application.
May be made by entity that made the application or another affected entity.
(2A) An application under paragraph (1)(ba)
5(2B) After subsection 96(2)
Application under paragraph (1)(bb) may only be made by the entity to whom notice of the declaration was given or another entity whose compliance with subsection 26WL(2) is affected.
5(2C) After subsection 96(2)
Application under paragraph (1)(bc) must be made by the entity to whom the direction was given.
5(2D) After subsection 96(2)
Defines entity for purposes of subsections (2A), (2B) and (2C)
6 Application of amendments—eligible data breaches
Application of amendments—eligible data breaches
privacy-amendment-notifiable-data-breaches-act-2017.pdf, p.26