Test Any Data Breach Notice Against What the Law Requires

Stop reading lists of the world’s biggest data breaches. They tell you how large a number can get and nothing about what to do when an email arrives saying your details were part of one.

The more useful question for an Australian is narrower. What does the company have to tell you, how soon, and what should you do with the notice? There is a legal answer to the first two, and it makes the third much easier.

The rule that decides what you get told

Since 2018, Part IIIC of the Privacy Act 1988 has required many organisations to report certain breaches. It is called the Notifiable Data Breaches scheme, and the Office of the Australian Information Commissioner (OAIC) runs it. It covers federal agencies and many businesses, including health service providers and businesses above a turnover threshold, though some small businesses sit outside it.

The trigger is an “eligible data breach”: unauthorised access to, or disclosure or loss of, personal information that is likely to result in serious harm to someone. If an organisation suspects that has happened, it has to assess the situation quickly, and the OAIC’s guidance puts the outer limit for that assessment at 30 days. If the assessment confirms an eligible breach, the organisation must tell the OAIC and the people affected as soon as practicable.

The notice isn’t free-form. It should name the organisation, describe what happened, say what kinds of information were involved and recommend what you should do next. If yours doesn’t say which of your details were taken, it is incomplete, and you are entitled to ask.

One exception is worth knowing. If the organisation contains the problem before serious harm is likely, it may not have to notify at all. That’s why you sometimes read about a breach in the news before an email arrives, or never get one.

What the big Australian breaches showed

Two incidents from 2022 are the ones most Australians remember: the Optus breach in September and the Medibank breach in October. One hit a mobile carrier and the other a health insurer, and both involved the kind of personal details that can be used to impersonate you. In the insurer’s case, health-related information was part of it.

They also showed something the global lists hide. The harm doesn’t end with the headline. Stolen details make later scams more convincing, because a caller who knows your date of birth and address sounds like the real company. For months afterwards the sensible assumption is that any unexpected message mentioning your account could be a copy of a genuine one.

Those global lists also blur two different events. Yahoo, Equifax, Marriott and Target were intrusions. The Facebook and Cambridge Analytica case was not a hack at all. It was a consent failure, with data collected through an app and used in ways people hadn’t agreed to. The response differs. After an intrusion you change credentials and watch for fraud. After a consent failure you review what you’ve shared and with whom, which is the same habit that applies to the apps and assistants on your phone, and one worth building after reading about how AI tools shape an ordinary day.

A test for any breach notice

Work through these in order. Most take a few minutes.

1. Is the notice real? Don’t click a link in the email. Open the company’s app or type its address yourself. Scammers send fake breach notices precisely because everyone expects one.
2. Which details were involved? A leaked password means changing the password. A leaked licence or passport number means asking the issuing body about replacement, and the options differ by document and by state.
3. Can the detail be changed? Passwords can. A date of birth can’t. The details you can’t change are the ones to watch for longest.
4. Where else did you use that password? Reuse is what turns one breach into five. Change every account that shared it, starting with your email, because every reset link goes there.
5. Is multi-factor authentication on for email and banking? If it isn’t, switch it on today.
6. Why do they still have your data? Under the Australian Privacy Principles, organisations must take reasonable steps to destroy or de-identify personal information they no longer need (APP 11), and you can ask to see what they hold about you (APP 12). A written request is a reasonable first step and often gets a clearer answer than the notice did.

Anything the notice leaves unanswered goes back to the company in writing. If you’re unhappy with the reply, the OAIC takes privacy complaints.

If identity documents were involved

Licence, passport and Medicare numbers are the awkward ones, because you can’t simply pick a new one overnight. Three steps cover most of it.

First, ask the issuing body whether the document can be reissued or flagged. Second, if you suspect someone is using your identity, you can ask the credit reporting bodies to place a ban on your credit file, which stops them releasing your credit report for credit checks for a limited period. Third, report identity misuse through the government’s ReportCyber service, so there’s a record if a fraud claim follows.

None of that needs doing in a panic. It needs doing once, in the first week, and then you can go back to ordinary life with a calendar reminder to check your credit report later.

The fair objection

The strongest objection is that none of this is your fault. A company that holds millions of records and loses them has failed at its job, and a stronger password on your side doesn’t fix its security. That’s right, and it’s why the scheme puts the duty to tell you on the organisation rather than on you.

But the steps above aren’t about blame. They limit what a thief can do with what they hold. Changing a reused password takes minutes and closes off the cheapest attack there is, so the trade is worth making even when you did nothing wrong.

Where that leaves you

A breach notice is a to-do list. It isn’t a verdict on you, and it isn’t a reason to panic. Check it’s real, find out what was taken, change what can be changed, watch what can’t, and ask why the data was still there. How big the breach looked in the headlines matters far less than whether you did those things in the first week.

Sources: Privacy Act 1988 (Cth), Part IIIC, Notifiable Data Breaches (https://www.legislation.gov.au/C2004A03712/latest/text); Office of the Australian Information Commissioner, Notifiable Data Breaches scheme (https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme); Office of the Australian Information Commissioner, Australian Privacy Principles, APP 11 and APP 12 (https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information); Office of the Australian Information Commissioner, APP 12 Access to personal information (https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-12-app-12-access-to-personal-information); Office of the Australian Information Commissioner, Fraud and your credit report (https://www.oaic.gov.au/privacy/your-privacy-rights/credit-reporting/fraud-and-your-credit-report); Australian Signals Directorate, ReportCyber (https://www.cyber.gov.au/submit-a-report)