Privacy & Data Protection

In the wake of the recent wave of high-profile data breaches at Optus, Medibank and MyDeal, Attorney-General Mark Dreyfus tabled the Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 (the Bill) in Parliament on 26 October 2022.   The Attorney-General referred to the data breaches having highlighted ‘the potential to cause serious financial and emotional harm to Australians’ and that the bill sends a clear message that the government takes privacy, security and data protection seriously.  The Bill significantly increases penalties under the Privacy Act 1988 (Cth), provides the Australian Information and Privacy Commissioner with increased powers to resolve privacy breaches and strengthens the Notifiable Data Breaches Scheme.

Increased penalties

Penalties for a serious or repeated breach of privacy will be significantly increased from the current maximum of $2.22 million to not more than the greater of:

• $50 million;
• three times the value of any benefit obtained through the misuse of the information; or,
• if the value of the benefit obtained cannot be determined, 30% of a company’s domestic turnover in the relevant period, which is a minimum 12 months.

In the Second Reading Speech, the Attorney-General stated that, ‘penalties for privacy breaches cannot be seen as simply the cost of doing business. Entities must be incentivised to have strong cyber and data security safeguards in place to protect Australians.’

Strengthened Notifiable Data Breaches Scheme (NDB Scheme)

The existing NDB Scheme will be strengthened in two significant ways by:

• empowering the Privacy Commissioner to assess an entity’s compliance with the Scheme’s requirements.
• providing the Privacy Commissioner with new information-gathering powers in regard to the Scheme’s reporting and notification requirements.

Enhanced enforcement powers

The Bill will also improve the powers available to the Privacy Commissioner to:

• Resolve privacy breaches by empowering the Commissioner to publish notices about specific breaches of privacy or otherwise ensure those directly affected are informed;
• Compel entities to undertake external reviews to improve their practices to reduce the likelihood of them committing a breach again; and
• Provide new information-gathering powers to conduct assessments and new infringement notice powers that can be used if an entity fails to provide information when required, without the need to engage in litigation.

Extraterritorial powers

The Privacy Act’s extraterritoriality provisions will be amended, so that foreign organisations which ‘carry on a business’ in Australia must meet the obligations under the Privacy Act.  In the second-reading speech, the Attorney-General explained that the purpose of this amendment is ‘to ensure Australia’s privacy laws remain fit for purpose in a globalised world and to ensure the Privacy Act can be enforced against global technology companies who may process Australians’ information on servers offshore’.

Greater information sharing arrangements

The Privacy Commissioner will have the express power to publish a final determination following a privacy investigation as well as information about their final assessment report. The Commissioner will be able to publish information about other matters, such as an update about an ongoing privacy investigation, if it is in the public interest.

The Commissioner will also be able to share information with enforcement bodies, alternative complaint bodies and privacy regulators for the purpose of the Commissioner or the receiving body exercising their functions and powers. The Australian Communications and Media Authority will also be provided better powers to share information within government for enforcement purposes.

The aim of the improved information sharing arrangements is to, ‘drive better cooperation between regulators in order to deliver better outcomes for Australians’.

PREPARATION CHECKLIST

Review the checklist below to see how well prepared your organisation is to demonstrate compliance with the Australian Privacy Act 1988 (Cth) (Cth.

1. Policy Compliance

Check that Privacy Policies and Notices up to date and compliant.

• Audit whether your Privacy Policy is being adhered to within the organisation.
• Audit whether the collection of personal data accords with the Privacy Notice.

2. Data Minimisation

Check – what personal data does your organisation really need to collect?

One of the critical risks to finally receive attention in Australia arising from the Optus and Harcourt data breaches is the over-collection and over-retention of personal data.

Review Privacy Notices and audit personal data being collected to assess whether it is reasonably required to provide a service or to be collected in accordance with a regulatory obligation to collect and retain that personal data.

3. Data Over-Retention

Check the process for securely disposing personal data.

Audit whether personal data is being disposed of when it is no longer required to be retained in accordance with the organisation’s Records and Archiving Policy or with regulatory requirements to retain records.

In light of the recent high profile data breaches, the over-retention of personal data poses a significant risk for organisations in the event of a serious data breach.

4. Data Map

Ensure there is an up-to-date data map, showing where data is stored, particularly personal data, which is essential for:

• Robust information lifecycle management, including disposal of data that is no longer required to be retained;
• Responding efficiently to a serious data breach by being able to quickly identity the types of data that have been subject to unauthorised access;
• Demonstrating the measures in place to protect and secure personal data in accordance with the requirements of the Privacy Act.

Check whether it is includes identifying and locating personal in all the organisation’s systems including cloud storage and any third-parties’ systems that have been listed on the data map identifying all the locations where personal data is stored?

5. Data Security

Ensure the organisation is prepared to defend against and respond to cyber-attacks and incidents by assessing whether:

• Organisational IT policies (BYOD, password, data management, IT procurement, network access) up to date and being complied with (check via audit).
• Necessary steps have been taken to protect personal data in the custody of the organisation – e.g. encryption being applied to all personal data both in transit and at rest as required.
• User, application and backend access controls are correct and up to date. Personal data being held in locations with limited or just-in-time access.
• Local and cloud-based and third party controlled applications used by the organisation have been tested for security suitability and approved for use.
• The organisation has fit for purpose security software and hardware to assist in the prevention, detection and response to security incidents (e.g. multi-factor authentication on critical systems particularly those with external access, anti-virus/mal-ware suites, actively managed proxy firewalls, intrusion detection systems, enterprise incident response applications).
• Proactive steps to build security culture and awareness within the organisation are taking place (e.g. training, education, phishing and social engineering exercises).
• Relevant security information and performance metrics are being reported to executives and the board

6. Data Breach Incident Response Plan

Check has your data breach incident response plan been reviewed and updated? Consider the following elements:

• Are roles and responsibilities during a data breach clearly laid out and up to date?
• Is there clear escalation procedures and established arrangements to activate internal or external incident response specialists?
• Does the plan have sufficient detail and guidance to address both deliberate and accidental data breach incidents, as well as internal and external originating threats?
• Are there protocols in place for capture and analysis of logs and other records from critical systems in the event of a suspected breach?
• Does the response plan provide sufficient guidance on how to approach internal and external communications, particularly with media and customers?
• Has there been recent data breach response training exercise carried out involving executives, Board and key players listed in the response plan?

7. Robust Information Governance

Implement and/or review the Information Governance Framework and polices to ensure there is adequate holistic information governance reporting, which is identifying and monitoring privacy compliance across the organisation including the various areas of privacy and legal, IT and cybersecurity and records and information siloes.

A robust enterprise-wide information governance framework provides a mechanism to co-ordinate and collaborate across the organisational siloes and to promote an information and data protection culture led from the top-down to minimise privacy and data breach risks.

At least one-third of all data breaches are caused by human error and many other successful cyberattacks are greatly enabled by human error from within an organisation.  Robust information governance can greatly assist in both minimising data and information risks as well as enabling organisations to maximise data and information value.

Authors: Susan Bennett, Founder and Executive-Director InfoGovANZ and Dr Peter Chapman, Forensic Technology Expert and InfoGovANZ Advisory Board

While Australia and New Zealand have successfully flattened the COVID-19 curve, the approaches of each country have somewhat differed, both in relation to the level of restrictions imposed on citizens, as well as the type of contact tracing technology deployed.

Australia and New Zealand stand alongside Germany, South Korea and Singapore as examples of countries that followed the advice of their scientists and moved into lockdown in a timely way to limit the spread of the COVID-19 virus.

Australia, similar to other countries, experienced a doubling of COVID-19 positive people every two days as it went into lockdown. The containment of the coronavirus in Australia and New Zealand is a result of a multipronged strategy that includes prompt lockdowns restricting movement and requiring social distancing; quarantining of international travellers for 14 days; and a high rate of testing and contact tracing.

The governments of both countries have developed their own voluntary app to speed up and support the manual tracking process of people who have been in contact with individuals who tested positive for COVID-19. Australia’s COVIDSafe app is a modified version of Singapore’s TraceTogether using Bluetooth technology to track encounters between the user’s phone and other phones that are using the app. New Zealand’s COVID Tracer app enables users to record their visits to specific businesses and organisations that have registered with either the Ministry of Health or the Ministry of Business, Innovation and Employment.

Australia’s COVIDSafe App

Australia launched its COVIDSafe app on 26 April 2020, with one million downloads in the first 24 hours. By the end of the first week, over four million people had downloaded the app. While the initial download rate of the app was positive, the rate then slowed. A month later, at the end of May, just over six million people had downloaded the app, which is nearly 25 percent of the population, although still a distance from the government’s 40 percent take-up target.[1]

The COVIDSafe app is considered by Australia’s Chief Medical Officer and the Government as a key tool to expedite contact tracing to enable lockdown restrictions to ease and enable Australians to return to everyday living more quickly. Privacy has been a central consideration in the development of the app and the COVIDSafe legislation, passed by Parliament on 14 May 2020, enshrines that the app is voluntary and no one is required to download it.[2]

How It Works

Following the approach of Singapore’s TraceTogether software, the COVIDSafe app uses Bluetooth technology to find other COVIDSafe app users. Australians are asked to provide a name (which can be a pseudonym), a contact phone number, a postcode and an age range. The app records the date, time, distance, duration of the contact and the other user’s reference code. The app does not collect location data. The information is encrypted and stored on the user’s phone. The contact information stored on phones is deleted on a 21-day rolling cycle. Users who test positive for COVID-19 have the option of uploading the encrypted data on their device to the National COVIDSafe data store. The uploaded data is information about other users who have been in contact within 1.5 metres for 15 minutes or more.

Privacy Protections

Privacy was a central consideration in the development of the COVIDSafe app. At the time the COVIDSafe app was launched, the Privacy Impact Assessment (PIA) report, the Department of Health’s Agency Response to the PIA, and the Privacy Policy for the app were made publicly available.[3]

Prior to passing the legislation on 14 May 2020, the Health Minister issued a Determination under the Biosecurity Act to protect people’s privacy and restrict access to information obtained from the app. The Determination enabled State and Territory health authorities to access the information solely for contact tracing, but only with the explicit consent of the user.[4] The only other access was by the COVIDSafe Administrator, including deletion of registration information at the user’s request.

On 5 May 2020, the Australian Government released the draft Privacy Amendment (Public Health Contact Information) Bill 2020, (COVIDSafe Act), which was subsequently passed by both houses of Parliament on 14 May 2020. The COVIDSafe Act enshrines privacy protections contained in the Health Minister’s Determination under the Biosecurity Act 2015. Breaching the requirements of the legislation is a criminal offence, a breach of the Privacy Act 1988, or both.

The COVIDSafe Act protects the app as being voluntary, stating that no one can be forced to download or use COVIDSafe or upload its data to the National COVIDSafe data store. The Act makes it a criminal offence, punishable by up to five years in prison or a $63,000 fine per breach, or both, to misuse the data or pass it on without the explicit permission of the user after contracting COVID-19. Data will be deleted every 21 days and the administrator of the National COVIDSafe data store will delete users’ registration data upon request. The legislation provides a process to be put in place for COVIDSafe data to be deleted at the end of the COVID-19 pandemic and users to be notified accordingly.

Over Collection of Data

Privacy academics Professor Graham Greenleaf and Dr. Katharine Kemp stated that ‘[a] crucial problem with the legislation is it allows the government to collect much more personal data than is necessary for contact tracing.’[5] They refer to the PIA of COVIDSafe and point out that the app collects data about ‘all other users who came within Bluetooth signal range even for a minute within the preceding 21 days.’ As Greenleaf and Kemp point out, the data collected should be minimised to that which is necessary and technically possible.

Data Storage

The data collected by the COVIDSafe app will be stored in Canberra in the National COVIDSafe data store. After it emerged that the government contract for storage of the COVIDSafe data was awarded to U.S. tech giant Amazon Web Services (AWS), concerns were raised about the global tech giant being awarded the contract over an Australian provider and the potential access to the data by the U.S. government, given the extraterritorial reach of the U.S. CLOUD Act 2018.

In response to the concerns, Health Minister Greg Hunt stated that he received advice from Attorney-General Christian Porter’s office that protections under Australia’s Biosecurity Act 2015 would prevail over the CLOUD Act.[6]  The Department of Health’s information webpage about COVIDSafe explains that the Australian Government’s Digital Transformation Agency had existing contracts with AWS, that the data is required to be stored in Australia, and AWS does not have access to the national COVIDSafe data store.[7]

Cybersecurity Concerns

Cybersecurity concerns have focused on the risks around a National COVIDSafe data store, as well as cybercrimes. The Australian Cyber Security Centre reports that from 10 March to early June 2020, there were more than 1,100 related COVID-19 scams reported to the Australian Competition and Consumer Commission (ACCC), 95 cybercrime reports related to COVID-19 themed scams and online frauds, 20 cybersecurity incidents affecting COVID-19 response services and/or major national suppliers, and over 150 malicious COVID-19 theme websites.[8]

Prior to the release of the COVIDSafe app, it was independently reviewed by the Cyber Security Cooperative Research Centre and CSIRO’s Data 61 with a team of cyber experts. The app’s source code was made available on 7 May 2020. While it was a further demonstration of transparency and enabled further scrutiny, the server code on ‘which all the important encryption is done’ was not made available.[9]

Limitations of Bluetooth Functionality

It has been slow going fixing Bluetooth bugs and there were challenges getting the app to work properly on iPhones.[10] The Apple version of the COVIDSafe app needed to be open for the Bluetooth functionality to work on iPhones, which drains the battery. However, an updated version enables the iPhone screen to be locked as long as the app is open. Upon releasing the second update to COVIDSafe, the Digital Transformation Agency’s media release on 14 May 2020, explained:[11]

We are continuing to make iterative improvements to enhance COVIDSafe’s Bluetooth performance.’

Today’s update includes new code from the United Kingdom Government’s National Health Service (NHSX) that improves the COVIDSafe app’s Bluetooth performance on iOS devices, including when the device is locked.

We continue to work with Apple and Google on further enhancements that will improve COVIDSafe’s performance.’

Google and Apple

In April 2020, Google and Apple announced a joint collaboration to enable the use of Bluetooth technology to help governments and health agencies to reduce the spread of COVID-19. User privacy and security are central to the design.

On 21 May 2020, Google and Apple released their contact tracing API to 22 countries, including Australia. The Exposure Notification System enables those who test positive to COVID-19 to alert others so they can isolate and/or get tested. Importantly, device location is not collected; it holds data only on users’ phones with no central data repositories and only official public health authorities are allowed to use the system whose apps ‘meet the specific criteria around privacy, security and data control.’

This decentralised approach is in contrast to Australia’s centralised data store for those who test positive and consent to upload their personal information and those they have been in contact with, which is then sent to the relevant state or territory carrying out the contact tracing. The collection of additional personal information, such as phone numbers, means that if the Australian government wants to utilise the Exposure Notification System, it will need to make modifications to the COVIDSafe app.

Differences in Australian and New Zealand Approaches

While Australia embarked on a suppression strategy of COVID-19, New Zealand implemented a higher level of lockdown restrictions, pursuant to the COVID-19 Response (Urgent Management Measures) Legislation Act 2020, with the objective of eliminating COVID-19.[12] New Zealand’s first reported COVID-19 case was on 28 February 2020 and on 26 March 2020, Prime Minister Jacinda Ardern, implemented the COVID-19 Alert System Level 4 – Lockdown.

By 26 April 2020, New Zealand had 1,121 confirmed COVID-19 cases and 18 deaths, with only four new cases reported on the preceding day. New Zealand’s approach required all nonessential services to be shut down, so basically only supermarkets and pharmacies remained open. This was significantly more restrictive than Australia’s lockdown, which enabled cafes and restaurants to continue to provide take-away services and other retail outlets to remain open.

On 8 June 2020, New Zealand was COVID-19 free after the recovery of the last person with COVID-19 and 17 days without a new case. The following day, all restrictions were lifted. Controls at the border remain in place, however, with a mandatory 14-day quarantine or self-isolation.

While Australia’s strategy was suppression, with the first confirmed case late in January 2020, the extent of containing the pandemic before the launch of the COVIDSafe app was impressive. There were 6,710 reported cases and 83 COVID-19 deaths in Australia. In the preceding six days leading up to the app’s launch on 26 April 2020, there were only between eight and 22 people testing positive across the entire country. On 8 June 2020, New South Wales, with a population of eight million, reported two new COVID-19 cases for the first of June 2020.[13]

Australia, with one of the highest levels of testing rates for COVID-19 per capita globally, has experienced a 1.4 percent mortality rate, which is slightly lower than New Zealand’s mortality rate of 1.5 percent. While these rates are low, there are other countries with lower mortality rates, such as Singapore at 0.43 percent, which is in stark contrast to the United Kingdom’s 14.2 percent mortality rate and 5.8 percent in the United States, according to Johns Hopkins University & Medicine Coronavirus Resource Center – Cases and mortality by country chart as at 7 June 2020.[14]

Contact Tracing in New Zealand

While the focus on technology to assist in contact tracing is a key plank for the Australian Government to enable the continuing containment of the virus, the New Zealand approach places less importance on the role of technology in contact tracing. On 19 April 2020, Prime Minister Ardern said in a COVID-19 media update:[15]

An app will only ever supplement the work that we have to do for contact tracing. And, again, most countries who have an app like this will highlight that you have to have the foundation of people and a people-centred network of contact tracers.’

The Prime Minister also asked New Zealanders to keep a diary of their daily movements to help with contact tracing. [16]

While the shutdown was very effective in New Zealand for containing the spread of COVID-19, Level 4 restrictions were reduced to Level 3 restrictions on 27 April 2020. This coincided with increasing concerns about the very serious economic challenges that were mounting, including from a group of academics who launched a campaign called ‘Plan B’, arguing the Level 4 measures were too strict and would create more serious problems. On 7 May 2020, Prime Minister Ardern set out Level 2 rules, with the Cabinet making a decision to reduce the level of restrictions on 11 May 2020.

On 20 May 2020, the New Zealand Ministry of Health launched its voluntary NZ COVID Tracer app together with the privacy impact assessment.[17] The Trace app enables users to create a digital diary of the locations visited by the user. The phone camera scans and selects any Ministry of Health COVID-19 QR code posters displayed by businesses and organisations visited. The QR codes contain the name of the business or organisation, its business number, the address and the global location number of the premises. The digital diary is designed to support, rather than replace, existing contacting tracing processes.

New Zealand’s Privacy Commissioner John Edwards said, ‘The Ministry’s app is a privacy-friendly solution for contact tracing which New Zealanders should feel secure in downloading and using. [18]

Is the COVIDSafe App Making a Difference?

At the launch of the COVIDSafe app, Health Minister Greg Hunt explained that the contact tracing app was one of three keys for Australia’s recovery from the pandemic. The other two were to expand testing capacity to people who are asymptomatic and increase rapid response capability, such as what occurred for the outbreak in a regional Tasmanian hospital, to contain outbreaks.

The Singapore experience shows that while the virus can be suppressed, there can be cluster outbreaks, such as those that have occurred in Singapore’s migrant worker dormitories. Cluster outbreaks in New South Wales in aged care homes, a regional hospital in Tasmania, and a meat abattoir in Victoria similarly highlight the significant challenges that are continually being reported and could last for up to two years. However, the Australian suppression strategy – with social distancing, allowing cafes and restaurants to do take-away, and allowing retail shops and hairdressers to remain open – has enabled Australia to still achieve suppression and possibly elimination all before the COVIDSafe app was available.

By the first week of June 2020, more than a month after the app’s launch, it was reported that there had only been one known case where a COVID-19 patient had downloaded the app and consented to the Victorian Health Department using the data. The data identified a person who hadn’t been identified in the initial interviewing process.

Deputy Chief Medical Officer, Dr Nick Coatsworth, explained, ‘[t]hat reflects how well Australia is doing. There are so few cases that it will naturally mean that the app will not be as well utilised by public health authorities simply because the cases are low’.[19]  While the app has so far not yielded any significant benefits, it is part of the overall response strategy of test, trace and self-isolate, and will be important in the event of a significant cluster outbreak or a second wave of the pandemic.

Conclusion

Australia and New Zealand developed their contact tracing apps as part of an overall strategy of testing, contact tracing, early self- isolation, and mandatory quarantining of international travellers. The use of contact tracing technology supports the manual tracking undertaken by people who were in contact with those individuals who test positive for COVID-19.

The actions of the Australian and New Zealand governments to restrict movement in a timely way has resulted in containment of the pandemic to date. Given the initial success of this suppression strategy in Australia and the elimination of COVID-19 in New Zealand, the contact tracing technology has not to date played a significant role. However, as a means of supporting and speeding up manual contact tracing in any cluster outbreaks or second waves of the pandemic, the apps are important tools for tracing potentially infected individuals to minimise further spread of COVID-19.

While both apps are voluntary, the COVIDSafe app has only been downloaded by 25 percent of Australians and is still well short of the target of 40 percent of the population. Once users have downloaded the app and where the user consents, the data can be accessed quickly and easily to track individuals who were in contact with the user for more than 15 minutes. The New Zealand app, on the other hand, minimises data collection, but requires ongoing commitment by users to scan codes of all premises they visit. The different approaches to the apps, where not all contacts are traced, highlight the usage of this type of technology as a support tool to manual contact tracing and is appropriate given the privacy and cybersecurity concerns and the low levels of COVID-19 infection rates.

It is clear that contact tracing is key to containing the expected continuing outbreaks and will assist in returning to a post COVID-19 ‘new normal’ world. There is no doubt that technology will provide a faster and more efficient way of finding and containing fast spreading COVID-19 cluster outbreaks than asking people to either remember or keep a record of all their movements. The role of contact tracing technology, particularly given that the pandemic is being predicted to be with us in one form or another for up to two years, will be crucial in managing the pandemic.

The key is for governments to ensure that privacy and cyber risks are mitigated and minimised. It would be a significantly good outcome for citizens where the use of technology for contact tracing ensures that cluster outbreaks are contained and there is a return to everyday living without further widespread waves of the pandemic and lockdowns.

While we as citizens have demonstrated we can live with restrictions on our movements and requirements to social distance without technology surveillance, we need government to demonstrate it can be trusted with our personal information.

Author

Susan Bennett (LLM(Hons), MBA, FGIA, CIPP/E) is the Founder and Executive Director, Information Governance ANZ and Principal, Sibenco Legal & Advisory

References

[1]  Meixner, Sophie, ‘How many people have downloaded the COVIDSafe app and how central has it been to Australia’s coronavirus response?’, ABC, 2 June 2020 , <https://www.abc.net.au/news/2020-06-02/coronavirus-covid19-covidsafe-app-how-many-downloads-greg-hunt/12295130>.

[2] Privacy Amendment (Public Health Contact Information) Act 2020.

[3] Department of Health, COVIDSafe Application Privacy Impact Assessment, <https://www.health.gov.au/resources/publications/covidsafe-application-privacy-impact-assessment>.

[4] Biosecurity (Human Biosecurity Emergency) (Human Coronavirus with Pandemic Potential) (Emergency Requirements—Public Health Contact Information) Determination 2020, <https://www.legislation.gov.au/Details/F2020L00480>.

[5] Greenleaf, Graham and Kemp, Katharine, Australia’s COVIDSafe Experiment, Phase III: Legislation for Trust in Contact Tracing (May 15, 2020). (2020) University of New South Wales Law Research Series. Available at SSRN: https://ssrn.com/abstract=3601730.

[6] Koslowski, Max, ‘Coronavirus app data will stay here despite US security laws, Health Minister says’, 28 April 2020, Sydney Morning Herald, <https://www.smh.com.au/politics/federal/coronavirus-app-data-will-stay-here-despite-us-security-laws-health-minister-says-20200428-p54o05.html>.

[7] Department of Health, COVIDSafe help, Why did the Australian Government choose Amazon Web Services? <https://www.health.gov.au/resources/apps-and-tools/covidsafe-app/covidsafe-help>.

[8] Australian Government, Australian Cyber Security Centre, ‘Threat update: COVID-19 malicious cyber activity’, as of 7 June 2020, <https://www.cyber.gov.au/threats/threat-update-covid-19-malicious-cyber-activity-20-apr-2020>.

[9] Teague, Vanessa, posted on Twitter 11 May 2020, <https://twitter.com/VTeagueAus/status/1259644018939408384>.

[10] Basford, Sarah, ‘CovidSafe still has bugs, according to experts’, Gizmodo, 25 May 2020 <gizmodo.com.au/2020/05/covidsafe-bugs-ios-android-tracking-privacy/>.

[11] Digital Transformation Agency, ‘The new release of COVIDSafe is live’, 14 May 2020, https://www.dta.gov.au/news/next-release-covidsafe-live

[12] COVID-19 Response (Urgent Management Measures) Legislation Act 2020, <https://www.parliament.nz/en/pb/bills-and-laws/bills-proposed-laws/document/BILL_96378/covid-19-response-urgent-management-measures-legislation>.

[13] NSW Department of Health, NSW COVID-19 case statistics, <https://www.health.nsw.gov.au/Infectious/covid-19/Pages/stats-nsw.aspx>, See also Department of Health, Coronavirus (COVID-19) current situation and case numbers, <https://www.health.gov.au/news/health-alerts/novel-coronavirus-2019-ncov-health-alert/coronavirus-covid-19-current-situation-and-case-numbers#total-cases-recoveries-deaths-and-new-cases-in-the-last-24-hours>.

[14] Johns Hopkins University & Medicine, Coronavirus Resource Center, Mortality Analysis, 7 June 2020, <https://coronavirus.jhu.edu/data/mortality>.

[15] Covid-19 media update, 19 April 2020, Ministry of Health, <https://www.health.govt.nz/news-media/news-items/covid-19-media-update-19-april>.

[16] Ibid.

[17] NZ COVID Tracer app, Ministry of Health, <https://www.health.govt.nz/our-work/diseases-and-conditions/covid-19-novel-coronavirus/covid-19-novel-coronavirus-resources-and-tools/nz-covid-tracer-app>.

[18] New Zealand Privacy Commission, ‘Privacy Commissioner backs NZ COVID Traces app’, 20 May 2020, <https://www.privacy.org.nz/news-and-publications/statements-media-releases/privacy-commissioner-backs-nz-covid-tracer-app/?mc_cid=cd56848da2&mc_eid=a12a97dd18>.

[19] Meixner, Sophie, ‘How many people have downloaded the COVIDSafe app and how central has it been to Australia’s coronavirus response?’, ABC, 2 June 2020 , <https://www.abc.net.au/news/2020-06-02/coronavirus-covid19-covidsafe-app-how-many-downloads-greg-hunt/12295130>.

The European’s Union General Data Protection Regulation (GDPR) imposes significant change to privacy laws in Europe and will apply and be enforced from 25 May 2018.   Organisations that fail to comply with the GDPR face heavy fines up to €20 million or up to 4% of global annual turnover, whichever is higher.  The GPDR will have a global impact because it applies to businesses operating in the EU as well as businesses outside the EU that offer goods or services or monitor the behaviour of individuals in the EU.  Businesses that are subject to the GDPR should assess their current information and privacy processes and governance structures, and take the necessary steps to ensure GDPR compliance.

Background to GDPR

After four years of debate, the GDPR was approved by EU Parliament on 14 April 2016 and comes into force on 25 May 2018.   The GDPR replaces the Data Protection Directive 95/46/EC and as set out in the EU GDPR website ‘was designed to harmonise data privacy laws across Europe, to protect and empower all EU citizens data privacy and to reshape the way organisations across the region approach data privacy’.

Extended jurisdiction

A major change is the extended jurisdiction of the GDPR set out in Article 3, as it applies to the processing of personal data of individuals in the EU by a controller or processor not in the EU where the processing activities are related to:

• The offering of goods and services, irrespective of whether a payment of the individual is required;
• The monitoring of their behaviour as far as their behaviour takes place within the EU.

Controllers determine the purpose and means of processing personal data (Article 4(7)).  They are the principal party with responsibilities including – collecting and managing consent and enabling rights under the GDPR.  Processors means the organisation which processes personal data on behalf of the controller (Article 4(2)).  The obligations on data processors under the GDPR are new.  Article 28 (1) requires controllers to only use processors providing ‘sufficient guarantees to implement appropriate technical and organisational measures’ that will meet the GDPR requirements.

Implication for Australian businesses and how to comply

The GDPR applies to the following:

• Australian businesses that are data processors or controllers with an establishment in the EU. That is, either an Australian business operating either on its own account or through a related entity or subsidiary, that is either processing or controlling personal data of EU residents, whether or not the data is processed in the EU;
• Australian businesses offering goods or services to individuals in the EU (irrespective of whether payment is required).
• Australian businesses monitoring the behaviour of individuals in the EU, where that behaviour takes place in the EU. Internet tracking of individuals and profiling are examples of monitoring (Recital 24).

To comply with the GDPR, Australian businesses that are data controllers and processors, which are not established in the EU, must appoint a representative within the EU in one of the Member States where the individuals who personal data are processed reside.  The representative is the point of contact for supervisory authorities and individuals in the EU on all issues related to data processing under the GDRP (Article 27).

GDRP applies to personal data

The GDPR applies to the processing of personal data (Article 2).  The GDPR states that ‘personal data’ means ‘any information relating to an identified or identifiable natural person (‘data subject’).  An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location number, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Article 4).

The GDPR refers to sensitive personal data as ‘special categories of personal data’ (Article 9).  The special categories specifically include genetic data, and biometric data where processed to uniquely identify an individual.

The Privacy Act 1988 (Cth) defines personal information as, ‘information or an opinion, whether true or not, and whether recorded in a material form or not, about an identified individual, or an individual who is reasonably identifiable.’  Additional protections apply to similar categories of ‘sensitive information’ (listed in section 6(1)), for example, Australian Privacy Principle 3.3 which provides that sensitive information can only be collected if the individual consents and it is reasonably necessary for, or directly relation to, one or more of the organisation’s activities.

Consent

The conditions for consent under the GDPR have been strengthened. Article 4(11) of the GDPR states that consent of the individual means any: ‘freely given, specific, informed and unambiguous indication of the individual’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’.

The request for consent must be clear, concise, transparent and in easily accessible form, with the purpose for data processing attached to that consent.  It must be as easy to withdraw consent as it is to give it.  The UK ICO’s Guide states, ‘Consent means offering individuals real choice and control. Genuine consent should put individuals in charge, build customer trust and engagement, and enhance your reputation’.

Consent requires a positive opt-in.  Silence, pre-ticked boxes or inactivity does not constitute consent (Recital 32).  When the data processing activities has multiple purposes, consent is required to be given for all of the processing purposes (Recital 32).

The Article 29 Data Protection Working Party published a guidance on Consent in January 2018.

In Australia, consent in section 6(1) of the Privacy Act means ‘express or implied consent’.  The four key elements of consent are set out in OAIC’s APP guidelines as:

• the individual is adequately informed before giving consent
• the individual gives consent voluntarily
• the consent is current and specific, and
• the individual has the capacity to understand and communicate their consent.

Notification of Breach

Under the GDPR, notification must be made where a data breach is likely to ‘result in a risk for the rights and freedoms of individuals’. Notification must be made within 72 hours of first having become aware of the breach. Data processors are required to notify their customers and the controllers ‘without undue delay’ after first becoming aware of a data breach.

In Australia notification must be made promptly to affected individuals and the Australian Information Commissioner where an organisation has reasonable grounds to believe a data breach is likely to result in serious harm.  An organisation must take all reasonable steps to complete the assessment within 30 days after it became aware of the grounds that cause it to suspect an eligible data breach – see my article on the Australia’s Notifiable Data Breach Scheme.

Rights of individuals under GDPR

There are rights for individuals under the GDPR which include – the right of transparent communications and information, right to access,  right to rectification, right to erasure/be forgotten, right to restrict processing in certain circumstances, obligation to notify recipients, right to data portability, right to object, and the right to object to automated decision making (to profiling)  in certain circumstances.  Rights exercised and information provided to pursuant to requests must be free of charge.  However, a ‘reasonable fee’ can be charged when a request is manifestly unfounded or excessive.

Right of Access

As part of the expanded rights under the GDPR, is the right for individuals to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, where and for what purpose. The controller must provide a copy of the personal data, free of charge, in an electronic format. This is a significant change empowering individuals and highlights the shift to data transparency under the GDPR.

Right to be Forgotten

The right to be forgotten under the GDPR is set out in Article 17 and entitles individuals to have the data controller erase their personal data, cease further dissemination of the data, and potentially have third parties stop processing of the data in certain circumstances including: the data no longer being relevant to the original purposes for processing; or a data subjects withdrawing consent. There are exceptions to this right, including where data processing necessary for the exercising of the right requires controllers to compare the subjects’ rights to ‘the public interest in the availability of the data’ when considering such requests.

Data Portability

In Article 20 the GDPR introduces the right for individuals to receive the personal data concerning them, which they have previously provided in a ‘commonly used and machine-readable format and have the right to transmit those data to another controller’.

Transfers outside the EU

To ensure that an adequate level of personal data protection is guaranteed, international transfers to third counties outside the EU are only permitted where the conditions laid down in the GDPR are complied with (Article 44).

Transfers may take place to a third country or international organisation where the EU Commission has decided that it ensures ‘an adequate level of protection’ (Article 45(1)).  The adequacy decisions under the current Directive remain in force under the GDPR and those determined by the EU Commission to provide ‘an adequate level of protection’ are: Andorra, Argentina, Canada (commercial organisations), Faeroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland and Uruguay.  Transfers to the US are currently permitted pursuant to the Commission’s July 2016 decision on the adequacy of the protection provided by the EU/US Privacy Shield.

Transfers are also permitted where appropriate safeguards have been provided by the controller or processor and on condition that enforceable individual rights and effective legal remedies for the data subject are available (Article 46).  Appropriate safeguards include:

• Approved binding corporate rules that enable transfers within a multinational group of companies (Article 47).
• Standard data protection contractual clauses approved by the EU Commission.
• Approved code of conduct pursuant to Article 40, and the recipient gives binding and enforceable commitments to apply appropriate safeguards.
• Approved certification mechanism pursuant to Article 42, together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards.

Accountability and Governance

The GDPR sets out expanded accountability and governance requirements including that data controllers must:

• Demonstrate that they comply with all the principles set out in Article 5(1) of the GDPR. These principles relate to the processing of personal data which include: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality. Article 5(2) states that the controller is responsible for and must be able to demonstrate compliance with 5(1).
• Implement appropriate technical and organisational measures to ensure compliance with the GDPR, including implementation of data protection policies (Article 24).
• Implement ‘data protection by design and by default’. The controller is required at the outset to determine the means for processing data, as well as at the time of processing to implement appropriate technical and organisational measures to ensure it complies with the GDPR and protects the rights of individuals. (Article 25).  This includes ensuring that only personal data collected and processed is for the specific purpose of the transaction, personal data is stored no longer than it is required and that access to personal data is restricted.
• Implement appropriate technical and organisational ‘measures to ensure a level of security appropriate to the risk’. This includes as appropriate: de-identification and encryption of personal data; ongoing confidentiality, integrity and availability and resilience of processing systems and services; ability to restore the availability and access to personal data; and a process for regularly testing, assessing and evaluating the effectives of the measures implemented to ensure security.
• Data protection impact assessment for high risk processing(Article 35).  A data protection impact assessment is required before processing personal data for processing which is likely to result in a high risk to the rights and freedoms of individuals.
• Appoint a Data Protection Officer (DPO) (Article 37) if the organisation falls within a category where a DPO is mandated.  This includes: public authorities, organisations carrying out large scale systematic monitoring of individuals (e.g. online behaviour tracking) or organisations carrying out large scale processing of special categories of data or data relating to convictions and offences.   DPO’s are required to have ‘expert knowledge’ of data protection law and practices.  The DPO must ‘directly report to the highest management level’, must not be instructed in the exercise of their tasks and must not be dismissed or penalised for performing their tasks (Article 38(3)).

A cost efficient and effective response to GDPR

In order to comply with GDPR, it will be critical for organisations to know and document the following:

• what information assets exist
• where data are located
• the flow of data within the organisation
• the value of the data and information held
• who has access, and
• how data and information is secured and protected.

More fundamentally from both a risk management perspective and data usage and availability, there are many benefits for an organisation to have:

• an overarching strategic information governance framework; and
• a program of implementing unified information policies, processes and procedures throughout the organisation including privacy and privacy impact assessments, information security, and defensible disposition of records.

Boards and Executives will find that this strategic approach will involve the collaboration of all information stakeholders (such as, privacy, legal, IT cybersecurity, data analytics, records and information management) and will result in the break-down of information silos to maximise the value of information while minimising the risks and ensuring compliance with all legal requirements including the GDPR.

Best practice in privacy and information protection: be strategic and proactive

A strategic, proactive and unified information governance approach will ultimately be the most cost effective and efficient way for organisations to meet the requirements of GDPR as well as other privacy regulatory requirements, such as Australia’s Notifiable Data Breach Scheme.

Best practice should prompt organisations to establish and embed unified information governance of all information held by the organisation in order to maximise the value of information from data (e.g data analytics) as well as minimising the risks and costs, such as those of non-compliance of the GDPR or arising from data breach.  Pursuant to the requirements of the GDPR and Australia Notifiable Data Breach scheme, the importance of embedding privacy by design or ‘data protection by design and by default’ as it is referred to under the GDPR requires organisations to be strategic and proactive in respect of personal information collected and stored by organisations. Given the potential enormous fines under the GDRP for non-compliance as well as all other costs involved in a data breach, from business interruption, legal costs, reputational damage, organisations need to be proactive, prepared and ready to respond to data breaches.

Essential questions for businesses subject to GDPR

Australian businesses that operate in the EU or with customers in the EU should confirm whether they are covered by the GDPR, and if so, take the necessary steps to ensure compliance by May 2018.  The GDPR requires organisations to ensure that they know the way in which they collect, process, store, share and dispose of personal data.

• Awareness & communication – are senior executives and all information stakeholders aware of the GDPR and the impact it will have on your organisation? Has GDPR training of employees occurred and is there an ongoing training program in place?
• Update privacy notices and privacy policies – are privacy policies and privacy notices compliant with the transparency requirements and the rights of individuals under the GDPR?
• Review information held – what personal data is held, where has it come from and with whom it is shared? Carry out an information audit and gap analysis, and implement a remediation plan as needed.  The audit should examine how and when personal information is being disposed of when it is no longer in accordance with the consent provided.
• Transfers outside of EU – is your business compliant with transfer mechanisms? What changes are needed to be compliant with the GDPR and how will you implement the changes to ensure compliance before GDPR comes into force?
• Update internal procedures – do you have policies, processes and procedures in place to deal with the practical implications of the new and extended rights for individuals under the GDPR?   For example, can requests for information be responded to promptly and within one month? In relation to the rights of rectification and erasure, are procedures for ensuring notification is made to other organisations (e.g. suppliers) to whom an individual’s personal data has been disclosed in place?
• Review current systems such as technology and HR systems – are current systems and technology in place to ensure individuals can exercise their rights under the GDPR?
• Review supplier/processors contracts – ensure that supplier contracts are reviewed and if appropriate renegotiated to ensure GDPR compliance.
• Update data breach response plan – do you need to review and update your data breach response plan to ensure mandatory data breach notification to a local data protection regulator within 72 hours of data breach?  Review and update processes and procedures for the detection, investigation, management and reporting of data breaches.
• Privacy-by-design/ Data Protection by design – how can you ensure that any activity that involves processing personal data is done with data protection and privacy in mind from the outset and throughout each step of the process? Depending on the activities of your organisation it may include specific projects, product or service development, system developments such as IT and HR.
• Review insurance and cyber policies – are the terms and coverage of your current policies adequate? If not, add appropriate cyber and data insurance protection as appropriate.
• Develop a unified Information Governance framework – does your privacy ecosystem align with a unified information governance framework to ensure the value of information throughout the organisation is maximised and risks of holding information are minimised?

Privacy regulation: EU and Australian comparison

OAIC’s table compares the requirements under the GDPR with the Australian Privacy Act  – Privacy business resource 21: Australian businesses and the EU General Data Protection Regulation

Susan Bennett LLM(Hons), MBA
Principal of Sibenco Legal & Advisory and co-founder of Information Governance ANZ.

If you would like assistance with your Privacy, Data or Information Governance ecosystem, please contact Susan on +61 2 8226 8682 or email susan.bennett@sibenco.com.

This article is for reference purposes only and does not constitute legal advice.

Further resources:

OAIC’s guidance for Australian businesses on the GDRP –  Privacy business resource 21: Australian businesses and the EU General Data Protection Regulation

EU GDPR – www.eugdpr.org

EU Commission – Article 29 Working Party

EU Commission – Data Transfers outside the EU

UK ICO GDPR Guidance https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/.

UK ICO resources:

• Preparing for the GDPR 12 steps to take now –https://ico.org.uk/media/1624219/preparing-for-the-gdpr-12-steps.pdf
• GDPR checklists – one for data controllers, and another for data processors – https://ico.org.uk/for-organisations/resources-and-support/data-protection-self-assessment/getting-ready-for-the-gdpr/
• Lawful processing – Consent – https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/