 Preventing employees deliberately or accidentally disclosing information
3. Preventing employee browsing
4. Storing personal information safely and securely
5. Disposing or re-using information and documents safely
6. Lessening the chances of emails and faxes going to wrong destinations
7. When personal information is published on websites or elsewhere
8. Keeping software up-to-date and using strong password security
- Pay particular attention to the physical security of mobile and portable devices. These include USB sticks and portable hard drives as well as smart phones and laptops.
- What is in your agency’s policy about what kind of information can be stored on a portable device?
- Use extra security measures for portable devices such as encryption, password locks, remote wipe ability and physical security.
- Make sure your security policies cover mobile devices as well as workstations or laptops.
- Make sure there is also proper physical security for electronic data and paper documents.
- Lock up workstations and laptops.
- Lock your work space, files and equipment when leaving the office, studio or home.
- Don't leave papers, computers or other electronic devices visible in homes or parked cars.
- Don’t leave sensitive information lying around, including on printers, fax machines, photocopiers, or in storage. This includes old hard drives as well as paper files.
- If work information can be accessed through a device, that device should be password protected. Consider implementing and running a mobile device management suite.
- Delete personal information and other data when it is no longer needed.
- Report thefts to Police and let them know if the stolen equipment contains sensitive information.
- Have a comprehensive workplace security policy for BYOD (bring your own device).
Back to top
A staff member from a government department dropped a paper file in a city street. The file contained a list with sensitive personal information about a large number of individuals. It was then passed to media outlets.
The department followed the Office of the Privacy Commissioner’s privacy breach notification guidelines and informed all individuals affected.
Some of the individuals complained to the Privacy Commissioner. The complaint raised issues under principle 5 of the Privacy Act which requires that personal information is protected against unauthorised loss and use, access or disclosure.
The department acted promptly to mitigate the harm to individuals. They took the following steps:
The department managed to contain the disclosure because it took these steps. The file was promptly recovered and had not been widely circulated. The incident had the potential to cause harm but the steps taken meant the affected people suffered no harm.
Although the department breached principle 5, the Privacy Commissioner found there was no interference with privacy because no one would have been harmed.
A memory stick containing the records of 150 employees of an Australian company was found to be missing. The information included the names, salary information, IRD numbers, home addresses, phone numbers, birth dates and, in some cases, health information of current staff. The data on the memory stick was not encrypted.
Due to the sensitivity of the unencrypted information - not only the extent and variety of the information, but also the inclusion of health information - the company decided to notify employees of the breach. Anticipating that individuals may, at some point, complain, it also notified the Australian Office of the Privacy Commissioner of the breach and explained what steps it was taking to resolve the situation.
A senior manager then emailed the affected staff members to notify them of the breach. In the notification she offered an apology, explained what types of information were involved, and advised that the privacy authority had been informed. She also explained what steps had been put in place to prevent this type of a breach occurring in the future. The manager also informed staff that they could make a complaint to the