y Commissioner respond to inquiries made by the public and to any complaints that might be received. The Privacy Commissioner may also be able to provide advice or guidance to your agency that may be helpful in responding to the breach. Notification helps to show that your agency is being responsible and taking the matter seriously.
An important rule of thumb in dealing with journalists is to respond as quickly as possible to their requests for information. It shows that you are treating an incident seriously and that you are not hiding from news coverage.
Remember that how you deal with the story (or fail to deal with it) could become as important as the incident itself.
Here are some other tips that can help minimise damage to your agency’s reputation while also demonstrating that you are seeking to maintain the public’s trust:
Don’t assume that there’s nothing that can be fixed or done to prevent future mistakes. There’s a system failure behind many errors and now is a good opportunity to learn from the mistake. There are a number of steps agencies can take to minimise or prevent data breaches. The most effective is having a well thought-out security plan for all personal information. A strong security standard to use is the International Standards Organisation Information Security Management Standard (AS/NZS ISO/IEC 27001:2006).
In the aftermath of a breach, agencies should review policies to minimise the collection and retention of personal information. Agencies need to take the time to investigate the cause of the breach and make changes to their prevention plan (especially when it clearly didn’t work) and how it is being applied.
The amount of effort should reflect the significance of the breach, and whether it happened as a result of a systemic problem or an isolated event. It could include:
The resulting prevention plan may include a requirement for an audit to ensure that the plan has been fully embedded into the organisation.
1. Preventing the theft or loss of computers, mobile devices and documents
2. Preventing employees deliberately or accidentally disclosing information
3. Preventing employee browsing
4. Storing personal information safely and securely
5. Disposing or re-using information and documents safely
6. Lessening the chances of emails and faxes going to wrong destinations
7. When personal information is published on websites or elsewhere
8. Keeping software up-to-date and using strong password security
- Pay particular attention to the physical security of mobile and portable devices. These include USB sticks and portable hard drives as well as smart phones and laptops.
- What is in your agency’s policy about what kind of information can be stored on a portable device?
- Use extra security measures for portable devices such as encryption, password locks, remote wipe ability and physical security.
- Make sure your security policies cover mobile devices as well as workstations or laptops.
- Make sure there is also proper physical security for electronic data and paper documents.
- Lock up workstations and laptops.
- Lock your work space, files and equipment when leaving the office, studio or home.
- Don't leave papers, computers or other electronic devices visible in homes or parked cars.
- Don’t leave sensitive information lying around, including on printers, fax machines, photocopiers, or in storage. This includes old hard drives as well as paper files.
- If work information can be accessed through a device, that device should be password protected. Consider implementing and running a mobile device management suite.
- Delete personal information and other data when it is no longer needed.
- Report thefts to Police and let them know if the stolen equipment contains sensitive information.
- Have a comprehensive workplace security policy for BYOD (bring your own device).
Back to top
A staff member from a government department dropped a paper file in a city street. The file contained a list with sensitive personal information about a large number of individuals. It was then passed to media outlets.
Th