Data breaches happen often. Agencies can lose or leak personal information through complacency, inadequate security, poor procedures or rare accidents. The ease of digital copying and transmission means the data breaches can range from the loss of one person’s information to hundreds of thousands of records. The cause of a breach can be accidental or through the deliberate actions of others. It is vital to any organisation’s reputation and its relationship with the people who trust it with their information that it does everything it can to prevent a data breach from happening. But when a data breach occurs, it is important to do everything it can to minimise the harm that it might cause.
This guidance provides tips to help organisations prevent common mistakes that lead to data breaches, and advice on what to do when a breach happens.
A data breach is when there is unauthorised or accidental access to or disclosure of personal information.
Data breaches happen in a number of ways. Some common examples include:
- lost or stolen laptops, removable storage devices, or paper records containing personal information
- computer hard disk drives being thrown away, recycled or returned to leasing companies, or serviced incorrectly, without the contents first being erased
- databases of personal information being hacked or illegally accessed by others outside the agency or organisation
- employees accessing or disclosing personal information outside their authorisation
- paper documents taken from recycling or rubbish bins
- personal information being given to the wrong person by sending information to the wrong physical or email address
- releasing personal information to a person who is fraudulently pretending to be someone else.
Data breach notification is the practice of notifying affected individuals and the Privacy Commissioner when their personal information has become available to unauthorised individuals or organisations. This enables those affected to take steps to prevent the misuse of their details.
These are four key steps in dealing with a data breach:
2. Evaluate the risks
3. Notify affected people if necessary
4. Prevent a repeat
Move quickly to investigate the suspected breach and its potential for harm. Consider the potential for harm to the individuals to whom the data relates, harm to the public’s trust in your organisation and harm to its reputation.
Steps 1, 2 and 3 should be undertaken either simultaneously or in quick succession. Step 4 provides recommendations for longer-term solutions and prevention strategies. The decision on how to respond should be made on a case-by-case basis.
Once you have discovered that a data breach has occurred, you should quickly take common sense steps to stop the damage becoming worse:
To determine what other steps are needed, you need to assess the risks caused by the breach. An evaluation of the type of information involved will help you determine how to respond to the breach, who should be informed (including the Office of the Privacy Commissioner) and also whether it is appropriate to tell the individuals affected.
Here are some factors to consider:
Being open and transparent with individuals about how personal information is being handled is a fundamental rule of privacy. Notification can be a key step to help individuals affected by the breach and show the agency is doing the right thing. If a data breach creates a risk of harm to the individual, those affected should usually be notified. Prompt notification can help them lessen the damage by taking steps to protect themselves and regain control of that information.
But do not notify people unless you are sure of the people whose information has been compromised by the breach. More damage can be done if the wrong people are notified in error.
When to notify: It is not always necessary to notify breaches although if there is no risk of harm, notification can be overkill and on occasion, notification can do more harm than good. Each incident needs to be considered on a case-by-case basis. Agencies are also encouraged to i