nform the Office of the Privacy Commissioner of material privacy breaches so it is also aware of the breach and can handle any related enquiries or complaints.
Agencies need to consider:
By now, you should have as complete a set of facts as possible and completed your risk assessment in order to determine whether to notify individuals. Notification should occur as soon as reasonably possible. But if law enforcement authorities are involved, check with those authorities on when to notify so that their investigation is not compromised.
How to notify: It is always best to notify affected individuals directly – by phone, letter, email or in person. Direct notification is more sincere and personal. Indirect notification – website information, posted notices, media – should generally only occur where direct notification could cause further harm, is prohibitively costly or the contact information is not known. Using multiple methods of notification may also be appropriate. It is also important to consider whether notification might reveal the value of the missing information. For particularly vulnerable people, you might need to consider notifying them through or with a support person.
Who should notify: The agency that has a direct relationship with the customer, client or employee should be the party to notify the affected people. For example, if a credit card information breach comes from a retailer, the credit card issuer would be the best agency to inform the customer. But on the other hand, if a courier company leaves a parcel on a doorstep and it is stolen, the organisation or agency that sent the parcel should be the one that lets the affected person know.
What to say: Breach notifications should generally contain:
Notifying third parties: Agencies should also consider whether the following groups or organisations should also be informed. Bear in mind any obligations of confidentiality.
One agency that should be notified of any serious breaches is the Office of the Privacy Commissioner. This will help the Privacy Commissioner respond to inquiries made by the public and to any complaints that might be received. The Privacy Commissioner may also be able to provide advice or guidance to your agency that may be helpful in responding to the breach. Notification helps to show that your agency is being responsible and taking the matter seriously.
An important rule of thumb in dealing with journalists is to respond as quickly as possible to their requests for information. It shows that you are treating an incident seriously and that you are not hiding from news coverage.
Remember that how you deal with the story (or fail to deal with it) could become as important as the incident itself.
Here are some other tips that can help minimise damage to your agency’s reputation while also demonstrating that you are seeking to maintain the public’s trust:
Don’t assume that there’s nothing that can be fixed or done to prevent future mistakes. There’s a system failure behind many errors and now is a good opportunity to learn from the mistake. There are a number of steps agencies can take to minimise or prevent data breaches. The most effective is having a well thought-out security plan for all personal information. A strong security standard to use is the International Standards Organisation Information Security Management Standard (AS/NZS ISO/IEC 27001:2006).
In the aftermath of a breach, agencies should review policies to minimise the collection and retention of personal information. Agencies need to take the time to investigate the cause of the breach and make changes to their prevention plan (especially when it clearly didn’t work) and how it is being applied.
The amount of effort should reflect the significance of the breach, and whether it happened as a result of a systemic problem or an isolated event. It could include:
The resulting prevention plan may include a requirement for an audit to ensure that the plan has been fully embedded into the organisation.
1. Preventing the theft or loss of computers, mobile devices and documents
2.