four key steps in dealing with a data breach:
2. Evaluate the risks
3. Notify affected people if necessary
4. Prevent a repeat
Move quickly to investigate the suspected breach and its potential for harm. Consider the potential for harm to the individuals to whom the data relates, harm to the public’s trust in your organisation and harm to its reputation.
Steps 1, 2 and 3 should be undertaken either simultaneously or in quick succession. Step 4 provides recommendations for longer-term solutions and prevention strategies. The decision on how to respond should be made on a case-by-case basis.
Once you have discovered that a data breach has occurred, you should quickly take common sense steps to stop the damage becoming worse:
To determine what other steps are needed, you need to assess the risks caused by the breach. An evaluation of the type of information involved will help you determine how to respond to the breach, who should be informed (including the Office of the Privacy Commissioner) and also whether it is appropriate to tell the individuals affected.
Here are some factors to consider:
Being open and transparent with individuals about how personal information is being handled is a fundamental rule of privacy. Notification can be a key step to help individuals affected by the breach and show the agency is doing the right thing. If a data breach creates a risk of harm to the individual, those affected should usually be notified. Prompt notification can help them lessen the damage by taking steps to protect themselves and regain control of that information.
But do not notify people unless you are sure of the people whose information has been compromised by the breach. More damage can be done if the wrong people are notified in error.
When to notify: It is not always necessary to notify breaches although if there is no risk of harm, notification can be overkill and on occasion, notification can do more harm than good. Each incident needs to be considered on a case-by-case basis. Agencies are also encouraged to inform the Office of the Privacy Commissioner of material privacy breaches so it is also aware of the breach and can handle any related enquiries or complaints.
Agencies need to consider:
By now, you should have as complete a set of facts as possible and completed your risk assessment in order to determine whether to notify individuals. Notification should occur as soon as reasonably possible. But if law enforcement authorities are involved, check with those authorities on when to notify so that their investigation is not compromised.
How to notify: It is always best to notify affected individuals directly – by phone, letter, email or in person. Direct notification is more sincere and personal. Indirect notification – website information, posted notices, media – should generally only occur where direct notification could cause further harm, is prohibitively costly or the contact information is not known. Using multiple methods of notification may also be appropriate. It is also important to consider whether notification might reveal the value of the missing information. For particularly vulnerable people, you might need to consider notifying them through or with a support person.
Who should notify: The agency that has a direct relationship with the customer, client or employee should be the party to notify the affected people. For example, if a credit card information breach comes from a retailer, the credit card issuer would be the best agency to inform the customer. But on the other hand, if a courier company leaves a parcel on a doorstep and it is stolen, the organisation or agency that sent the parcel should be the one that lets the affected person know.
What to say: Breach notifications should generally contain:
Notifying third parties: Agencies should also consider whether the following groups or organisations should also be informed. Bear in mind any obligations of confidentiality.
One agency that should be notified of any serious breaches is the Office of the Privacy Commissioner. This will help the Privac