e department followed the Office of the Privacy Commissioner’s privacy breach notification guidelines and informed all individuals affected.
Some of the individuals complained to the Privacy Commissioner. The complaint raised issues under principle 5 of the Privacy Act which requires that personal information is protected against unauthorised loss and use, access or disclosure.
The department acted promptly to mitigate the harm to individuals. They took the following steps:
The department managed to contain the disclosure because it took these steps. The file was promptly recovered and had not been widely circulated. The incident had the potential to cause harm but the steps taken meant the affected people suffered no harm.
Although the department breached principle 5, the Privacy Commissioner found there was no interference with privacy because no one would have been harmed.
A memory stick containing the records of 150 employees of an Australian company was found to be missing. The information included the names, salary information, IRD numbers, home addresses, phone numbers, birth dates and, in some cases, health information of current staff. The data on the memory stick was not encrypted.
Due to the sensitivity of the unencrypted information - not only the extent and variety of the information, but also the inclusion of health information - the company decided to notify employees of the breach. Anticipating that individuals may, at some point, complain, it also notified the Australian Office of the Privacy Commissioner of the breach and explained what steps it was taking to resolve the situation.
A senior manager then emailed the affected staff members to notify them of the breach. In the notification she offered an apology, explained what types of information were involved, and advised that the privacy authority had been informed. She also explained what steps had been put in place to prevent this type of a breach occurring in the future. The manager also informed staff that they could make a complaint to the Australian Privacy Commissioner if they were unhappy with the steps the company had taken.
A person contacted an agency because they had received completed application forms that belonged to a number of other people. The person had originally completed an application for a service provider. The service provider had then mailed the form back to the client because not all the fields in the form had been filled in.
However, the employee at the agency who returned the incomplete form inadvertently included the completed forms from 17 other clients in the envelope that was sent out to the person.
In trying to do the right thing, the agency was over eager in attempting to notify the people whose forms had been accidentally sent to the wrong person. In doing so, it made assumptions about who the other people were, only to find out later that none of the people it had notified had been involved in the mix-up.
The agency then had to contact the 17 people whose information had been accidentally disclosed and also apologise to those other people who had first been mistakenly contacted about the breach.
Insights from agencies
“Develop a high degree of personal responsibility with BYOD (bring your own device). Personal phones and tablets are under a user’s control and do not come under organisational control. While managing personal phones is seen as intrusive, guidelines are necessary because many employees use them to access work information.”
“Accept collective responsibility. In many cases, it is often an organisation’s fault and not the individual employee because workers were not made aware of the risks.”
“Use the lessons learned as a teachable moment for workers throughout your agency.”
A man asked a company for access to his personal information. In response, the company sent a list of debtors' details which contained not only personal information about the man, but also about several other people. The employee who sent the information was inexperienced, and did not comply with the company’s usual procedures.
The com