How the privacy reforms will affect boards

An update of the 35-year-old Privacy Act will make boards more accountable for how they handle information from individuals. 

Privacy has been a sleeper issue for many organisations and their boards, left to management to worry about or tucked away somewhere in the cybersecurity strategy. This will change with the proposed changes to the Privacy Act 1988, which will give individuals more control over how organisations use their data (and will make those organisations and their boards more accountable for how they handle individuals’ information).

“This is a quantum shift — a big shift in Australian privacy,” says Alec Christie, a partner in privacy, cyber and digital at law firm Clyde & Co. “It’s going to be more prescriptive, it’s going to be enforced more, it’s going to be more detailed.”

The change will be bigger for some organisations than others, because it fills out the detail and puts into practice what many should already be doing. Companies that are compliant already will still find the changes significant, but much easier to implement than those that aren’t.

“For a company not complying with privacy requirements now, this will be like the GST coming,” says Christie. “This will be an amazing change for them.”

The looming privacy reforms stem from last year’s Privacy Act review, which considered whether the Act and its enforcement are fit for purpose in an environment where Australians now live much of their lives online and their information is collected and used for a myriad of purposes in the digital economy.

In late September, the government announced that it would accept many of the report’s recommendations and legislate accordingly, although observers say the reforms will take a number of years to be legislated and the changes might be introduced in stages.

Christie says a key driver of the reforms is to bring Australia more into line with the European Union’s General Data Protection Regulation (GDPR) regime and so potentially ease the path for Australian businesses to share information with entities in Europe. Currently, Australian businesses have to jump multiple hurdles to share even small amounts of data. Should the EU recognise the equivalence of Australia’s data protection regime it will make data sharing much simpler for companies with branch offices in Europe, which have data processed in Europe or are planning M&A deals, for example.

The majority of boards currently leave privacy to management — and they will need to play a greater role in oversight of the organisation’s privacy and cybersecurity risk management and compliance. “The privacy compliance of an organisation is part of a director meeting their duty for due care and skill,” says Christie, noting that boards should be assessing where their company is now with privacy and cybersecurity.

“The board needs to ensure their organisation is meeting [current requirements] or has a program of work to uplift in order to meet the current requirements,” he says. “That is a fundamental step in starting to be ready for the changes.”

Directors should also ask when the company last had an independent review of its privacy and cybersecurity settings — hopefully within the past two years — and whether the company has acted on areas of concern that might have been raised.

Christie points out a director must exercise due care diligence on privacy, but that it shouldn’t stop a company from carrying out its business. “There’s got to be a pragmatic lens on whatever we do in a privacy sense, as well.”

Larissa Cook GAICD, a principal at Baker Cook Advisory — and a non-executive director at Central and Eastern Sydney Private Health Network, St John Ambulance (NSW) and Hunter Health Insurance — says the privacy reforms will make boards and management realise that privacy isn’t just “set and forget”. Instead of using off-the-shelf privacy policies, companies will need to come up with a bespoke privacy model that reflects what the business actually does. “The whole process now has to be more bespoke,” she says. “You have to have a privacy policy that specifically deals with what it is you do as a company, what information you collect, for what purpose, how you’re going to store it, what you’re going to do with it, who you’re going to disclose it to.”

Cook suggests companies carry out an audit of the data they hold. “Data destruction policies go hand in hand with data protection policies.” 

Personal data in the firing line

Privacy hit the headlines in September last year when telco Optus suffered a data breach that affected up to 9.7 million current and former customers, whose names, birthdates, home addresses, phone numbers, email addresses, passport and driving licence numbers were stolen.

A month later, health insurer Medibank Private was also breached. Along with similar information that was stolen in the Optus attack, the hackers took medical claims data, including information about diagnosis, procedures and location of medical services.

Both organisations are the subject of ongoing class actions. Optus apologised to customers, identified lessons learned and commissioned an independent external review, led by Deloitte. Medibank established a cyber response support program for current and former customers.

The most recent Deloitte Privacy Index reveals the reputation risk that organisations face if they do not have adequate data handling and protection policies. Australians who have suffered a breach tend to be more disappointed with the organisation than with the actual cybercriminals. And 80 per cent believe organisations should be liable for compensating data-breach victims.

The expanded definition of personal information from information “about a person” to information “that relates” to a person will include a much wider sweep of data, such as analytic insights a company has derived from data it holds.

Kate Monckton, a risk advisory partner at Deloitte, says personal information can include technical data such as IP addresses, which can reveal a location, and even someone’s email address. For instance, bill.smith@acme.com.au reveals Bill Smith’s name, the fact that he works for Acme and lives in Australia. Companies need to consider whether the expanded definition means they will have to start treating previously excluded data sets as personal information and bring them into their privacy programs.

Some organisations advised by Deloitte are proactively taking a “we can, but should we?” approach to their use of data and establishing ethical frameworks for data handling. Monckton advises companies to put aside budget to implement the looming changes. Additionally, if they are planning a big tech investment that will run for several years, they need to ensure it is future-proofed to comply with the new regime.

“The smart organisations are getting ahead now. It might not be huge investments of time or money right now, but it’s enough to know this is coming,” she says. “You can’t wait until that happens in some of the organisations that have long funding cycles.”