The introduction of data breach notification legislation in Australia : a comparative view

Daly, Angela (2018) The introduction of data breach notification legislation in Australia : a comparative view. Computer Law and Security Review, 34 (3). pp. 477-495. ISSN 0267-3649 (https://doi.org/10.1016/j.clsr.2018.01.005)

[thumbnail of Daly-CLSR-2018-The-introduction-of-data-breach-notification-legislation-in-australia]
Preview
 Text. Filename: Daly_CLSR_2018_The_introduction_of_data_breach_notification_legislation_in_australia.pdf
Accepted Author Manuscript
License: Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 logo
Download (481kB)| Preview

Abstract

This article argues that Australia's recently-passed data breach notification legislation, the Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth), and its coming into force in 2018, makes an internationally important, yet imperfect, contribution to data breach notification law. Against the backdrop of data breach legislation in the United States and European Union, a comparative analysis is undertaken between these jurisdictions and the Australian scheme to elucidate this argument. Firstly, some context to data breach notification provisions is offered, which are designed to address some of the problems data breaches cause for data privacy and information security. There have been various prominent data breaches affecting Australians over the last few years, which have led to discussion of what can be done to deal with their negative effects. The international context of data breach notification legislation will be discussed, with a focus on the United States and European Union jurisdictions, which have already adopted similar laws. The background to the adoption of the Australia legislation will be examined, including the general context of data privacy and security protection in Australia. The reform itself will be then be considered, along with the extent to which this law is fit for purpose and some outstanding concerns about its application. While data breach notification requirements are likely to be a positive step for data security, further reform is probably necessary to ensure strong cybersecurity. However, such reform should be cognisant of the international trends towards the adoption of data security measures including data breach notification, but lack of alignment in standards, which may be burdensome for entities operating in the transnational data economy.

ORCID iDs

Daly, Angela ORCID logoORCID: https://orcid.org/0000-0002-7529-4213;
CORE (COnnecting REpositories)