Nick Abrahams is the Global Head of Technology & Innovation for international law firm, Norton Rose Fulbright. In addition to his tech & privacy law practice, co-created Parker, the world’s first AI-powered privacy chatbot. He is a disruptor in his own right, having co-founded successful online legal service LawPath. He is on the boards of: ASX300 software company, Integrated Research; global genomic medicine leader, the Garvan Foundation; the Sydney Film Festival; and the Vodafone Foundation. He is the author of the Kindle best-selling book Digital Disruption in Australia and produced the mockumentary Searching for Alison Porchnik featuring Woody Allen and Carol Kane. Nick is a Futurist, Speaker & Facilitator. Please see www.nickabrahams.com for more information.Jim Lennon is a commercial lawyer with over 25 years’ experience in privacy, information technology and intellectual property (IT/IP). His main expertise is in privacy, data breaches and cyber security, spam, cloud services and IT procurement. He also regularly advises on cross-border data protection and data breach issues.Jim has been a volunteer advisor for the Arts Law Centre of Australia since 1993. He is also the Specialist Editor for the chapters on Information Technology, E-commerce and Intellectual Property in the Australian Encyclopedia of Forms and Precedents published by LexisNexis.
Description
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1Part 1: Privacy Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5At a glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6Background and overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6Key privacy compliance requirements . . . . . . . . . . . . . . . . . . . . . . . 10Other important provisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17Part 2: Data Breach Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . 21At a glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22Data breaches in Australia . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23The mandatory data breach notification scheme . . . . . . . . . . . . . . 26Eligible data breaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28Mandatory notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32Practical implications and next steps . . . . . . . . . . . . . . . . . . . . . . . . 39Incidents that might require notification . . . . . . . . . . . . . . . . . . . . . 45Other reporting considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61Ransomware and strategies for responding . . . . . . . . . . . . . . . . . . 72Part 3: GDPR & Privacy Act Gap Analysis 79Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79Background to the GDPR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79Comparison with the Privacy Act . . . . . . . . . . . . . . . . . . . . . . . . . . . 80How to use this document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82Appendices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114Appendix 1 – Complying with the Australian Privacy Principles . 114Appendix 2 – APP Compliance Checklist . . . . . . . . . . . . . . . . . . . . 137Appendix 3 – Privacy Policy Compliance Checklist . . . . . . . . . . . . 147Appendix 4 – The Australian Privacy Principles – full text . . . . . . 151INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185Legislation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190