Another country appears to be on the verge of passing a privacy breach notice law…
“Australian Privacy Commissioner calls for mandatory reporting of major data security breaches”
Whew, the paper submitted by the Australian Privacy Commissioner, Karen Curtis, is 786 pages long, and contains MANY recommendations, as you’d expect to find in such a tome.
According to the news report, some of the recommendations include:
” * Maintaining a principles-based and technology neutral approach – to provide flexibility and responsiveness to change.
* Creating codes where specific privacy concerns emerge – to apply in addition to the uniform principles.
* Minimising exemptions from the Privacy Act.
* Health sector – the Privacy Act should “cover the field” for the regulation of private sector health service providers.
* Credit reporting – further independent research on comprehensive (or “positive”) credit reporting is required before it is clear whether its introduction will be beneficial.
* Audits – a qualified audit power would allow the Office to conduct privacy performance assessments of private sector organisations for compliance in certain circumstances.”
It will be interesting to read the Commissioner’s epic.
Tags: Australia, awareness and training, breach notice law, Information Security, IT compliance, Karen Curtis, policies and procedures, privacy, privacy law, privacy policy, risk management, security awareness, security training