Hacked companies off the hook under new Australian privacy laws
The Office of the Australian Information Commission (OAIC) has confirmed it won’t hold organisations accountable for the exposure of personal information when accessed via a cyber attack, as long as the Office is satisfied with the level of security in place within the targeted systems.
New privacy rules strengthening the enforcement power of the OAIC come into effect in 12 March 2014.
In final guidelines to the way these laws are likely to be enforced, the OAIC made a distinction between what it will treat as a ‘disclosure’ of personal information – which could incur penalties of up to $1.7 million under the new regime – and ‘unauthorised access’. “An APP entity is not taken to have disclosed personal information where a third party intentionally exploits the entity’s security measures and gains unauthorised access to the information," the guidance noted.
