Guidelines on the assessment of data breaches under Part 6A of the PPIP Act

Read the document below or download it here: Guideline - Guidelines on the assessment of data breaches under Part 6A of the PPIP Act September 2023

3.1 Assessment process

3.1.1 Assessment trigger

The obligation to assess a suspected data breach is triggered ‘if an officer or employee of an agency is aware that there are reasonable grounds to suspect there may have been an eligible data breach’.^[6] On becoming aware, the officer must report the data breach to the head of the agency (or to any person to whom the head of the agency has delegated functions).^[7]

Following receipt of this report, the head of the agency must:

• immediately take all reasonable efforts to contain the data breach, and 
• carry out an assessment to determine whether the data breach is an eligible data breach, or there are reasonable grounds to believe the data breach is an eligible data breach.

Where a breach is found to be an eligible breach, notification obligations to the Privacy Commissioner and affected individuals are triggered.

3.1.2 Assessment timeframe

To reduce the risk of harm to affected individuals, an agency should undertake its assessment of a suspected data breach as quickly and efficiently as possible. Section 59E provides that an agency must undertake an assessment of a suspected data breach within 30 days. To meet this timeframe the person undertaking the assessment must take all reasonable steps to ensure it is completed within 30 days.^[8]

The assessment timeframe commences when the officer or employee becomes aware that there are reasonable grounds to suspect an eligible data breach has occurred. The officer or employee becoming aware of a potential breach is the trigger for the time period to commence rather than when the breach is reported to, or received by, the head of the agency or their delegate.

The 30-day assessment period refers to calendar days, not business (working) days.

As there is an additional requirement for agencies to carry out the assessment in an expeditious way^[9], agencies should treat the 30 days as the maximum timeframe and where possible aim to complete the assessment in a shorter timeframe.

3.1.3 Extensions of time

Where the head of the agency is satisfied that an assessment cannot reasonably be carried out within 30 days, they may approve an extension of time to conduct the assessment.^[10]

Where an extension is applied, the head of the agency must provide written notice to the Privacy Commissioner advising:

• when the assessment commenced, and
• that the head of the agency has approved an extension of time to carry out the assessment.

As a matter of best practice, the notice provided to the Privacy Commissioner should also include advice on the reason for the delay in undertaking the assessment.

If the assessment is not completed within the extended time period, the head of the agency must provide further written notice to the Privacy Commissioner:

• advising that the assessment is ongoing,
• that a new extension of time has been granted, and
• specifying the new extension period.

As with an initial extension notification, the notice provided to the Privacy Commissioner should also include advice on the reason for the delay in undertaking the assessment.

An extension of time may only be approved for an amount of time reasonably required for the assessment to be conducted.^[11] When considering whether to grant an extension and when forming a view about the period of the extension, the head of the agency should consider whether the circumstances justify the delay.

On receiving such notification, the Privacy Commissioner may seek further information from the head of the agency regarding the progress of the assessment.

Early notification of breaches to affected individuals can be key to minimising the risks of serious harm resulting from a data breach. Agencies should avoid undue delay and should work to make affected individuals aware of the breach as soon as possible. For complex breaches or where significant numbers of individuals are affected, the agency may need to consider applying a triage system to notification. This might involve making notification in tranches based on the level of risk posed to the individual or the sensitivity of the information involved in the data breach.

3.1.4 Who should conduct an assessment?

The head of the agency may direct one or more persons to carry out the assessment (the ‘assessor’). Section 59G provides that an assessor may be:

1. An officer or employee of the agency subject to the breach.
2. An officer or employee of another agency acting on behalf of the agency subject to the breach. For example, this may include NSW agency employees under secondment or the Chief Information Officer of another agency assigned to assist based on their previous experience in assessing data breaches.
3. An external party who has been engaged, whether through employment or contract, by the agency to conduct the assessment on the agency’s behalf, including the external party’s employees.

Note, if the head of the agency has reason to suspect an individual was involved in an act or omission that led to the data breach, that person is not permitted to take on the role of the assessor.^[12]

3.1.5 How to conduct an assessment

There is no specific procedure by which an agency must conduct an assessment. In general, an assessment will involve the following:

1. Information gathering: collect all relevant information regarding the suspected breach. This may involve contacting relevant stakeholders, identifying what information was or may have been compromised, and investigating logs or other evidence from compromised systems that may be relevant to the assessment of the suspected breach.
2. Analysis: review the information collected during the previous phase to evaluate the scale, scope, and content of the suspected data breach, and its potential impact on affected individuals. The analysis should include a careful consideration of the type of information involved in the breach, the actual or potential harms that may arise for affected individuals, the seriousness of the harm and the likelihood of that harm occurring.
3. Decision: come to a conclusion as to the eligibility of the suspected data breach based on the factors considered throughout the analysis.

3.1.6 Assessing breaches due to cyberattacks

When assessing data breaches involving cyberattacks, agencies may face challenges in establishing whether unauthorised access, unauthorised disclosure or loss has occurred. In these circumstances, the agency is often reliant on digital forensic evidence to confirm whether a breach has resulted in access to, or exfiltration of, personal information.

Agencies that do not have audit or activity logging enabled on their network or email servers/accounts, or that are unable to undertake retrospective traffic analysis of their internet gateway, will generally have difficulty determining whether a malicious actor who gained access to their network was able to access or exfiltrate personal information.

In these circumstances, it is recommended that agencies should adopt a conservative approach and conduct the assessment on the assumption that unauthorised access and/or exfiltration has occurred. The absence of digital evidence of access/loss does not in itself justify a conclusion that access/loss did not occur, particularly in circumstances where the agency has limited access auditing capabilities.

When assessing a data breach that results in personal information being posted to a website, agencies should ensure that the assessment considers the totality of personal information stored in the compromised server or network environment, and not just the personal information that has been posted on the web. Agencies should not assume that a malicious actor will publish all stolen personal information immediately or in one place. As recent data breaches in Australia and overseas have demonstrated, malicious actors will often publish part of the personal information stolen in an effort to coerce an agency to pay a ransom to prevent disclosure of the remaining information.

3.1.7 Concurrent obligations to contain and mitigate

During an assessment, the agency must make all reasonable attempts to contain the breach and mitigate any harm arising as a result of the breach.^[13]

‘Containing’ a data breach means limiting its extent or duration or preventing it from intensifying. This could be done by stopping an unauthorised practice, recovering or limiting the dissemination of records disclosed without authorisation, or shutting down a compromised system. Containment actions can be distinguished from mitigation actions, which involve managing or remediating harms arising as a result of the breach.

Guidance on containment and mitigation measures is contained in the Guide to managing data breaches under the PPIP Act.

3.1.8 Requirements to notify

When the head of an agency decides that an eligible data breach has occurred, the notification process under Division 3 of the MNDB Scheme is triggered.

There are four elements of the notification process, which are explained further in the MNDB Scheme Guidance:

1. Notify the Privacy Commissioner: Once an agency determines an eligible data breach has occurred, the head of the agency must immediately notify the Privacy Commissioner about the breach in the approved form.^[14]
2. Determine whether an exemption applies: If one of the six exemptions set out in Division 4 of the MNDB Scheme applies in relation to an eligible data breach, an agency may not be required to notify affected individuals.^[15] Although Part 6A does not impose a timeframe for the head of the agency to make this assessment, the IPC expects that in most instances this assessment should occur as part of or immediately following the assessment of the data breach.
3. Notify individuals: Unless an exemption applies, agencies are required to notify affected individuals as soon as reasonably practicable. Notification should be made directly to the individual concerned, their parent or guardian (in the case of children) or an authorised representative. Where the agency is unable to notify directly or it is not reasonably practicable to do so, a public notification must be made.
4. Provide further information to the Privacy Commissioner (as required): Agencies may be required to provide additional information to the Privacy Commissioner, if they have been unable to provide complete information in their initial notification, if they have made a public notification, or if they are relying on an exemption.

3.2 What is serious harm?

The term ‘serious harm’ is not defined in the PPIP Act. Harms that can arise as the result of a data breach are context-specific and will vary based on:

• the type of personal information accessed, disclosed or lost, and whether a combination of types of personal information might lead to increased risk, 
• the level of sensitivity of the personal information accessed, disclosed or lost, 
• the amount of time the information was exposed or accessible, including the amount of time information was exposed prior to the agency discovering the breach,
• the circumstances of the individuals affected and their vulnerability or susceptibility to harm (that is, if any individuals are at heightened risk of harm or have decreased capacity to protect themselves from harm), 
• the circumstances in which the breach occurred, and 
• actions taken by the agency to reduce the risk of harm following the breach.

Serious harm occurs where the harm arising from the eligible data breach has, or may, result in a real and substantial detrimental effect to the individual. That is, the effect on the individual must be more than mere irritation, annoyance or inconvenience.

Harm to an individual includes physical harm; economic, financial or material harm; emotional or psychological harm; reputational harm; and other forms of serious harm that a reasonable person in the agency’s position would identify as a possible outcome of the data breach.

While mere irritation or annoyance does not in itself amount to serious harm, emotional or psychological impacts of a data breach can amount to serious harm if they are severe.

See section 3.4.6 below for further discussion of the kinds of harms that may arise as a result of a data breach.

3.3 When is a breach ‘likely to result’ in serious harm?

Whether a data breach is ‘likely to result’ in serious harm is an objective test to be determined from the perspective of a reasonable person and on the facts of the specific breach in question. In this context, the phrase ‘likely to result’ means that the risk of serious harm to an individual is more probable than not, rather than merely possible.

Serious harm does not need to be likely for all individuals to whom the breached information relates. A data breach will be an eligible data breach if serious harm is more likely than not for a single individual or a subset of individuals involved in a breach.

An agency may determine that serious harm is likely to result for some individuals without being able to identify which specific individuals those are. This means that data breaches affecting very large numbers of individuals may be considered an eligible data breach even when the information exposed is not highly sensitive.

Although quantitative analysis has a role in assessment of likelihood, in most cases the exercise should be primarily a qualitative one. That is, agencies should avoid relying too heavily on mathematical calculations to determine the likelihood of serious harm. Instead, agencies should consider the factors which affect the risk and err on the side of notification when there is doubt as to whether a data breach is ‘likely to result’ in serious harm.

The following example is provided as an illustration of circumstances in which quantitative assessment may assist an agency in determining whether serious harm is likely. An agency might consider that across their customer base, on average, one in every ten thousand customers would be likely to experience serious harm if their home address were exposed in a data breach. This could be as a result of having a high-profile public position, having a sensitive job in corrections or law enforcement, being a survivor of family violence, or for some other reason. If a data breach occurred at that agency which exposed one million records including home addresses, the agency could conclude that approximately 100 people are likely to experience serious harm as a result, even if the agency did not have sufficient information to determine which 100 people those were.

3.4 Factors relevant to an assessment

The factors that may be relevant in assessing the likelihood and severity of harm are contextual to the specific type and form of the data breach. Section 59H provides a non-exhaustive list of factors an assessor may consider when determining the risk of serious harm resulting from a breach.

The Privacy Commissioner has identified the following additional factors to which agencies should also have regard when determining the risk of serious harm (as per s59H(a)(g)):

• The extent to which affected individuals may be particularly vulnerable to harm,
• The ease with which information can be accessed and individuals identified.

Each of these factors is explored further in this section.

Examples are provided in the sections below to demonstrate how these factors may operate. These examples are not exhaustive and should be considered as illustrative only. Whether there is a risk of serious harm arising from a data breach must be assessed based on the facts and context of each individual breach.

3.4.1 The type(s) of personal information involved in the data breach

Assessors should consider the type of personal information compromised through the data breach.^[16] 

Some types of personal information carry more inherent risk than other types. Financial information and health information are two categories that generally carry a greater risk of serious harm. For example, the disclosure of contact details (such as a phone number or email address) on their own is unlikely to result in serious harm for most people, while disclosure of financial information, such as credit card or bank account numbers, is more likely to lead to harm in the form of fraud or financial crime. 

Additionally, some combinations of personal information carry more risk than others. For example, disclosure of contact details for individuals combined with information that those individuals have recently sought support for problem gambling may expose those individuals to a greater risk of embarrassment or of being targeted by a scam.

Combinations of multiple types of personal information in a record or data breach affected data set also create an additional risk of identity takeover or impersonation fraud for individuals. For example, a combination of name, address, telephone number and date of birth could be used in impersonation fraud to bypass the know-your-customer controls of a bank or government agency and gain access to the customer record for a breach-affected individual.

In considering the harms that certain types of information might pose, agencies should consider the potential for personal information to be combined with other publicly available or observable personal information.

Data breaches involving the full or partial details of government-issued identity documents or credentials, such as driver licences, Medicare cards or passports, create significant additional risks for individuals. The details of these identity documents are often collected by agencies as part of their know-your-customer controls and are verified through the Document Verification Service. Criminals who obtain the details of government-issued identity documents can easily use these details to commit fraud. This in turn can cause significant harm to the relevant individual, by impacting their credit rating or resulting in the defrauded organisation seeking recovery of costs from them.

Where a data breach involves government issued identity documents agencies should take a cautious approach and assume that there is a risk of serious harm for the individuals affected.

3.4.2 The sensitivity of the personal information involved in the data breach

Assessors should consider the sensitivity of personal information that has been compromised by the breach.^[17]

Special restrictions apply to the disclosure of some types of personal information based on their sensitivity: an individual’s ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities.^[18] These types of information are considered sensitive because of the specific risks to individuals that may arise from unauthorised use or disclosure, or loss of this information by an agency. Data breaches involving these types of personal information may be more likely to result in serious harm.

As noted in the previous section, it is important to remember that there are other types of information that may not typically be categorised as ‘sensitive’ but which may pose a significant risk of harm to an individual in a given context. Identity documents or credentials that may be misused and information about vulnerabilities of an individual that could be exploited are examples of this.

Not all information within a broad class will have the same level of sensitivity. Although health and financial information may be considered inherently more sensitive, the actual risk presented by a piece of information will depend on the context and the information itself. For example, generally a patient list for an audiology clinic might be considered less sensitive than a patient list for a drug treatment centre due to the reputational impact that may result for affected individuals. However, for an individual employed in a field that requires full hearing ability, disclosure of this information may have a more significant impact.

A combination of personal information is also typically more sensitive than a single piece of personal information. Data breaches involving health information, identity documents, or financial information can all cause harm on their own, but if combined, will likely present greater risks to the affected individuals.

3.4.3 Whether the personal information is or was protected by security measures

Assessors should consider the extent to which information subject to unauthorised access or disclosure is protected by security measures.^[19]

Strong encryption may significantly reduce the likelihood that personal information will be misused even if it is lost or accessed or disclosed without authorisation. Other security measures, such as access controls (using strong passwords, multi-factor authentication (MFA) or biometrics) and remote wiping capabilities can also be effective when combined with strong encryption. The level of protection offered by a particular technological solution may change over time and agencies should monitor the use of technology to ensure its continued effectiveness.

Assessors should consider (and if required, obtain technical advice on) the likely effectiveness of the specific security measures that were in place, taking into account the anticipated capabilities of the attacker. For example, if data stolen by a sophisticated hacker is protected by a relatively weak encryption protocol, it may not be reasonable to expect that encryption to be effective in reducing or preventing harm. Whereas if a laptop is stolen opportunistically from an employee’s car, but all data on the laptop is protected in line with an industry-recognised secure encryption standard and a strong password, MFA or biometric access control, it may be reasonable to conclude that the likelihood of a thief being able to gain access to the stored information is low and so the risk of serious harm is low.

In cases where disclosure was inadvertent or accidental, an agency should have regard to whether the unauthorised recipients of the personal information would have the motive and/or capability to circumvent any security safeguards applied to the information. For example, if a threat actor holds both encrypted data and the encryption key needed to decrypt that data, the agency should not assume the data is secure.

3.4.4 The persons who have, or may have, had access to the information

Information about the identity or motives of the person/s who have or may have had access to the personal information can enable an agency to better assess the likelihood and severity of harm to affected individuals.^[20]

Personal information obtained through a targeted cyber-attack by a known cybercrime group may be very likely to be published or misused in a way that causes harm. Cyber-attacks involving ransom demands are usually accompanied by threats of the harms that will result from publication on the dark web. Agencies should consult with cyber security experts in assessing the seriousness of these threats and consequential harms. Agencies should also report ransom demands to Cyber Security NSW, other cyber authorities (where relevant) and police.

By comparison the same information accidentally sent to a lawyer at a law firm providing services to an agency may be much less likely to be misused. In this case it might be sufficient to request and seek written confirmation (by way of a statutory declaration or undertaking) that the information has been deleted from all sources (including deleted folders) to be satisfied that serious harm is unlikely.

If personal information is made public, it is much more likely that someone, somewhere will have the skills and motive to misuse it.

Any relationship between the recipient of compromised information and the individual to whom the information relates can have a bearing on the likelihood of harm eventuating from the breach. Certain types of information (for example, information about sexual preferences or practices) may be highly distressing or embarrassing if disclosed to a colleague or family member but may be much less impactful if disclosed to an unknown third party. Similarly, an individual’s postal address may be of little consequence in the hands of an unrelated third party but may present a very high risk in the hands of a former partner where there has been a history of family violence. However, it cannot be automatically assumed that a disclosure to an unknown third party will not result in some level of harm.

3.4.5 Likelihood the person/s had malicious intent or capacity to circumvent security measures

Whether the compromised personal information is in the hands of people whose intentions are unknown, or possibly malicious, can have a bearing on the level of potential risk.^[21]

As discussed in the previous sections, the risk of harm arising from a data breach will be higher when the recipient of the information is a sophisticated actor and has demonstrated malicious intent. For example, where a breach has occurred as the result of a deliberate and targeted cyberattack, it will usually be the case that the risk of harm is higher than where the cause was accidental or inadvertent (for example, the accidental disclosure of information to an unintended recipient). The more sophisticated the threat actor, the more likely they will be able to circumvent security measures and sell or exploit lost or stolen data effectively.

3.4.6 The nature of the harm that has occurred or may occur to the affected individuals

The exposure of personal information during a data breach can result in a range of harms to the affected individuals.^[22] Harm can be physical, financial, emotional, or reputational. The particular characteristics and circumstances of the individuals affected may also impact the risk of harm. A person may be impacted by just one type of harm or by a combination of harms as a result of a data breach event and this may be a relevant factor for consideration as part of the risk assessment. The risk of harm may also be increased where the affected individual has been impacted by a previous data breach.

Examples of harm that may arise from a data breach include:

• Identity theft or fraud: Identity theft occurs when someone uses another person's personally identifying information such as their name, date of birth, identifying numbers (for example, Medicare, passport or driver licence number), or credit card number, without their permission, to commit fraud or other crimes. Identify fraud can encompass a range of activities, including the unauthorised use by one party of another party’s personal information to:
  • create fake identity documents in the individual’s name,
  • apply for grants, loans and benefits,
  • port a telephone number to a new device,
  • create a social media profile,
  • apply for real identity documents in the person’s name, but with another person's photograph,
  • open a bank account,
  • obtain a credit card,
  • apply for a passport, or
  • conduct illegal activity. 
• Financial loss: Financial loss involves monetary loss or a loss in the value of something. Financial loss may be a result of scams or identity theft, or may be incurred by an affected individual in remediating or responding to the impacts of a data breach, for example:
  • Direct loss of money or assets, for example where compromised information is used to help target and lend authenticity to a scam, or to enable fraudulent transfer of funds or assets, or application for loans.
  • Other costs incurred in responding to a breach, for example, cost to reissue identity documents, costs of counselling, fees from legal or other professional advisors retained to assist in managing impacts, cost of increased security measures or relocation expenses.
  • Loss of a financial benefit, for example damage to a person’s credit worthiness through identity fraud.
• Disruption of access to government services: Data breaches may result in the loss or denial of access to vital government services, including access to utilities or health services, for example where compromised credentials have been used for identity fraud and an individual loses access to their own accounts.
• Emotional distress, embarrassment or humiliation: The loss or theft of personal information might cause significant emotional distress that has a detrimental impact on the mental health and wellbeing of the affected individual. Exposure to an increased risk of scams and identity theft (which can be long lasting and difficult to resolve) can lead to anxiety and hypervigilance. Similarly, loss of control over information boundaries within a person’s life — between work, social and home lives, or around private facts such as health, for example — can be distressing and humiliating. For at-risk or vulnerable individuals, the real or perceived risks of harm arising from the breach of their personal information can cause very significant emotional impacts.
• Reputational damage and loss of employment or business opportunities: A breach of personal information can result in embarrassment or damage to the personal or professional reputation of the affected individual. In turn, this may have negative impacts on an individual’s employment or business prospects.
• Physical harm, stalking, harassment or intimidation: Data breaches can result in increased risks of physical harms, stalking, harassment or intimidation. Some individuals may be more susceptible to these types of harms based on their personal circumstances or profession, such as celebrities, corrections and police officers, judicial officers, and individuals impacted by family or domestic violence.
• Family or domestic violence: Data breaches can result in an increased risk of family or domestic violence, for example when information about an at-risk person’s current address, activities or access to services is shared with a perpetrator of family or domestic violence.

3.4.7 Vulnerability

The particular characteristics and circumstances of the individuals affected may impact the type, likelihood and severity of harms that may arise. Agencies should consider whether affected individuals may be particularly vulnerable or susceptible to harm. Vulnerability can be temporary or permanent and can arise as a result of either a heightened exposure to harm, or a decreased ability to protect oneself from harms.

Vulnerability may be due to a particular attribute or condition of an individual, such as their age, mental or physical health status, disability status, literacy. Some kinds of vulnerability may arise as a result of a person’s choices or circumstances such as their profession, employment/unemployment, past experiences, financial stress, homelessness or caring obligations.

Not all types of vulnerabilities will lead to greater susceptibility to harm from a data breach.

Where a data breach affects a large number of individuals, it may be impracticable to assess vulnerability on an individualised basis. However, agencies should consider the range and frequency of vulnerabilities that are present within the population as a whole (or if the breach only affects a particular sub-group, the range and frequency of vulnerabilities that are present within that sub-group).

3.4.8 Ease of identification of individuals

An important factor to consider is how easy it will be for a person who has access to compromised personal information to identify specific individuals or match the data with other information to identify individuals.

Depending on the circumstances, identification could be possible directly from the personal information breached with no special research needed to discover the individual’s identity, or it may be extremely difficult to match personal data to a particular individual, but it could still be possible under certain conditions.

Identification may be directly or indirectly possible from the breached information, but it may also depend on the specific context of the breach, and public availability of related personal details. Agencies should consider that most individuals will have some form of publicly available presence or profile that may facilitate identification of an individual from information disclosed via a data breach. This could include:

• social media accounts,
• personal websites and blogs,
• digitised newspapers and magazines, or
• genealogy databases.

Agencies should take a cautious approach and generally assume that most individuals will be identifiable from a small amount, or even a single item, of personal information.