Malicious or criminal attacks including cyber incidents remain the leading cause of data breaches involving personal information in Australia, with almost one in three breaches linked to compromised login credentials, figures published today show.

The Notifiable Data Breaches Report for July to December 2019 warns organisations about the risks associated with storing sensitive personal information in email accounts, as well as the risk of harm to individuals whose personal information is emailed to the wrong recipient.

Australian Information Commissioner and Privacy Commissioner Angelene Falk said accidental emailing of personal information to the wrong recipient was the most common cause of human error data breaches over the period, accounting for 9% of all breaches.

“Email accounts are also being used to store sensitive personal information, where it may be accessed by malicious third parties who breach these accounts. Organisations should consider additional security controls when emailing sensitive personal information, such as password-protected or encrypted files.”

Our latest Notifiable Data Breaches Report also shows health service providers continue to report more data breaches to the OAIC than any other sector.

Following the release of our Guide to health privacy, we’ve published a four-step action plan specifically aimed at the health sector to help them contain and manage data breaches, including those involving the My Health Record system.

The resource has been developed in partnership with the Australian Digital Health Agency, Australian Cyber Security Centre and Services Australia.

This month we welcomed a new Assistant Commissioner, Dispute Resolution to lead the OAIC’s privacy dispute resolution and enquiries teams, Commissioner initiated investigations, and notifiable data breaches area.

David Stevens brings more than 20 years’ experience working in prominent legal and investigations-related roles in Australia and overseas, as Assistant Commonwealth Director of Public Prosecutions, Head of Chambers of the International Criminal Court in The Hague, and at the NSW Crown Solicitor’s Office and NSW Electoral Commission. He is an experienced change leader, an accredited mediator and has also worked as a law lecturer and training officer.

David will work alongside Assistant Commissioner, Regulation and Strategy, Melanie Drayton, and Assistant Commissioner, Corporate, Ruth Mackay.

You can read more about our executive on our website.

Members of our Information Contact Officers Network (ICON) should save the date for our next information session for government agency staff, to be held in Canberra on 7 April 2020 from 9.30am to 11.30am.

More details for the event will be shared with ICON members shortly.

Earlier this month, Commissioner Angelene Falk made an appearance at a Parliamentary Joint Committee on Intelligence and Security hearing in relation to its review of the mandatory data retention regime.

The Commissioner’s opening statement addressed the regulatory role of the OAIC and outlined key privacy considerations for the Committee. These include reducing the potential for personal information to be collected outside what is intended by or is reasonably necessary under the regime, as well as the need to consider reducing the retention period and introducing a warrants-based access system.

Following the hearing the OAIC provided a supplementary submission to the Committee outlining four additional matters. The supplementary submission is now available on our website.

We’re holding a one-day training session to build the practical skills of staff performing Privacy Officer functions on behalf of Australian Government agencies. The training program will help officers understand how to carry out their role under the Australian Government Agencies Privacy Code.

This course is for staff from Australian Government agencies only and is suitable for those who are new to the role.

The next training session will be held on Thursday, 19 March 2020, 9am to 5pm.

Amendments to the Credit Reporting Code 2014 (the CR Code) came into force earlier this month, making the system fairer for consumers.

Australian Information Commissioner and Privacy Commissioner Angelene Falk said the changes should facilitate an efficient credit reporting system while ensuring the privacy of individuals is respected.

The amendments benefit consumers by making it easier for people to prevent identity and credit fraud and limiting the types of information that can be included on credit reports.

You can catch up with our submissions on a range of legislative and other issues through our website, including our recent comments in relation to the draft Telecommunications (Mobile Number Pre-Porting Additional Identity Verification) Industry Standard 2020.

Information Commissioner review decisions and privacy determinations are listed on our website and published in full on AustLII. Recent Information Commissioner decisions include:

• 'RO' and Department of Home Affairs (Freedom of information) [2020] AICmr 3
  Request for access to policies and procedures used to determine Class 600 visitor visa applications at the Australian High Commission in Pretoria, South Africa — Whether reasonable steps taken to locate documents — Reviewable decision set aside
• United Firefighters Union of Australia Aviation Branch and Airservices Australia (Freedom of information) [2020] AICmr 4
  Request for access to documents relating to the use of fire-fighting foams and the spread of per- and poly-fluoroalkyl substances — Whether a practical refusal reason exists — Whether work involved in processing the request would substantially and unreasonably divert Airservices’ resources from its other operations — Reviewable decision set aside and substituted
• RP' and Department of Defence (Freedom of information) [2020] AICmr 5
  Request for access to submissions made by an ex-service organisation regarding the emblazoning of Vietnam battle honours on unit colours — Whether disclosure of personal information is unreasonable — Whether contrary to the public interest to release a conditionally exempt document  — Reviewable decision varied