Data breach notification

A data breach is unauthorised access or use of personal information. Breach notification is the practice of notifying affected individuals when personal information has become available to unauthorised parties.

There have been some recent high profile data breaches.

• The Treasury lost a CD in the post that contained personal and company tax details of numerous individuals.
• The website of mobile phone company 2degrees suffered teething problems making it possible to see the personal details of previous visitors to its site.
• Massey University’s intranet suffered a fault potentially exposing sensitive student information to anyone who accessed the site.

Data breach law

Holders of personal information are under no legal obligation to notify individuals or the Privacy Commissioner when an individual’s personal information is compromised. However, failure to notify would be taken into account by the Privacy Commissioner if a complaint was received.

There are strong arguments in support of making data breach notification mandatory. An individual who is notified will be able to take measures to ensure the negative effect of the breach is controlled or mitigated.

Information such as medical records and financial information is inherently sensitive. If people were notified of a breach they could take steps such as changing bank account details and passwords.

As notification is currently voluntary it makes it difficult to determine which firms and industries are the worst at protecting information. Mandatory notification would enable the collection of this type of data and allow areas of concern to be identified.

Voluntary notification may also act as a disincentive for organisations to notify individuals. By not contacting the affected individuals, organisations avoid exposure to liability, insurance consequences and damage to reputation.

Mandatory data breach notification would encourage organisations to increase the protection of personal information.