Guide to handling personal information security breaches

View printable version of this page

August 2008

Key Messages

• The aim of this guide is to provide general guidance on key steps and factors for agencies and organisations to consider when responding to a personal information security breach.
• Agencies and organisations have obligations to have reasonable security safeguards in place and to take reasonable steps to protect the personal information they hold from misuse, loss and from unauthorised access, modification or disclosure.
• Personal information security breaches are not limited to malicious actions, such as theft or "hacking", but may arise from internal errors and failures to follow information handling policies, causing accidental loss or disclosure.
• In general, if there is a real risk of serious harm as a result of a personal information security breach, the affected individuals should be notified.
• Notification can operate as an important mitigation strategy for individuals and it promotes transparency and trust about the organisation or agency.
• There is no specific requirement in the Privacy Act to notify individuals when and if a breach has occurred.
• Notification of a breach in appropriate circumstances is consistent with good privacy practices.
• Compliance with this voluntary guide is recommended. It is not mandatory.
• The operation of this guide could inform the Government response to the Australian Law Reform Commission's August 2008 recommendation that mandatory breach notification be introduced into law.

Key terms used in this guide

Privacy Act

Refers to the Privacy Act 1988 (Cth)

Personal information

Has the meaning as set out in s6 of the Privacy Act:

personal information means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.

Personal information security breach

Has the meaning as given in section 4 of this Guide.

IPPs

The Information Privacy Principles (IPPs) set out in s14 of the Privacy Act.  Australian and ACT government agencies must comply with the IPPs.

NPPs

The National Privacy Principles (NPPs) set out in Schedule 3 of the Privacy Act.  In general, the NPPs apply to all businesses and non-government organisations with a turnover of more than $3 million, all health service providers and a limited range of small businesses.[1]

TFNs

Tax File Numbers.  The Privacy Act includes provisions relating to TFNs in Part III.  The Office has issued Guidelines under s17 of Privacy Act to regulate the use of TFNs.

1. The purpose of this guide

This guide has been developed to assist agencies and organisations to respond effectively to a personal information security breach. In particular, the guide explains when an effective response to a personal information security breach might include notification of individuals affected by the breach.

The Office has developed this guide to respond to requests for advice from agencies and organisations, and in recognition of the global trends towards breach notification.  Breach notification has been introduced as law in many states in the United States and is being considered by other countries including Australia. This voluntary guide has been informed by voluntary guidelines developed by the Privacy Commissioner of Canada and the Privacy Commissioner of New Zealand.[2]

The guidance provided is not intend to supplant the need for mandatory breach notification, in certain circumstances, to be entered into law.  Such a measure has been proposed by the Australian Law Reform Commission in August 2008.

2. Scope of this guide

Breach notification is one particular option in responding to a personal information security breach.  However a key challenge is to determine in what circumstances it is an appropriate response.  While establishing appropriate thresholds for requiring breach notification can be considered good privacy practice, the steps and actions outlined in the guide are not specifically required under the Privacy Act 1988 (the Privacy Act). Therefore, compliance with this guide is voluntary.

The aim of this guide is to provide general guidance on key steps and factors for agencies and organisations to consider when responding to a personal information security breach, without the sole focus being notification of breaches. 

The guide encourages a risk-analysis approach so that agencies and organisations evaluate a breach on a case-by-case basis and make decisions on actions to take according to their own assessment of risks and responsibilities in their particular circumstances. 

The guide also highlights the importance of preventative measures as part of a holistic information security plan.

It is important to note that, while the guidance is not mandatory and is of an advisory nature only, agencies and organisations do have binding legal obligations under the Privacy Act to secure personal information, as set out in the Information Privacy Principles (IPPs) and National Privacy Principles (NPPs).

It is not intended that the advice in this guide be limited to personal information security breaches that are breaches of IPP4 or NPP4[3].  Rather, the guide is intended to extend to any situation where personal information has been compromised.

3. Who should use this guide?

This guide has been developed for use by Australian and ACT Government agencies and private sector 'organisations'[4] that handle personal information. As well as businesses, organisations in the not-for-profit, community and charity sectors may find the guide useful.

The guide may also be useful to small businesses that have obligations under Privacy Act, including those small businesses that may only be covered by the NPPs in respect of some of their activities[5] or are covered by the credit reporting provisions of Part IIIA of the Privacy Act.

Government agencies of the states and the Northern Territory, as well as private sector businesses not covered by the Privacy Act, may find the guide helpful in outlining good privacy practice.  However, the Privacy Commissioner would not have a role in receiving notifications about personal information security breaches from these entities. 

State and Northern Territory government agencies should also consider the role of relevant Privacy or Information Commissioners in their own jurisdictions.

4. What is a personal information security breach?

A personal information security breach occurs when personal information is subject to loss or unauthorised access, use, disclosure, copying or modification.

The use of the term 'personal information security' breach is consistent with the Privacy Act, which regulates the handling of personal information.  This term is used in preference to the term 'data' which is generally not used in the Privacy Act.[6]

Personal information security breaches can occur in a number of ways.  Some of the most common breaches happen when personal information held by an agency or organisation is lost, misused, mistakenly disclosed or stolen.  Some examples include:

• lost or stolen laptops, removable storage devices, or physical files containing personal information
• paper records inadequately recycled or left in garbage
• computer hard drives and other storage media being disposed of without erasing contents
• an agency or organisation mistakenly providing personal information to the wrong person, for example by sending details out to the wrong address
• an individual deceiving an agency or organisation into improperly releasing the personal information of another person
• databases containing personal information being 'hacked' into or otherwise illegally accessed by individuals outside of the agency or organisation and
• employees accessing personal information outside the requirements of their employment.

It is important to recognise that personal information security breaches are not limited to external malicious actions, such as theft or 'hacking', but may just as often involve internal errors and failures to follow established information handling procedures.  While there may be no harm intended, these types of breach can affect individuals' privacy as much as malicious actions.

5. Prevent personal information security breaches

Security is a basic element of information privacy.[7] In Australia, this principle is reflected in the Privacy Act in both the IPPs and the NPPs. 

5.1 Obligations under the Privacy Act

The IPPs regulate the way most Australian and ACT Government agencies handle personal information.  These principles cover the collection, storage, use, disclosure and access obligations of those agencies. 

The NPPs regulate the way private sector organisations handle personal information.  These principles cover collection, storage, use, disclosure and access obligations of organisations covered by the Privacy Act.  In general the NPPs apply to all businesses and non government organisations with a turnover of more than $3 million, all health service providers and a limited range of small businesses.[8]

Agencies and organisations are required to take reasonable steps to protect the personal information they hold from misuse and loss and from unauthorised access, modification or disclosure.  This requirement is set out in IPP 4 for public sector agencies and NPP 4 for private sector organisations.[9] (See Appendix A for IPP4 and NPP4.)

Section 18G(b) of the Privacy Act imposes equivalent obligations on credit reporting agencies and all credit providers. Similarly, guideline 6.1 of the statutory guidelines regulating Tax File Numbers (TFN) requires TFN recipients to afford TFNs security safeguards as are reasonable in the circumstances.

5.2 Other obligations

Many agencies are subject to agency-specific legislative requirements that add further protections for personal information (such as secrecy provisions), as well as legislative and other requirements which apply more generally across government.[10] These other requirements can include the Australian Government's Protective Security Manual and the Information and Communications Technology Security Manual (also known as ACSI 33).

Organisations may also be subject to additional obligations through sectoral specific-legislation in respect of particular information they hold.  For example, Part 13 of the Telecommunications Act 1997 (Cth) sets out obligations on the telecommunications industry in relation to the handling of certain telecommunications-related personal information.  Some organisations may also have common law duties relating to confidentiality of particular information. 

These additional obligations need to be considered by agencies and organisations when taking steps to prevent or respond to personal information security breaches.

5.3 Considerations for keeping information secure

While the focus of this guide is the process of responding to a personal information security breach agencies and organisations should aim to avoid such breaches in the first place by ensuring that they have appropriate security safeguards in place consistent with IPP4 or NPP4. 

Some of the information in Step 4 of the guide (see page 32) could equally be used by agencies or organisations as a way of assessing what security measures they should have in place to avoid a breach occurring.

What are reasonable steps to secure personal information will depend on context, including:

• the sensitivity to the individual of the personal information the organisation holds
• the harm that is likely to result to people if there is a breach of their personal information
• the potential for harm (reputational or other damage) to the agency or organisation if the personal information in question were breached
• how the agency or organisation stores, processes and transmits the personal information (for example, paper-based or electronic records, or using a third party service provider).

Appropriate security safeguards for personal information need to be considered across a range of areas.  This could include maintaining physical security, computer and network security, communications security and personnel security.  To meet their information security obligations, agencies and organisations should consider the following steps: 

• risk assessment - identifying the security risks to personal information held by the organisation and the consequences of a breach of security
• policy development - developing a policy or range of policies that implements measures, practices and procedures to reduce the identified risks to information security
• staff training - training staff and managers in security and fraud awareness, practices and procedures and codes of conduct
• the appointment of a responsible person or position - creating a designated position within the agency or organisation to deal with personal information security breaches. This position could have responsibility for establishing policy and procedures, training staff, co-ordinating reviews and audits and investigating and responding breaches
• technology - implementing privacy enhancing technologies to secure personal information held by the agency or organisation, including through such measures as access control, copy protection, intrusion detection, and robust encryption.
• monitor and review - monitoring compliance with the security policy, periodic assessments of new security risks and the adequacy of existing security measures, and ensuring that effective complaint handling procedures are in place
• standards - measuring performance against relevant Australian and international standards as a guide
• privacy impact assessments - evaluating, in a systemic way, the degree to which proposed or existing information systems align with good privacy practice and legal obligations
• audits - undertaking regular audits to detect system weaknesses and/or breaches and
• appropriate contract management - conducting appropriate due diligencewhere services are contracted, particularly in terms of the IT security policies and practices that the service provider has in place and then monitoring compliance to these policies through periodic audits.

Further, in seeking to prevent personal information security breaches, agencies and organisations should consider their other privacy obligations under the IPPs and NPPs.  Some breaches or risks of harm can be avoided or minimised by not collecting particular types of personal information or only keeping it for as long as necessary.  Consider:

• What personal information is necessary to be collected? Simply put, personal information that is never collected, cannot be mishandled and therefore the risk of mishandling is avoided. Both IPP1 and NPP1 require that agencies and organisations, respectively, only collect personal information that is necessary for one or more of their functions or activities. IPP 3 also requires that a collector of personal information take steps to ensure that the information collected is relevant to the purpose for which it was collected.
• How long does the personal information need to be kept? NPP 4.2 requires organisations to securely destroy or permanently de-identify information that is no longer needed for the permitted purposes for which it may be used or disclosed. Although the IPPs do not contain a similar obligation, agencies should nevertheless consider retention practices, subject to other applicable record-keeping requirements such as those contained in the Commonwealth Archives Act.

6. Why breach notification is good privacy practice

Both the IPPs and the NPPs require that personal information be held securely.  Failure to comply constitutes an interference with privacy under the Privacy Act. 

However, the Privacy Act does not expressly require an agency or organisation to notify individuals if personal information is subject to a breach of information security safeguards.  In addition, breaches of personal information may arise from activity that is not regulated by the Privacy Act, such as acts and practices relating to employee records held by private sector organisations.[11]

Notifying individuals where a breach affects their personal information is consistent with good privacy, for these reasons:

• Notification as a reasonable security safeguard: As part of the obligation to keep personal information secure, notification may in some circumstances be considered as a reasonable step in the protection of personal information against misuse, loss or unauthorised access, modification or disclosure.
• Notification as openness about privacy practices: Being open and transparent with individuals about how personal information may be handled is recognised as a fundamental privacy principle.[12] Part of being open about the handling of personal information may include telling individuals when something goes wrong and explaining what has been done to try to avoid or remedy any actual or potential harm.
• Notification as restoring control over personal information: Privacy is valued, not only because it underpins our human dignity but also because it gives individuals a measure of control in their everyday interactions as to how personal information about them is handled. To this end, the Privacy Act seeks to ensure that individuals know why information is collected, what it is used for, who it is ordinarily disclosed to and provides for rights of access and correction.

Notification of a breach in appropriate circumstances is consistent with good privacy practices and is to be encouraged in maintaining a community in which privacy is valued and respected. 

7. Four key steps in responding to a breach

Personal information security breaches can be caused by a variety of factors, affect different types of personal information and give rise to a range of actual or potential harms to individuals, agencies and organisations. 

Given this context, it is clear that there is no single way of responding to a personal information security breach.  Each breach will need to be dealt with on a case-by-case basis, undertaking an assessment of the risks involved, and using that risk assessment as the basis for deciding what actions to take in the circumstances.   

Each of the steps is set out in further detail below.

General tips: 

• Be sure to take each situation seriously and move immediately to contain and assess the suspected breach.
• Breaches that may initially seem immaterial may be significant when their full implications are assessed.
• Agencies and organisations should undertake steps 1, 2 and 3 either simultaneously or in quick succession. In some cases it may be appropriate to notify individuals immediately, before containment or assessment of the breach occurs.
• The decision on how to respond should be made on a case-by-case basis. Depending on the breach, not all steps may be necessary, or some steps may be combined. In some cases, agencies and organisations may choose to take additional steps that are specific to the nature of the breach.

STEP 1: Contain the breach and do a preliminary assessment

Once an agency and organisation has discovered or suspects that a personal information security breach has occurred, they should take immediate common sense steps to limit the breach. These may include

STEP 2: Evaluate the risks associated with the breach

To determine what other steps are immediately necessary agencies and organisations should assess the risks to the individual associated with the breach. 

Consider the following factors in assessing the risks:

• (a) What personal information is involved
• (b) What is the context of the information
• (c) Establish the cause and extent of the breach
• (d) Asses what is the risk of harm that could result to individuals
• (e) Identify what other harms or risks could arise

STEP 3: Consider notification

Notification can be an important mitigation strategy that has the potential to benefit both the agency or organisation and the individuals affected by a personal information security breach.  The challenge is to determine when notification is appropriate.  While notification is an important mitigation strategy, it will not always be the appropriate response to a breach.  Providing notification about low risk breaches can cause undue anxiety and de-sensitise individuals to notice.  Each incident needs to be considered on a case-by-case basis to determine whether breach notification is required. 

In general, if a personal information security breach creates a real risk of serious harm to the individual, those affected should be notified. 

Prompt notification to individuals in these cases can help them mitigate the damage by taking steps to protect themselves.  Agencies and organisations should:

• take into account the ability of the individual to take specific steps to mitigate any such harm
• consider whether it is appropriate to inform other third parties about the personal information security breach such as the police, professional bodies, the Privacy Commissioner or other regulators or professional bodies.

(a) Deciding whether to notify affected individuals

In notifying affected individuals, a key consideration is whether notification is necessary in order to avoid or mitigate serious harm to an individual whose personal information has been inappropriately accessed, collected, used or disclosed.

Agencies and organisations should consider the following factors when deciding whether to notify:

• What is the risk of serious harm to the individual as determined by step 2?
• What is the ability of the individual to avoid or mitigate possible harm if notified of a breach (in addition to steps taken by the agency or organisation)? For example, would an individual be able to have a new bank account number issued to avoid potential financial harm resulting from a breach? Would steps such as monitoring bank statements or exercising greater vigilance over their credit reporting records assist in mitigating risks of financial or credit fraud?
• Even if the individual would not be able to take steps to fix the situation, is the information that has been compromised very sensitive or likely to cause humiliation or embarrassment for the individual?
• What are the legal and contractual obligations to notify and what are the consequences, of notification?
• What are the consequences of failing to notify affected individuals? If individuals subsequently find out about the breach through the media for example, what could be the associated loss of trust that the agency or organisation sustains?

(b) Process of notification

At this stage, the organisation or agency should have as complete a set of facts as possible and have completed the risk assessment in order to determine whether to notify individuals.  The following tables set out some of the considerations in the process of notification.

Sometimes the urgency or seriousness of the breach dictates that notification should happen immediately, before having all the necessary facts.  

(c) What should be included in the notification?

The content of notifications will vary depending on the particular breach and the method of notification chosen.  In general, the information in the notice should help the individual to reduce or prevent the harm that could be caused by the breach.  Notifications should include the types of information detailed in the table below.

(d) Others to Contact

In general, notifying the Office, other authorities or regulators should not be a substitute for notifying individuals. However, in some circumstances it may be appropriate to notify these third parties.

STEP 4: Prevent future breaches

Once the immediate steps are taken to mitigate the risks associated with the breach, agencies and organisations need to take the time to investigate the cause of the breach and consider whether to either evaluate the existing prevention plan or develop one.

A prevention plan should suggest actions which are proportionate to the significance of the breach and whether it was a systemic breach or an isolated instance.

This plan may include the following:

• a security audit of both physical and technical security
• a review of policies and procedures and any changes to reflect the lessons learned from the investigation and regularly after that (for example, security, record retention and collection policies)
• a review of employee selection and training practices and
• a review of service delivery partners (e.g. dealers and retailers).

The plan may include a requirement for an audit at the end of the process to ensure that the prevention plan has been fully implemented.

Some suggestions for being prepared to respond to a breach are: 

• Develop a breach response plan: while the aim should be to prevent breaches, having a breach response plan may assist in ensuring a quick response to breaches, and greater potential for mitigating harm from the breach.
  
  A plan could set out contact details for appropriate staff that should be notified; clarify the roles and responsibilities of staff; and document processes for the agency or organisation to contain breaches, coordinate investigations and breach notifications and cooperate with external investigations.
• Depending on the size of the agency or organisation, a management group responsible for responding to personal information breaches could be established, with representatives from relevant areas that may be needed to investigate an incident, conduct risk assessments and make appropriate decisions (e.g. privacy, senior management, IT, public affairs, legal).
  
  The group could convene periodically to review the response plan, discuss new risks and practices, or consider incidents that have occurred in other agencies or organisations.
• Include information in the agency or organisation's privacy policy about how it respond to breaches. This could include letting individuals know how they are likely to be notified in the event of a breach and whether the agency or organisation would ask them to verify any contact details or other information.
  
  This would make clear to individuals how their personal contact information is used in the event of a breach, and may also assist individuals to avoid 'phishing' scam emails involving fake breach notifications and asking recipients to verify their account details, passwords and other personal information. 

Tips for preventing future breaches

Some of the measures that have resulted from real-life personal information security breaches are:

• the creation of a senior position in the agency or organisation with specific responsibility for data security
• a ban on bulk transfers of data onto removable media without adequate security protection (such as encryption)
• disabling the download function on computers in use across the agency or organisation to prevent the download of data onto removable media
• ensure hard drives and other storage media are erased before being disposed
• use secure couriers and appropriate tamper proof packaging in the transport of bulk data and
• a ban on the removal of unencrypted laptops and other portable devices from government buildings.

Technological advances allow increasingly larger amounts of information to be stored on increasingly smaller devices.  This creates a greater risk of personal information security breaches due to the size and portability of these devices, which can be lost or misplaced more easily when taken outside of the office. There is also a risk of theft because of the value of the devices themselves (regardless of the information they contain).

Preventative steps that agencies and organisations can take include conducting risk assessments to determine:

• whether and in what circumstances (and by which staff), personal information is permitted to be removed from the Office, whether it is removed in electronic form on disks, USB storage devices, laptops and other portable devices or in physical files and
• whether their stored data, both in the office and when removed from the office, requires encryption security.

8. The Role of the Office of the Privacy Commissioner

The Office, on behalf of the Privacy Commissioner, has the function of investigating possible breaches of the Privacy Act.  It also has the function of providing advice to agencies and organisations on any matter relevant to the operation of the Privacy Act.  While the Office has no formal role in relation to breach notification, it may provide general advice on how to respond to a personal information security breach.

Step 3(d) of the guide provides guidance on when it may be appropriate to notify the Office of a personal information breach.  Consistent with its statutory functions, the Office may consider whether it needs to investigate the conduct.

A personal information breach may constitute a breach of information security obligations under the IPPs or NPPs, and in that circumstance it will be an interference with an individual's privacy.[13]  However, the Office cannot make a decision on whether there has been a breach of the Act until it has conducted an investigation. 

If an individual thinks an agency or organisation has interfered with his or her privacy, and they have been unable to resolve the matter directly with the agency or organisation, they can complain to the Privacy Commissioner.  The Office may investigate and may attempt to resolve the matter by conciliation between the parties. 

The Privacy Act does not specify penalties for breaches of the IPPs or NPPs, though deliberate contravention of some of the credit reporting provisions in Part IIIA of the Privacy Act does carry penalties.  The Privacy Commissioner may make determinations requiring the payment of compensation for damages or other remedies, such as the provision of access or the issuance of an apology.  These determinations can be enforced by the Federal Court or Federal Magistrates Court.

The Office also has the power to initiate an investigation on its own motion in appropriate circumstances without first receiving a complaint.

Agencies should also be aware that, under s 27(1)(j) of the Privacy Act, the Privacy Commissioner can inform the Cabinet Secretary, as the Minister responsible for the Privacy Act, of action that needs to be taken by an agency in order to achieve compliance by the agency with the IPPs.

The Office conducts its investigations in private, and in general will not publicise details of its inquiries.  However, consistent with its roles of education and enforcement, in some circumstances the Commissioner may publicise information about the information management practices of an agency or organisation.

8.1 Reporting a personal information security breach to the Office

The Privacy Act does not specifically require agencies and organisations to report personal information security breaches to the Privacy Commissioner.  However, agencies and organisations may choose to notify the Office of a personal information security breach where the circumstances indicate that it is appropriate to do so, as set out in Step 3(d).  The following are some potential benefits from notifying the Office of a personal information security breach:

• An agency or organisation's decision to notify the Office on its own initiative may be viewed by the public as a positive action. It tells clients and the public that the agency or organisation views the protection of personal information as an important and serious matter. This may enhance public/client confidence in the agency or organisation.
• It can assist the Office in responding to inquiries made by the public and managing any complaints that may be received as a result of the breach. If the agency or organisation provide the Office with details of the matter, and the action taken to address it, and prevent future occurrences, then it may be that any complaints received can be dealt with more quickly based on that information. In those circumstances, consideration will need to be given to whether an individual complainant can demonstrate that they have suffered loss or damage, and whether some additional resolution is required, or alternatively, the Office may consider that the steps taken have adequately dealt with the matter.

It is important to note that reporting a breach does not preclude the Office from receiving complaints and conducting an investigation of the incident (whether in response to a complaint or of its own motion).

If the agency or organisation decide to report a personal information security breach to the Office, the following provides an indication of what the Office can and can't do:

What the Office can do:

• Provide general information about obligations under the Privacy Act, factors to consider in responding to a personal information security breach and steps to take to prevent similar future incidents.
• Respond to community enquiries about the breach and explain possible steps individuals can take to protect their personal information.

What the Office cannot do:

• Provide detailed advice about how to respond to a breach or approve a particular proposed course of action. Agencies and organisations will need to seek their own legal or other specialist advice.
• Agree not to investigate (either using the Commissioner's 'own motion investigation' powers, or if a complaint is made to the Office) if the Office is notified of a breach.

When the Office receives a complaint about an alleged breach of the Act, in most cases, the Office must investigate.  As set out above, the Office may also investigate an act or practice in the absence of a complaint, on its 'own motion'.  The Office uses risk assessment criteria to determine whether to investigate a matter on its own motion.  These criteria include:

• whether a large number of people have been, or are likely to be affected, and the consequences for those individuals
• the sensitivity of the personal information involved
• the progress of an agency or organisation's own investigation into the matter
• the likelihood that the acts or practices involve systemic or widespread interferences with privacy;
• what actions have been taken to minimise the harm to individuals arising from the breach, such as notifying them and/or offering to re-secure their information and
• whether another body, such as the police, are investigating.

These factors are similar to those included in the risk assessment criteria for responding to a personal information security breach.

8.2 What to put in a notification to the Office

Any notice provided to the Office should contain similar content to that provided to individuals.  It should not include personal information about the affect individuals.  It may be appropriate to tell the Office:

• a description of the breach
• the type of personal information
• what response the agency or organisation has made to the breach
• what assistance has been offered to affected individuals
• who is the contact person
• whether the breach notified has to other external contact(s).

9. Schematic guide to breach notification

Appendix A

Web HTML, Word and PDF published August 2008

ISBN 978-1-877079-62-7

© Commonwealth of Australia 2008

[1] See sections 6D and 6E of the Privacy Act. 

[2] See Office of the Privacy Commissioner of Canada, 'Key Steps for Organisations in Responding to Privacy Breaches' (August 2007), available at http://www.privcom.gc.ca/information/guide/2007/gl_070801_02_e.asp. and New Zealand Office of the Privacy Commissioner draft privacy breach guidelines, available at http://www.privacy.org.nz/privacy-breach-guidelines-2/.   

[3] IPP4 and NPP4, require agencies and organisations, respectively, to protect information they hold from misuse and loss and from unauthorised access, modification or disclosure.

[4] An organisation, as defined under the Privacy Act 1988, is

• (a) an individual, or;
• (b) a body corporate or;
• (c) a partnership or;
• (d) any other unincorporated association or;
• (e) a trust;

that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed instrumentality.

[5] For example, organisations that are reporting entities for the purposes of the Anti Money Laundering and Counter Terrorism Financing Act 2006 are required to comply with the NPPs in terms of these activities, even if they are otherwise exempt under the Privacy Act.   

[6] Although the titles for NPP 3, NPP 4 and NPP 9 all refer to 'data' (being the 'Data quality', 'Data security' and 'Transborder data flows' principles respectively), this term tends not to be used in the substantive provisions of the Act.  See Privacy Act 1988 (Cth), Schedule 3.  The NPPs are available at http://www.privacy.gov.au/publications/npps01.html.

[7] See the 'security safeguards principle' in the Organisation for Economic Cooperation and Development (OECD) Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980) available at http://www.oecd.org/document/18/0,2340,en_2649_34255_1815186_1_1_1_1,00.html.
The Privacy Act 1988 (Cth) was enacted to implement the OECD guidelines in Australia, as recognised in the preamble to the Act.

[8] For further information on coverage of the NPPs, see Information Sheet 12-2001 Coverage of and Exemptions from the Private Sector Provisions, available at http://www.privacy.gov.au/publications/IS12_01.html.

[9] The Office has provided further guidance on compliance with the information security principles elsewhere, available at

Guidelines to the Information Privacy Principles (principles 4-7) (for Australian and ACT Government agencies), available at
http://www.privacy.gov.au/government/guidelines/index.html.

Guidelines to the National Privacy Principles (for private sector organisations), available at
http://www.privacy.gov.au/publications/nppgl_01.html.

Information Sheet 6-2001:  Security and personal information
Provides information for organisations on compliance with NPP 4 available at  http://www.privacy.gov.au/publications/IS6_01.html.

[10] See the Office's Guidelines to the Information Privacy Principles (principles 4-7) for a brief overview of existing guidance on security standards for agencies, available at http://www.privacy.gov.au/government/guidelines/index.html.

[11] Employee Records (as defined in s6 of the Privacy Act) directly related to an employment relationship of current or former employees are exempt from coverage by the NPPs under s7B(3). 

[12] See the 'openness principle' in the Organisation for Economic Cooperation and Development (OECD) Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980), available at http://www.oecd.org/document/18/0,2340,en_2649_34255_1815186_1_1_1_1,00.html.  This principle is reflected in NPP 5 and IPP 2 in the Privacy Act 1988 (Cth).

[13] See sections 13 (agencies) and 13A (organisations) of the Privacy Act 1988 (Cth).