Companies that fail to adequately protect people’s data could face fines of $50m or more under new legislation to be introduced next week.
After Optus and Medibank reported significant breaches of customer data, including sensitive health information, the Albanese government was now moving to increase penalties for serious or repeated breaches of customer data.
The attorney general, Mark Dreyfus, who has had cybercrime added to his portfolio, will introduce the legislation that would increase penalties for serious or repeated data breaches from $2.2m to whatever is higher; $50m, three times the value of any benefit obtained through the misuse of information, or 30% of a company’s adjusted turnover in the relevant period.
“When Australians are asked to hand over their personal data they have a right to expect it will be protected,” Dreyfus said.
“Unfortunately, significant privacy breaches in recent weeks have shown existing safeguards are inadequate. It’s not enough for a penalty for a major data breach to be seen as the cost of doing business.”
The number of individuals potentially involved, whether sensitive information has been accessed, and the potential for further consequences from the information’s release are among the factors considered in whether or not to categorise a data breach as serious.
Deliberate or reckless conduct, the type of data – for example, health – or a history of serious interference with privacy, or disregard for keeping data safe would also be considered.
The legislation would also give the Australian information commissioner greater powers to resolve breaches. It would seek to ensure more information on the nature of the breach and compromised information goes to the commissioner so they could judge the risk of harm to individuals. It would also give the commissioner greater information-sharing powers.
That was in addition to the review of the privacy act the attorney general has already ordered, which was due to be handed back by the end of the year. Those recommendations could lead to further law changes.
The amendments to the privacy legislation will be introduced during one of the busiest weeks the government has had so far, with Labor also handing down its first budget and introducing industrial relations legislation aimed at overhauling bargaining.
The Coalition has already pressed the Labor government to do more on privacy laws after the Optus hack, and was expected to support the legislation which should ensure its transition through the parliament.
The privacy reforms add to the list of legislation the government wants passed by the end of the year, with the national anti-corruption commission and industrial relations bills already a priority. The crossbench hopes the territory rights private member’s bill would also be brought to a vote.
Employers have revolted against proposed changes to multi-employer bargaining, which would include both a “supported” stream for low-paid industries, and a “single interest” stream, where workers with a “common interest” can bargain together.
In a joint statement the Business Council of Australia, Australian Chamber of Commerce and Industry and Australian Industry Group warned against the “undue expansion of multi-employer bargaining”.
The Acci chief executive, Andrew McKellar, warned if “proposals for multi-employer bargaining force unwanted terms and conditions on workplaces irrespective of whether productivity gains are realised, jobs and small business will be at risk”.
The workplace relations minister, Tony Burke, has rejected calls to delay the reform until next year, warning that “getting wages moving” is essential to help with the cost of living so the bill must proceed with “absolutely urgency”.
