eevBLAB #52 - My Personal Data STOLEN from the Government! - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: September 19, 2018, 12:55:53 am
content: All my personal data was STOLEN from the Western Australian Government's Perth Mint thanks to a third party data breach.Obvious serious identity theft implications for customers as a result.

author: WN1X
author_rank: Unknown
timestamp: September 19, 2018, 01:02:19 am
content: So how are they going to help you out if/when someone actually uses the stolen info to steal your identity and mess up your life for many years to come? Sounds like a nasty law suit in the works.

author: Muttley Snickers
author_rank: Unknown
timestamp: September 19, 2018, 01:11:12 am
content: How do we even know you are the real Dave ?, you could have somehow used his private information to access his login and password details leaving all of us at the mercy of some unscrupulous fiend who's agenda is to cause mayhem and havoc about the place.

author: ttelectronic
author_rank: Regular Contributor
timestamp: September 19, 2018, 01:50:52 am
content: A few things bother me and it's the same anywhere. Why The F does anyone get away with not answering a single question, and why the hell aren't journalists asking the questions. This bullshit about security and not mentioning where the data was stolen from. It's OUR data, yet they won't even let us knowwhoshould be held accountable. WTF.....

author: TERRA Operative
author_rank: Super Contributor
timestamp: September 19, 2018, 02:10:15 am
content: Quote from: Muttley Snickers on September 19, 2018, 01:11:12 amSo, business as usual then?

author: Scottjd
author_rank: Frequent Contributor
timestamp: September 19, 2018, 04:30:55 am
content: No point in trying anymore. Oh, my info was stolen so I get 1 year of free credit monitoring. Like the hackers won’t hold onto the info for 5 years before selling it or using it, really? Then again I had 6 years of free credit monitoring because at point 6 different companies were compromised one year after another. At this point just give up...unless you change the info used for verifying who you are like buying a different car, moving to another house, changing all credit cards then in 5 years the info would be outed to be used for creating ID theft.. Since banks ask about what car you recently bought, the balance estimate on a credit card (I don’t keep balances so that’s pointless) and current and past addresses for verification then you will need to change all of these things every time you info is stolen, that’s not possible to do every year. Then let’s make it easier for them by making the home you bought public information, that’s needs to stop also. I give up at this point. It would be easier for me to create a new ID fake identity and start over then to try and prevent ID theft with how many times my information has been stolen. It not the question if it will happen anymore, but when will it happen these days.And other on social media just give away infor for free making it even easier, wow.Interesting fact, if the data compromised is encrypted then some companies don’t even need to let you know your information was stolen. So for every time your notified, 5 other companies probsbly didn’t tell you. How fast computers are getting with cluster networked systems it will only take a few years to break some encryptions. Or maybe they encryption is already compromised also, but you don’t know about it so you don’t know what encryption was even used.Then you have some governments (US) requiring companies to follow certain regulations to protect customer information, and they turn around and let the IRS server get hacked that is NOT encrypted a decade after they made other companies encrypt their data. Can we say two faced?

author: SeanB
author_rank: Super Contributor
timestamp: September 19, 2018, 05:07:23 am
content: Give a hint as to the "third party", nobody ever got fired for using them. Now your info was in a database that was viewable by anybody with the right credentials. Password was "Password" and this was on a post it note on the notice board of an outsourced company, in the public lobby...... So the staff of the day could "Do the Needful".

author: Chupacabras
author_rank: Regular Contributor
timestamp: September 19, 2018, 07:01:39 am
content: Good news is:1) they discovered the breach2) they notified the publicYes, they made many "mistakes", but I bet there are many other organizations and many breaches they even didn't notice.

author: EEVblog
author_rank: Unknown
timestamp: September 19, 2018, 08:04:03 am
content: LOL! Comments disabled!

author: Decoman
author_rank: Regular Contributor
timestamp: September 19, 2018, 09:58:26 am
content: I am reminded of something I vaguely remember having read about in my local news, many years ago. Something about how a record with the personal numbers (11 digit number afaik) of every citizen in norway, was lost on a cd that was displaced, and presumed lost in a public place. I don't think I am remembering this wrong, but its been so long and I don't have any copy of this.Presumably, and I am speculating, it is all too easy for me to assume that, one way to circumvent local laws regarding privacy and data protection, is to simply circumvent the presumably very narrow legal language and white washing the illegal sharing of such data, by simply handing it over to other countries governments. Something similar could be done for monitoring traffic, in simply routing local data traffic over another country, thus allowing country B to monitor the local traffic in country A. Sweden is known for having laws that warrant internet traffic monitoring. "FRA" law iirc, or maybe it's just a military institution, unsure. And I think I've learned that the internet doesn't have data sent over the shortest connection based on geograprahpy, data might really go places before ending up at its final destination.Btw, speaking of money, I remember a couple of times, I had made a small donation (some 10 usd) with my Visa card, and then the bank froze my bank account, which seems like an overreaction. I interpreted it as an act of intimidation simply because of who the money was supposed to go to (nothing criminal or violent or bad), and the bank said they did it because they didn't know who the money went to (money went to a foundation). I suppose I should be glad if my bank puts a stop to mysterious bank transactions, but it seems to me that it is about control, more than providing security. Presumably, banks in can/will be held accountable should money go places where other people don't want it to do, I guess that is sort of ok (if fraud is involved), but I don't know, I basically want to decide for myself where my money goes.I like donating money on the internet, because if everybody chip in, things gets done. However, I am also conscious that this activity might as well be considered very limited, as it won't solve the world's poverty problems (not my donation activity anyway I would think, as I have limited money anyway), and also that I am no willing to donate too much either. Either way, I don't donate to feel better about myself, but to well help out when I feel it is ok.

author: NivagSwerdna
author_rank: Super Contributor
timestamp: September 19, 2018, 10:14:51 am
content: Seems there is some physical hacking going on too!http://www.abc.net.au/news/2018-08-03/man-hid-stolen-perth-mint-gold-coins-in-computer-hard-drive/10070998

author: Raj
author_rank: Frequent Contributor
timestamp: September 19, 2018, 12:51:16 pm
content: You haven't seen the worst yet.Aadhar system in India is way worse. Afterall, you can't replace your eyes and fingerprints. F#($) Governments.

author: madires
author_rank: Super Contributor
timestamp: September 19, 2018, 12:54:10 pm
content: As a victim of one official data breach (LinkedIn) I've experienced only more SPAM and additional verification measures when logging in on some shopping websites from time to time. The latter is caused by some crooks trying to use the data from the breach for free shopping. This is one of the reasons you should have a dedicated password for each account/login. It also tells me that the password was stored in clear text or only secured by a poor hashing algorithm.There are also unofficial data breaches, mostly when an employee copies customer data for some extra income. I had a subscription of an electronics magazine. One day I received a newsletter from a Dutch audio magazine which is owned by the same publisher. I asked them to remove me from their list and they told me that someone has ticked the wrong box. No drama, things like this happen. But after that some shady marketer started to send me Dutch SPAM and still does. Luckily most of the SPAM is rejected by my MTAs (I run my own mail servers), so it doesn't bother me much. This looks like some employee is selling customer data, doesn't it?

author: Bud
author_rank: Super Contributor
timestamp: September 19, 2018, 01:05:36 pm
content: Article on Amazon employees making extra cash selling insider information including customer email addresseshttps://www.theverge.com/2018/9/16/17867358/amazon-investigation-employee-seller-bribery-internal-data-deleting-negative-reviews

author: HeywoodFloyd
author_rank: Contributor
timestamp: September 19, 2018, 01:09:49 pm
content: Any idea if the identity theft monitoring is worth the risk/effort/cost?My data was stolen in the recent British Airways data breach. BA offered me monitoring for 1yr but I note the monitoring company asks for way more information than BA had, and their privacy policy says they share it with third parties and keep it for six years after my account closes. Having monitoring may be a greater risk than not having it

author: NivagSwerdna
author_rank: Super Contributor
timestamp: September 19, 2018, 01:23:04 pm
content: Quote from: HeywoodFloyd on September 19, 2018, 01:09:49 pmI noticed that too... I think I was offered Garlik after a breach but I notice that Garlik is really Experian... funny it keeps asking me for my bank and credit card details...

author: madires
author_rank: Super Contributor
timestamp: September 19, 2018, 01:52:32 pm
content: Identity theft monitoring is just a placebo to keep the victims calm. It doesn't help when a bank turns up suddenly and asks you to pay for a credit you never signed, or when a debt collection service demands the money for some expensive toys you never ordered. Those are typical cases of identity theft, and you would have to hire a lawyer to deal with them. I wouldn't accept any cheap monitoring service, I'd demand that the company pays my lawyer for dealing with the real problems and some compensation for the stress and time wasted.

author: vodka
author_rank: Frequent Contributor
timestamp: September 19, 2018, 06:12:47 pm
content: Quote from: Decoman on September 19, 2018, 09:58:26 amOur case is quite worse, it is the own goverment,concretly, the "Generalitat" of Catalonia who stolen our privacy data for doing an illegal referendum.https://youtu.be/ud-MCpHjTtwHere the transciption:Quote

author: bitwelder
author_rank: Super Contributor
timestamp: September 19, 2018, 07:46:17 pm
content: "Perth Mint did not identity the third-party IT provider that hosted the breached database. But over the past couple of years, the mint has sought to revamp its IT infrastructure, which involved moving from in-house ICT support to a managed service, CRN reported in March 2017.After a tendering process, the mint selectedSilverfern ITof Perth."https://www.bankinfosecurity.com/perth-mint-says-3200-customers-affected-by-data-breach-a-11521

author: firewalker
author_rank: Super Contributor
timestamp: September 19, 2018, 08:01:24 pm
content: Can you twist their arm with a court order or similar to answer your really valid questions?Alexander.

author: thm_w
author_rank: Super Contributor
timestamp: September 19, 2018, 08:18:07 pm
content: Quote from: NivagSwerdna on September 19, 2018, 10:14:51 amInteresting because that happened in 2016 when the database is supposedly from: "Joseph Charles Viola, 29, pleaded guilty in the District Court to six charges of stealing the items, worth a total of $55,000 and including a limited edition Kimberley sunrise coin,between February and April 2016."But that doesn't match up with the other information given, so probably was not him.

author: HeywoodFloyd
author_rank: Contributor
timestamp: September 20, 2018, 08:28:28 am
content: Quote from: madires on September 19, 2018, 01:52:32 pmMind you, you'd need to know which one of your data leaks led to that particular identity theft.You probably have an account with credit rating agencies that you don't even know about...https://www.bbc.co.uk/news/uk-england-essex-45574163

author: Halcyon
author_rank: Unknown
timestamp: September 20, 2018, 10:09:18 am
content: Quote from: firewalker on September 19, 2018, 08:01:24 pmThere's really no point and it's certainly not worth the time, effort and expense of going to court. The best we (the public) can do is refer the matter to the Office of the Australian Information Commissioner. If they determine that the Privacy Act has been breached, they can take action against the entity. But it appears that there is nothing compelling the organisation to answer Dave's questions, as fair as those questions may be.

author: NiHaoMike
author_rank: Super Contributor
timestamp: September 21, 2018, 04:07:33 am
content: Those in the US probably remember the infamous Equifax hacking incident...Quote from: Decoman on September 19, 2018, 09:58:26 amI use cryptocurrency for that - maintains my desire to keep "regular money" and "hobby money" separate where practical and it's a lot more fun to build and run a machine that "generates money". Well, more like "collect the transaction fees from other users in exchange for getting their transactions into the blockchain", especially for coins like Swagbucks that recently halved the block reward. (There seem to be lots of clueless users who waste their time on the surveys only to have a significant percentage of their little profit going to the miners, but that helps to keep the mining profits high...) Some of the exchanges don't ask for very much personal information so there's not much to leak in the first place.That is not to say that cryptocurrency is completely immune to leaking personal data - one time Perk ramped up asking for ID in order to use the exchange services, which was likely a factor in its crash... (I just moved on to mining other coins like many others did and never gave them any personal information.)

author: (*steve*)
author_rank: Regular Contributor
timestamp: September 22, 2018, 03:08:24 am
content: I'm employed in an area within the WA Govt which is very aware of data breaches. It's not the Mint (but I won't say more).One thing you need to be aware of is that WA Government agencies are not covered under the Privacy Act (1988) (the Act). This is because of (1) the definition of who is covered by the Act, and (2) because WA has *NO* privacy legislation. Off the top of my head, I'm not sure if the WA Mint falls under one of the categories which are covered, but they well may not be... This is something you can check by a call to the Office of the Australian Information Commissioner (OAIC) (email foi@oaic.gov.au) 1300 363 992.The report by the mint to the OAIC may be a courtesy rather than a requirement. If it is, the OAIC can't force them to follow the law they're not acting under...If they are covered by the Act, your best recourse is a complaint to the OAIC because complaints by individuals *can* be handled under the Act.HOWEVER, if you take the time to read the Act (and yes, I'm someone who has) there are plenty of outs for organisations if they deem your issue falls into the "too hard" basket or (as they've said) would result in a further breach.If the breach has been reported ONLY by the Mint, then the third party is probably a party that isn't covered by the Act. This could be a WA State Govt agency (but you can bet they would have been thrown under the bus) or they are situated outside Australia. The latter would be my best bet.Given the date of the breach vs the currency of the data, my bet is that the breach occurred in a test system populated with old production data.The definition of a eligible data breach in the Act (Section 26WF, pp185-186 requires that there is both "unauthorised access to, or unauthorised disclosure of, the information", AND "a reasonable person would conclude that the access or disclosure WOULD [my emphasis] result in serious harm[...]". Given that, you can draw some conclusions about whether the disclosure was contained (I would guess it wasn't, because containment would mitigate the risk) and regardless of whether there is "no threat to any account holdings at The Perth Mint", there IS a real risk of "serious harm". Personally, I would go beyond "real risk".Whilst I wouldn't go this far, some have suggested that the Act is designed to shield Australian organisations (not people) from harm resulting from data breaches. Some evidence in this regard is that one type of organisation exempted from the Act is "political parties".The OAIC can hold hearings and has some power to compel witnesses, so if you want to have a bit of fun you could agitate to have the OAIC investigate. Beware that they can also require you to attend and answer questions under oath. This is not my idea of fun.

author: Halcyon
author_rank: Unknown
timestamp: September 22, 2018, 06:21:46 am
content: Quote from: (*steve*) on September 22, 2018, 03:08:24 amI'm sorry but that's just not correct at all. Could you point to some references to support your claim?The Privacy Act is federal legislation. It trumps any state/territory legislation to the contrary but also co-exists with existing state/territory legislation concerning the collection of personal information. The Privacy Act 1998 applies to all states and territories within Australia. In fact, if you look at the very first paragraph on the OAIC website concerning this, it says:The Privacy Act 1988 (Privacy Act) regulates how personal information is handled by Australian Government agencies and the Norfolk Island administration, medium-to-large businesses, the not-for-profit sector, the credit reporting industry and health service providers.The report by WA mint to OAIC was done because that is what is required of them by the act.

author: (*steve*)
author_rank: Regular Contributor
timestamp: September 22, 2018, 07:15:22 am
content: Please see the Privacy Act (1988) herehttps://www.legislation.gov.au/Details/C2014C00076One of your objections is under section 109 of the Australian Constitution. This act explicitly deals with inconsistency by generally deferring to State/Territory legislation. Read section 3:"It is the intention of the Parliament that this Act is not to affect the operation of a law of a State or of a Territory that makes provision with respect to the collection, holding, use, correction or disclosure of personal information (including such a law relating to credit reporting or the use of information held in connection with credit reporting) and is capable of operating concurrently with this Act."The fact that WA does not have Privacy legislation is important, but not the sole consideration here because many state acts make provision for the "collection, holding, use, correction or disclosure of personal information[...]"Then section 6C (p36)Starting with "What is an organisation?", and going through to "that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed instrumentality of a State or Territory."Then further on page 37, "What is a State or Territory authority?" which lists a huge set of things. Notably, and as I alluded to in my opening post, certain structures are exempted from this exemption. 6C(3)(c)(i) may apply to the Mint.There are other methods by which organisations can be prescribed, exempted, or have certain functions exempted, but I doubt those are relevant here.I think it is quite likely, but not 100% certain thatQuoteBecause it's not relevant to what I do, I've not looked to see if organisations exempt from the Act can volunteer to report to the OAIC.The entire point of this is that *before* you go off complaining that the organisation has not reported completely, you should determine that the organisation is actually covered by the Act. Once you find that it is, I would recommend you direct your enquiries to the OAIC. As underfunded as they are, they have the power to actually get an answer, the Act doesn't really give an individual much power to demand anything (because there are so many ways they can fob you off).

author: Brumby
author_rank: Unknown
timestamp: September 22, 2018, 09:53:30 am
content: To me it sounds absurd to claim a Federal act has no power in a state because that state has no similar legislation - because that's what it sounds like you are saying.While I'm no legal expert, the phrase "is not to affect the operation of a law of a State or of a Territory ... ... and is capable of operating concurrently with this Act." would indicate to me that, if there is noconflictbetween State law and the Federal privacy act, then they canbothbe applied to a given situation. In the case where the state has no such legislation, then the Federal legislation carries full weight.It's like having a Federal law to not detonate a nuclear bomb - but the state has no such laws. It doesn't mean you can go to that state and blow shit up with one.

author: (*steve*)
author_rank: Regular Contributor
timestamp: September 22, 2018, 02:19:13 pm
content: QuoteI didn't say that.QuoteFunnily enough I rely on the advice of those who are.QuoteNo, it's like having a federal law that is drafted so as not to override state legislation.I'm not going to argue with you. If you're correct, please inform the Federal AG and the AOIC, the various State Solicitors, and frankly as many other people as you can. It will save me a hell of a lot of time and effort and let me retire early to my electronics hobby.

author: Brumby
author_rank: Unknown
timestamp: September 22, 2018, 04:11:52 pm
content: Seems I've got the wrong end of the stick. Maybe I'll reread this when my head cold clears.

author: Halcyon
author_rank: Unknown
timestamp: September 22, 2018, 11:23:44 pm
content: Quote from: (*steve*) on September 22, 2018, 07:15:22 amThe key words here are "and is capable of operating concurrently with this Act". The above clause in the Privacy Act basically gives each state the ability to create its own laws in addition to the federal Privacy Act (although it seems a little redundant to me). As per Section 109 of the Australian Constitution, If there is a clash between state and federal law, then federal law takes precedence as to the extent of the inconsistency.Quote from: (*steve*) on September 22, 2018, 07:15:22 amIt really doesn't matter for the purposes of this thread whether Western Australia does or does not have it's own laws regarding Privacy or the collection of personal information, this is why the Privacy Act 1988 exists.Quote from: (*steve*) on September 22, 2018, 07:15:22 amYou're looking at the wrong definition. Under Part IIIC (Notification of eligible data breaches), this part refers to "entity", not "organisation". An "entity" is defined as being an agency, organisation or a small business operator. Then, if you look at the definition of "agency", its interpretation is wide. The Western Australia Mint falls under this definition.Quote from: (*steve*) on September 22, 2018, 07:15:22 amCorrect.Quote from: (*steve*) on September 22, 2018, 07:15:22 amYes they can but it doesn't apply in this case.Quote from: (*steve*) on September 22, 2018, 07:15:22 amI made the comment in another thread that it was possible that WA Mint didn't fully comply with the requirements under the Privacy Act, specifically "the kind of kinds of information concerned". I haven't read the e-mails from WA Mint to Dave so I only made the suggestion based on Dave's comments before the video was uploaded to YouTube. Whilst I've studied law, I'm not an expert in legislation concerning privacy and alike. The wording is open to interpretation and I'm sure the legal experts at WA Mint would have advised correctly. However, by not providing a complete list of the various fields/pieces of information that was stored in the database seems a bit dodgy to me.I don't think anyone expects an organisation to send each and every person affected by a breach a personal letter to explain exactly what of theirs was stolen, but I would expect them to tell everyone what fields were in the database subject to the breach, then it would be up to the individual to determine whether they had provided that data to the organisation.* I used the word state but consider this to also mean "territory".

author: EEVblog
author_rank: Unknown
timestamp: September 22, 2018, 11:48:59 pm
content: The Perth Mint have now offered a third party credit monitoring service for 12 months for all those affected.

author: MK14
author_rank: Super Contributor
timestamp: September 23, 2018, 12:14:41 am
content: Quote from: EEVblog on September 22, 2018, 11:48:59 pmI was offered something similar, when my account details (in the end, I think I was lucky, and my details were safe) were compromised (along with a huge number of others), because of a UK business being hacked. About 2 or 3 years ago.But I ignored that measly offering, because I was worried it would need my credit card to verify who I am for the "free" 12 month period.Then after the 12 months, they would charge me for the credit monitoring service and be a real nightmare (pain in the neck), to cancel. Needing lots of phone calls and listening to sales talk (which I'm not interested in), from sales reps, trying to sell me services I don't want. For just cancelling the "free" service.

author: (*steve*)
author_rank: Regular Contributor
timestamp: September 23, 2018, 02:35:43 am
content: QuoteSigh. Clearly expertise in electronics elicits a greater working knowledge of the Privacy Act (1988) than a person who has to deal with it, and more than the Federal AG and the OAIC have in administering it.Please read the datasheet. You don't even have to read the whole 346 pages. I have provided references to the information created for engineers using this product. I would encourage you to read and understand that rather than the bullshit marketing fluff.My last word on this (and then I'll leave you to your misinterpretation based on inaccurate media reporting of detailed technical information):The Act EXCLUDES state agencies (and a broad range of other groups -- possibly including Dave -- from many/all provisions), and this MAY include the WA Mint. I'm not saying it is a good thing any more than I would say that "Absolute Maximum" ratings are a good thing, they're just facts. I have suggested how to find out, and once you have, how to leverage the Act to possibly get answers to your questions.

author: madires
author_rank: Super Contributor
timestamp: September 23, 2018, 10:52:26 am
content: Quote from: MK14 on September 23, 2018, 12:14:41 amIt's like being robbed twice.

author: Halcyon
author_rank: Unknown
timestamp: September 23, 2018, 10:22:37 pm
content: Quote from: (*steve*) on September 23, 2018, 02:35:43 amAs I said, I have a very good grasp of law based on my previous employment. My electronics knowledge aside, I think I have a fairly clear understanding on how to interpret legislation. My interpretation has absolutely nothing to do with the media, in fact, I haven't read, seen or heard a single thing about it in mainstream media, mostly because I don't pay that much attention to it.It seems it's you who is misinterpreting the law in this instance. I get that you're getting advice from others, but I find Chinese whispers never worked too well. As I said, I'm not going to pretend to know the in's and out's of privacy legislation, it's not my area of expertise, but you're still yet to point me to any piece of legislation which excludes the WA Mint from the definitions/clauses I pointed out previously. From what I can see it very much INCLUDES them. On one hand you're sitting on the fence by using words like "may", yet on the other hand you're arguing sections which I literally copied from the Privacy Act. If you're going to assert that I'm wrong, provide some evidence please.

author: CatalinaWOW
author_rank: Super Contributor
timestamp: September 23, 2018, 10:32:13 pm
content: What is silly about this is that anyone anywhere will loan a significant amount of money based on a single number, an email address and a password. These data breaches shouldn't really matter. They are annoying, troubling and all of that, but wouldn't have affected anything in the world of a few decades ago when you couldn't get any kind of credit unless the banker knew you and your employer personally.We have gained much with the convenience of these remote transactions, but we have lost much too. Perhaps we should swing the pendulum back the other way a bit and require something closer to the bandwidth involved in the older methods of giving credit.

author: Halcyon
author_rank: Unknown
timestamp: September 23, 2018, 11:03:37 pm
content: Quote from: CatalinaWOW on September 23, 2018, 10:32:13 pmMost (all?) banks in Australia now use two-factor authentication. Whilst it's not enforced on every account, the banks tend to limit their liability by restricting transfer limits. For example without 2FA, the most I can transfer out of my account is $1000. With 2FA, I can increase that up to $10,000 per day.But all the security measures in the world won't protect people from themselves, for starters, they need to stop using the same passwords for their various accounts!

author: (*steve*)
author_rank: Regular Contributor
timestamp: September 25, 2018, 11:13:28 am
content: Quote from: Halcyon on September 23, 2018, 10:22:37 pmhttps://www.oaic.gov.au/privacy-law/rights-and-responsibilitiesScroll down to "Whodoesn'thave responsibilities under the Privacy Act?"then read this:The Privacy Act does not cover:State or territory government agencies, including state and territory public hospitals and health care facilities (which are covered under state and territory legislation) except:certain acts and practices related to My Health Records and Individual Healthcare Identifiersentities prescribed by the Privacy Regulation 2013individuals acting in their own capacity, including your neighboursuniversities, other than private universities and the Australian National Universitypublic schoolsin some circumstances, the handling of employee records by an organisation in relation to current and former employment relationshipssmall business operators, unless an exception applies (see above)media organisations acting in the course of journalism if the organisation is publicly committed to observing published privacy standardsregistered political parties and political representatives.This is, of course, not as authoritative as the references to the Act that I have already provided.And I am VERY MUCH on the fence as to whether or not the Mint is covered -- you simply assume they are. I was pointing out that state agencies ARE NOT covered, and IF it includes the Mint, it is a reason why they don't have to do what the ACT says an organisation under the act has to do. My advice continues that you should (1) find out, and (2) IF they are, take it up any perceived non-compliance with the OAIC.The legal question concerning the Mint is whether their corporate structure falls one way or the other with respect to the Act.I would recommend that Dave, in his next communication with the Mint, ask "Are you covered by the Privacy Act (1988)?"

author: Halcyon
author_rank: Unknown
timestamp: September 25, 2018, 11:55:25 pm
content: Quote from: (*steve*) on September 25, 2018, 11:13:28 amDon't just rely on the dot-points on the OAIC website, for example If you scroll up a little bit it states:Who has responsibilities under the Privacy Act?Australian Government agencies(and the Norfolk Island administration) and all businesses and not-for-profit organisations with an annual turnover more than $3 million have responsibilities under the Privacy Act, subject to some exceptions.As I said, read the actual legislation.QuoteQuoteQuoteA number of exemptions exists, for example, complying with secrecy provisions, but they don't seem to apply here.

author: BrianHG
author_rank: Super Contributor
timestamp: September 27, 2018, 03:59:08 pm
content: How funny, bumped into this (shows you how the Australian government databases have been hacked many times and shared with others...):