Privacy Act 2020, ss 112-118
One of the biggest changes in the Privacy Act 2020 is that organisations now have obligations to let people know if there has been a “notifiable privacy breach”. This means that if breach has caused (or is likely to cause) serious harm to someone, the organisation must tell the individual whose privacy was breached, and the Privacy Commissioner.
An organisation has to consider the following before deciding if the privacy breach is likely to cause serious harm:
any action taken by the organisation to reduce the risk of harm following the breach
whether the personal information is sensitive in nature
the nature of the harm that may be caused to affected individuals
the person or body that has obtained or may obtain personal information as a result of the breach (if known)
whether the personal information is protected by a security measure
any other relevant matters.
When deciding if a privacy breach is likely to cause serious harm, organisations should get independent legal advice. If an organisation fails to notify the Privacy Commissioner of a “notifiable privacy breach”, they can be fined up to $10,000.