Table 1: Summary international comparison – mandatory data breach notification schemes Country Relevant law/instrument/other details Notification threshold and recipient/s Kind of information Consequences for non-compliance Standard (compared to draft Bill) Australia — proposed scheme Exposure Draft — Privacy Amendment (Notification of Serious Data Breaches) Bill 2015 Notify the Information Commissioner and affected individuals of all data breaches creating a real risk of serious harm Personal information, credit reporting information, credit eligibility information and tax file number information, as defined in the Privacy Act Risk of enforcement action, including potential civil penalties for serious or repeated infringements N/A Canada — scheme passed into law in June 2015 but is yet to commence Digital Privacy Act Notify the Privacy Commissioner and affected individuals of all data breaches creating a real risk of significant harm Personal information, defined as information an identifiable individual Risk of fines for knowing or wilful failure to report a breach to the Commissioner, to notify an individual or to maintain records in specified circumstances Similar European Union Commission Regulation (EU) No 611/2013 Notify a national authority of all ‘personal data breaches’ Notify both a national authority and individuals where the data breach is likely to adversely affect the individuals’ personal data or privacy Personal data, defined so that the notification requirement applies only to providers of publicly available electronic communication services Judicial remedies and penalties in relevant Member State laws (for example, in the United Kingdom, monetary penalties may apply under the Privacy and Electronic Communications (EC Directive) Regulations 2003 or the Data Protection Act 1988) Lower notification threshold, but applies to a narrower range of information Two-tier notification system
New Zealand — proposed scheme Outlined in Government press release ‘Privacy law changes to strengthen protection’, 28 May 2014 Notify all ‘material’ data breaches to the Privacy Commissioner Notify both the Privacy Commissioner and affected individuals where the breach carries a real risk of harm Personal information, defined to mean information about an identifiable individual Expected that Commissioner will have full range of existing powers available Lower notification threshold Two-tier notification system OECD Guidelines — international guidance material (not binding) OECD Privacy Framework (2013) Notify a national authority of ‘significant security breaches’ Notify both a national authority and individuals where a significant security breach is likely to adversely affect those individuals Personal data, defined as information relating to an identified or identifiable individual N/A Lower notification threshold Two-tier notification system
United States — California California Code § 1798.29(a) and 1798.82(a) (many other US states have implemented variations on this model) Notify an individual if their unencrypted personal information is acquired without authority Notify the Attorney General if a data breach affects more than 500 individuals Personal information, defined as an individual’s name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted: social security number drivers’ license number account number, credit or debit card number in combination with an access code medical information health insurance Information Any combination of a user name or email address and access credentials also falls under the definition Criminal penalties and ability under law to sue breaching organisations Lower notification threshold, but applies to a narrower range of information Encryption provisions similar to how the draft Bill deals with assessing the risk of harm Two-tier notification system
United States — proposed federal scheme Draft legislation — Personal Data Notification & Protection Act (would replace existing laws applying to the private sector) Businesses that handle ‘sensitive personally identifiable information’ of more than 10,000 individuals per year must notify an individual of a security breach of that information within 30 days, unless there is no reasonable risk of harm or fraud, or the information is adequately encrypted Sensitive personally identifiable information, defined (in summary) as an individual’s name in combination with any two of the following: home address, telephone number, mother’s maiden name or birthday various government identifiers biometric data account identifier user name or electronic mail address, in combination with an access code. Any combination of an individual’s name, account identifier/user name and access credentials also falls under the definition Attorney-General of the State or the local law enforcement agency on behalf of the residents of the agency’s jurisdiction may bring a civil action The Federal Trade Commission may also commence an investigation Lower notification threshold with a set time limit, but applies to a narrower range of information Applies only to businesses, not government agencies Encryption provisions similar to how the draft Bill deals with assessing the risk of harm Exclusion of small businesses would potentially be similar to the Australian Privacy Act.