Katrine Evans: Current issues Key themes in enquiries and complaints “Privacy at work” Neil Sanson: Risk Data breach guidelines Data encryption Combining datasets

Just a few of our current issues Code making – review of the Credit Reporting Privacy Code Policy – comments on the Immigration Bill Technology – layered privacy notice project Information matching – encryption International – implementation of APEC Privacy Framework eg through trustmarks Privacy (Cross-Border) Amendment Bill

“Personal affairs” Section 56 of the Privacy Act

Protecting information on portable media Principle 5

Preventing employee browsing Principle 5 again

PRIVACY AT WORK

66% involved data the victim did not know was on the system 75% of breaches were not discovered by the victim 83% of attacks were not highly difficult 85% of breaches were the result of opportunistic attacks 87% were considered avoidable through reasonable controls

“the length of time between the attacker’s initial entry into the corporate network and the compromise of information is relatively short.” … “this was accomplished within minutes or hours in just under half of cases investigated.” “In sharp contrast, it takes much longer for organizations to discover a compromise. Months or even years transpired...”

“Companies that carry out formal risk assessment are twice as likely to detect unauthorised access by staff or attacks on network traffic and nearly four times as likely to detect identity theft as those that do not.”

“Decisions should take account of the wider context of the risk and include consideration of the tolerability of the risks borne by parties other than the organisation that benefits from it.” [3.5]

Cost to Victim: existing accounts - $ new accounts - $1, Cost to Business: $48, Victim hours repairing: existing accounts – 116 hours; new accounts – hours 49% repaired in 6 months

Unauthorised access to or collection, use, or disclosure of personal information Most common privacy breaches happen when personal information of customers, patients, clients or employees is stolen, lost or mistakenly disclosed guidelines-2/ Privacy Breach Guidelines What is a privacy breach ?

Data Encryption Required for data transfers - physical media mostly now done - on-line transfers are under review - Government Shared Network (GSN) – expect encryption Can you call it ‘professional’ if you are not taking steps to protect data?

Combining Datasets Privacy Act as guidance when combing datasets