From Paper Shredders to Rogue Insiders: the OAIC’s Emerging Playbook on APP 11

One of the biggest challenges under the Australian Privacy Principles has been identifying the security controls needed to meet obligations under APP 11. In the past year, the OAIC has issued several Determinations considering APP 11, which provide some valuable guidance on the Privacy Commissioner’s APP 11 expectations across a diverse range of factual scenarios covering both technical and organisational aspects of security.

We covered the OAIC’s determination in the Vinomofo Determination and the main takeaways for organisations on APP 11 controls here.

Below, we cover some of those other recent Determinations and their coverage of APP 11.

What is APP 11?

A reminder that the APP 11 requirement is for organisations to take such steps as are reasonable in the circumstances to protect the personal information they hold from misuse, interference and loss, as well as unauthorised access, modification or disclosure.

Background

The facts of the past years’ Determinations that involved APP 11 aspects included:

• a rogue employee of a telco disclosing a customer’s information to a journalist.

• a person who discovered his digital health record was intertwined with another person’s record because of a similar name and date of birth despite Services Australia being aware of the exposure of personal information.

• a psychiatrist office getting a shredding service to dispose of old paper files and inadvertently destroying a person’s medical records.

• a wine wholesaler having lax security controls on customer data during a data migration allowing a hacker to gain access.

• a mistake by Optus which meant that 40,000 customers who had requested an unlisted number remained published in the White Pages, thereby exposing them to potential harm.

The Rogue Employee Ruling Shows the Limits of APP 11

Usurpingly the regulator takes a dim view of lax technical security controls or mishaps and mistakes that could have been avoided with more diligence.

But a particularly interesting Privacy Commissioner insight on APP 11 comes on the telco rogue employee. The Commissioner found that the telco did not in fact breach APP 11 in this situation.

The Commissioner said APP 11 is about the entity’s actions to secure personal information and not a guarantee against every possible insider misuse. In this case the telco had reasonably tight access controls in place and the rogue employee had legitimate access to the personal information for their role.

According to the Commissioner, no additional technical controls or policies by the telco could have stopped a determined insider who wanted to misuse their authority to pursue a personal grievance as this rogue employee did. The aggrieved person could have other legal remedies but APP 11 wasn’t one of them.

Common Themes from the Regulator on Securing Personal Information

Several consistent threads run through the OAIC’s current approach on securing personal information:

• Known risk, not acted on, is treated harshly. In several of these Determinations the Commissioner specifically noted the respondent had prior knowledge of the relevant risk (recurring identity mix-ups, known security gaps) well before the incident that triggered the complaint or investigation, and had not fixed it. A documented risk you haven’t remediated is treated more seriously than an undiscovered one.
• Poor data governance is a big source of APP 11 failure. The Optus White Pages case has a long list of data governance failures. Each on its own could be seen as perhaps trivial and technical, but together it turned sloppiness into real problems affecting tens of thousands. These included a lack of appropriate staffing assigned to the management of data integrity and alignment of White Pages data, and the absence of reconciliation of listing data, both within the Optus system and between Optus and Telstra. There was also poor data integrity due to historical IT system changes and problems with data fields in key source systems.
• “Reasonable steps” is scaled to size and sophistication. The Optus determination is explicit that a large, well-resourced entity is expected to do more than a small operator facing the same risk.
• Security obligations aren’t just IT/cyber. The psychiatrist office destroying paper files shows APP 11 clearly also applies to physical record storage, retention and destruction practice, not only digital files. And of course, using third parties to perform work or hold data doesn’t relieve you of responsibility if they aren’t doing their job correctly.
• Culture and governance matter, not just technical controls. Several Determinations show the Commissioner will look at training, policies, procedures and organisational attitude toward privacy, not only whether a specific technical safeguard existed.

What Orders Does the Commissioner Make?

The regulator is pragmatic in the orders it makes.

In the intertwined health records case, Services Australia was ordered to pay the complainant $10,000 for non-economic loss (stress, anxiety and the like) and provide a written apology.

The other major piece was an order to conduct a review within 3 months, produce a report with recommendations, give the OAIC a timeline for implementing any report recommendations, and finally inform the OAIC of the action taken to implement them.

Similarly, in the wine wholesaler case there was an order for several specific security uplifts, along with an order to engage a suitably qualified independent reviewer to assess the effectiveness of implementation and to inform the OAIC of the action taken to implement the recommendations from the reviewer.

In contrast in the White Pages case, it appeared that the steps needed to address the situation had already been taken and the order was limited to a declaration that Optus had breached APP 11.

It is interesting that in the psychiatrist office case, while the complainant got a declaration the respondent had breached APP 11 and $7,500 for non-economic loss, the Commissioner did not award any compensation for financial loss. This was because the complainant failed to come up with evidence of any costs they incurred even though they argued strongly they had incurred $12,000 of extra medical expenses and expenses of piecing together information from their lost records. 

Conclusion

The upshot is that failing to secure personal information is a very broad concept and the Determinations continue to show that the regulator is pragmatic and practical in its approach when and if it does get to the stage of making rulings. For organisations, it should be remembered that third party reviews and reports back to the regulator are likely to be more expensive and time consuming than complying with the modest financial awards to complainants.