Our legal experts will keep you up to date on all relevant and current developments.
We have seen multiple clients affected by this issue over the last 12 months. For that reason, we ask all our clients whether they have appropriate policies, procedures, and practices in place to minimise the chance of a cyber attack and, equally important, to confidently manage the cyber attack if and when it occurs.
There is no question that one of the most high-profile legal issues at the moment relates to privacy and data control.
Recent privacy breaches have highlighted that Australia’s laws may not be as effective as we would like in requiring businesses to take appropriate precautions to prevent the inappropriate release of private information and personal data.
In part, this may be because Australia has a very low penalty regime with respect to privacy breaches. This, and other relevant matters, are currently being considered - and an update to the Privacy Act 1988 has now been drafted and introduced into Parliament.
The Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 considers some of the core elements referred to in the 2021 Exposure Draft. In particular it increases penalties for data breach. Currently, a corporate entity could be exposed to penalties of up to $2.22 million.
Moving forward, under the new regime, penalties will be the greater of:
$50 million;
3 times the value of the benefit obtained by the company; or
30% of the adjusted turnover of the company during the period in which the privacy breach occurred.
Non-corporate entities and individuals will have their penalties raised from $444,000 to $2.5 million.
With the increasing prevalence of malicious cyberattacks, new regulations have been introduced to ensure that the government has knowledge of cyber incidences affecting specific entities in the following industries:
By implementing a mandatory reporting regime, the government seeks to strengthen the security and resilience of critical infrastructure, by empowering the relevant authorities to more immediately address critical cyber incidents - and to develop responses and protections to minimise the risk of future incidents occurring.
On 21 June 2021, Shadow Assistant Minister for Cyber Security, Tim Watts introduced the private members Ransomware Payments Bill 2021 (Cth) into Parliament. The Bill would require the Commonwealth Government and big businesses to report ransomware payments to the Australian Cyber Security Centre (ACSC).
The Bill was introduced in response to the 200% increase in reported ransomware attacks on Australian organisations - including prominent incidents affecting companies such as JBS Foods and Nine Entertainment.