Recently, AAPT customer data was hacked and published on the
internet. Following an own motion investigation, on 15 October,
Australian Privacy Commissioner, Timothy Pilgrim, found AAPT had
breached the Privacy Act in respect of the incident.
The case provides a useful scenario to examine what would the
result be if the same issues arose for an agency under the new law.
In particular, the case provides useful guidance around the
Commissioner's thinking on:
- what constitutes "disclosure" and what constitutes
"use"
- what your obligations are when you use a third party server,
and
- what your training obligations are.
Background
This case involved AAPT's company data (including
customers' personal information) being accessed and stolen by
Anonymous, an international network of "hacktivists",
between 17 and 19 July 2012. Anonymous subsequently published the
data on the internet.
