IN BRIEF
Recent changes to the Privacy Act 1988 (Cth) (Privacy Act)
require entities to take reasonable steps to implement practices,
procedures and systems that will ensure compliance with the new
Australian Privacy Principles (APPs). This article looks at the
Australian Privacy Commission's report on a privacy breach by
Telstra and provides valuable insight into the Commissioner's
expectations and the need for ongoing review and monitoring of
compliance measures
BACKGROUND AND FINDINGS
The personal information of 15,775 Telstra customers was
unlawfully disclosed when a Telstra contractor inadvertently turned
off access control making the files in question accessible online
from 24 February 2012 to 15 May 2013. Google's Googlebot later
indexed the files and they then became discoverable through Google
search.
