Privacy law - employers, employees and data breach risks – a recent case

The Notifiable Data Breach scheme, established by the Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth), commenced on 22 February 2018. Broadly, the scheme provides that companies must take reasonable steps to notify all potentially affected individuals of an eligible data breach, and report the breach to the Office of the Australian Information Commissioner.

One month on from the commencement of the scheme, Svitzer Australia has reported a notifiable data breach involving the personal information of approximately half of its employees. This breach is one of the first to be notified under the new laws.

This breach occurred over a period of nearly 11 months, and involved the auto-forward function which saw emails from three employee accounts being automatically forwarded to an external source. Investigations are currently being undertaken, but it has been confirmed that the leaked information may include employee information such as tax file numbers and