Reasonable steps to protect personal information - 5 key lessons from the Privacy Commissioner's determinations

Under Australian privacy laws, organisations need to implement 'reasonable steps' to protect any personal information they hold against misuse, interference, loss, unauthorised access, modification or disclosure. We look at the Privacy Commissioner's determinations for guidance on what should be done.

Recently, when Australia's privacy regulator (the OAIC) was asked about its privacy governance priorities for 2016, the issue of information security was, unsurprisingly, high on the agenda.

The OAIC emphasised the need for corporate counsel to focus on "get(ting) security right and...mak(ing) sure that there is a real culture of building in privacy and security protections in organisations."