June 2016 – Cyber Law Watch

Agreed changes to EU-US Privacy Shield strengthens data transfer pact

Jun 28 2016

The US and the European Union reportedly reached an agreement on the language of a key data transfer pact, including clearer limits on U.S. surveillance and stricter rules for companies holding information of Europeans. The updated EU-US Privacy Shield was sent to EU member states, who are expected to vote on the proposal in July. The revised data transfer pact is said to include stricter cross-border data-handling rules for companies using Europeans’ information for targeted online advertising, and also has detailed the specific condition under which U.S. government intelligence services would collect data in bulk and the safeguards on how the data is used.

Meanwhile, U.S. Chamber of Commerce Executive Vice President and Head of International Affairs Myron Brilliant urged the EU’s member states to quickly sign off on the updated version, saying that the new framework for trans-Atlantic data transfer is critical for companies on both sides of the pond.

Further information regarding the report by Reuters can be read here.

Report finds average cost of data breach reaches $4 million

Jun 20 2016

By Cameron Abbott and Giles Whittaker

A report sponsored by IBM and conducted by the Ponemon Institute found that the average cost of a data breach has grown to $4 million, up 29% from 2013. The survey also found cybersecurity incidents continued to witness growth in both volume and sophistication, with 64% more security incidents reported in 2015 than the preceding year. According to the study, the companies lose $158 per compromised record. Also not surprisingly, breaches in highly regulated industries were even more costly. For instance, healthcare breaches reached $355 per record – a full $100 more than in 2013.

Read the full report conducted by the Ponemon Institute here.

European Data Protection Supervisor less than impressed with EU-US Privacy Shield

Jun 05 2016

By Cameron Abbott, Rob Pulham and Giles Whittaker

The EU-US Privacy Shield data-sharing agreement has come under scrutiny from the European Data Protection Supervisor Giovanni Buttarelli. Mr Buttarelli has expressed concerns that the Privacy Shield, which will outline how data (including personal information) should be handled in foreign jurisdictions, is “not robust enough to withstand future legal scrutiny”.

While Mr Buttarelli said he “appreciates” the efforts made to develop a solution to replace Safe Harbour, he emphasised that “significant improvements are needed should the European Commission wish to adopt an adequacy decision, to respect…the key data protection principles” which are afforded in Europe with particular regard to “necessity, proportionality and redress mechanisms”.

Giovanni Buttarelli’s statement regarding the Privacy Shield can be found here.

OAIC releases draft guide for conducting big data activities

Jun 03 2016

By Cameron Abbott and Simon Ly

Last week the OAIC released their consultation draft Guide to big data and the Australian Privacy Principles, with feedback on the Guide open until 26 July 2016.

The main purpose of the Guide is to facilitate big data activities while protecting personal information (being information or an opinion about an identified individual, or an individual who is reasonably identifiable). The Guide addresses issues such as notice and consent, retention minimisation and use limitation in regards to such data. Whilst not legally binding, the Guide will be referred to by the Privacy Commissioner in undertaking its functions under the Privacy Act.

One of the key aspects dealt with in the Guide is that entities should consider undertaking big data activities on an anonymised manner by de-identifying personal information. If so, this has the favourable outcome that such data will not be considered personal information so accordingly less onerous obligations apply under the Privacy Act to such data. Of course, if this is the case it also lessens the chance that personal information will be compromised should a data breach occur (speaking of which, we note OAIC’s April 2016 guide to deal with data breaches). However, in our experience most of our clients want to analyse and then drill down to take actions or campaigns in relation to a then identified group of customers.

The Guide also highlights how big data interacts with the APPs as well as discussing other related concepts, such as “privacy by design” frameworks. For more information, you can access the OAIC’s consultation draft Guide here.

Archive:June 2016