16 Jun, 2023
Privacy breaches happen all the time to organisations all over the world. We've had some notable ones here in NZ which provide some good 'what not to do' examples, but chances are, your organisation will experience at least a few in its lifetime! They key thing is how you manage them. Before we jump into managing a breach, it's useful to explain the difference between an incident and a breach. A privacy incident refers to any situation where there is a potential unauthorised access, use, or disclosure of personal information. This might be an unsecured system or an HR file left on a copier. On the other hand, a privacy breach occurs when there is an actual unauthorised access, use, or disclosure of personal information. This can happen if a hacker breaks into a database, if an employee accidentally sends an email to the wrong person, or if a physical document goes missing. Basically, any time personal information is exposed in a way that wasn't supposed to happen, it's considered a privacy breach. This is a big deal because personal information is sensitive and can be used for things like identity theft. If you think there's been a privacy breach, it's important to take action right away to protect people's privacy. To determine if a privacy incident is a breach under the New Zealand Privacy Act, you should consider the following factors: Nature of the information: Personal information includes details like names, contact information, financial data, or any other data that identifies an individual. If the incident involves unauthorised access to this kind of information, it raises concerns for a potential breach. Unauthorised access or disclosure: A privacy breach occurs when there is an unauthorised access or disclosure of personal information. If someone gains access to or shares personal information without proper authorization, it could be considered a breach. Likelihood of harm: The Privacy Act considers the potential harm or adverse effects that could result from a privacy breach. If there is a risk of harm to individuals, such as identity theft, financial loss, or reputational damage, it strengthens the case for a breach. Steps taken to mitigate harm: If an organisation takes prompt action to minimise the impact of the incident and protect individuals affected by the privacy incident, it demonstrates commitment to handling the situation responsibly. Reporting obligations: Organisations are required by law to notify the Privacy Commissioner and affected individuals in the event of a privacy breach that could cause serious harm. Compliance with these reporting obligations is an important factor in determining if an incident qualifies as a breach. Breaches can be a really scary time for the victims of the breach and the people who (hopefully unwittingly) caused the breach. This can be magnified if the breach reaches the threshold of being notifiable under the Privacy Act. We can help figure out your threshold and identify whether you need to get the Privacy Commission involved. We're experts at dealing with breaches (we love a little drama in our lives!) and have a strong belief in a no-blame culture, unless the breach is caused by malicious activity of course. If you need some help figuring out whether you're dealing with an incident or a breach or maybe you just need a calming pat on the head, we're here to help! We also recommend checking out the OPC guidance on managing breaches .