The Optus Data Breach: Will It Lead to Privacy Reforms in Asia?

The Optus Data Breach: Will It Lead to Privacy Reforms in Asia?

By Desarack Teso, CIPP-A/CIPP-E, Senior Advisor, Asia-Pacific | 4 November 2022

Photo by Galeanu Mihai on Unsplash

The Optus data breach in September has so far revealed that personal data of up to 10 million customers were compromised, including their home addresses, drivers’ licenses and passport numbers. Optus is Australian No. 2 mobile operator that is wholly-owned by Singapore’s Singtel.

In the wake of this massive data breach, the Australian government quickly moved to reveal its plans to pursue substantial reforms of the current Privacy Act, including increased penalties. Some of the major regulatory issues that are in scope for review include: What are the “reasonable security measures” to protect personal data? How long is the “timely manner” to report a data breach? What are the “reasonable steps” the organization must take to remediate the breach? What are the potential penalties to promote compliance?

High-profile and massive data breach incidents are hitting closer and closer to Asia. In addition to Australia, they will no doubt raise questions with other countries across the Asia Pacific, particularly those with a comprehensive privacy law in place but yet has rarely been tested.

What are “reasonable” security measures?

Many countries in Asia with comprehensive personal data protection laws require organizations to put in place “reasonable,” “practicable,” or “appropriate” security measures to protect personal data from unauthorized access, misuse, interference or loss. This regulatory approach is appropriate given the rapid pace of technology developments and the increased sophistications of the malicious actors.

The current reality is that malicious actors are now well-funded, and in some cases state-sponsored. As such, they can employ sophisticated tactics to gain unauthorized access to networks and systems, and there might not have been anything an organization could do about it despite the reasonable security measures it had in place. This is what will likely be investigated in the Optus case.

The scrutiny on “reasonable” security measures must take into account the organization’s size and resources, the complexity of its operations and business model, as well as the amount and type of the personal data it holds. In the Optus case – based on the amount and sensitive nature of the personal data it held, the size of the organization, its business model – these “reasonable” steps will likely need to be on the sophisticated end of the scale.

What is “timely” data breach notification or “reasonable” remediation measures?

Many countries in Asia require organizations to report a data breach “without undue delay,” or in “timely manner,” or “where feasible” within a specified number of hours (usually 72 hours) after having become “aware” of the breach. There is a consensus among cybersecurity experts that failure to report the data breach quickly can lead to serious harms to the data subjects, including subsequent financial or identity fraud.

Timely data breach notification must be accompanied by “reasonable” steps to protect personal data after the breach. An obvious reasonable step should include patching up any system vulnerabilities that have been compromised and that may lead to further unauthorized disclosure. Some critics are raising questions whether paying the ransom demand should be explored as a remedial measure. Notifying affected individuals so they can be vigilant and take steps to protect themselves should also be prioritized. However, most organizations must navigate any remedial measure against the potential damages to their corporate and brand reputations.

What are deterrent penalties?

The proposed privacy amendment bill submitted to the parliament by the Australian government include increasing the maximum penalties under the Privacy Act, and if passed, Australia will have the highest privacy breach penalties in the world.

Currently, the penalties for serious or repeated interference with privacy by companies is A$2.22 million. The proposal calls for penalties equivalent to the greater of: (1) A$50 million, or (2) three times the value of the benefit obtained; or (3) if that can’t be determined, 30% of the “adjusted turnover” during the “breach turnover period” for the past 12 months or duration of the privacy breach (whichever is longer).

For context, the General Data Protection Regulation (GDPR) provides for administrative fines of up to €20 million (approximately A$31 million), or 4% of the firm’s worldwide annual revenue from the preceding financial year, whichever is higher, for serious infringement. China’s recently enacted Personal Information Protection Law provides for fines of up to RMB 50 million (approximately A$10.7 million) or 5% of the annual turnover of the preceding year for severe violations. These large penalties pale in comparison to what is being proposed in Australia.

What’s next?

Australia’s proposed privacy amendment bill was submitted to the parliament in October just a few weeks after the Optus breach was discovered in September. Moreover, the government has also confirmed that there will be a further privacy reform measures that will be revealed at the end of this year. These regulatory actions demonstrate that the government will move quickly and decisively in response to serious privacy breach.

Will other regulators in Asia take note of the Australia’s approach? One thing is for sure, organizations must remain vigilant in monitoring and engaging in any reform agenda and be well prepared to quickly comply with enhanced privacy and information security requirements.

Posted in

Related Articles

Consumer data privacy: a snapshot of new regulations in Vietnam

By Nga Dao The first half of 2023 has witnessed some key developments in Vietnam’s data privacy legislation. These particularly include the issuance of the first-ever decree on personal data protection (Decree 13/2023/ND-CP or PDPD) in April and the adoption of the Law on E-Transactions and Law on Consumers’ Right Protection in June, both of […]

Thailand’s improving internet freedom under the new government

By Pett Jarupaiboon Thailand’s politics is currently in transition. Thai voters voiced their demands and are looking for a change after almost a decade under the Prayuth regime. As the winner in the election, the Move Forward Party (MFP) is trying to form a government and among the sweeping policies to reform the country, digital […]

The Illusion of Regulation: Unveiling the Truth Behind Misinformation

By Edika Amin Prevalence of Misinformation in Asia Pacific Misinformation is defined as false or misleading information that is spread, regardless of intent to mislead. Essentially, misinformation doesn’t care about intent, and so is simply a term for any kind of false or misleading information. The spread of misinformation is becoming a significant issue in […]