Recipient: Board of Directors of Latitude Financial Services
Recipient: Board of Directors of Latitude Financial Services
Sender: Cyber Risks Officer
Date: 10/5/2023
Re: Your enquiry on data breach advice
Summary
Dear, Board of Directors,
Thanks for reaching out.
As Cyber Risks Officers of Latitude Financial Services, we are writing to provide comprehensive advice on the recent data breach affecting the company. This memorandum aims to assist further guidance from external lawyers on how to handle the consequences of a breach of Australian law, in accordance with the legal requirements in Australia.
Bound by
Based on the information provided in previous linked documents, it appears that Latitude is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. The Privacy Act 1988 (Cth) regulates the handling of personal information by Australian government agencies and some private sector organizations. An Australian business that generates a yearly turnover over $3 million Australian dollars, is subject to the Privacy Act. The Act defines personal information as information or an opinion, whether true or not, and whether recorded in a material form or not, about an identified or reasonably identified individual. Referencing the Annual report 2022, stating that the privacy system is not limited to potential growth meaning an even more strong[er] data security protection, and if not protected this would result in a breach of Australian privacy principles.
The APPs are a set of 13 privacy principles that apply to organizations covered by the Privacy Act 1988 (Cth). The APPs regulate the collection, standards, use, storage, and disclosure of personal information by these organizations.
Obligations - Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)
As Latitude Financial services generates an annual turnover surpassing$3 million Australian dollars and is considered a credit provider due to its service as a business, it is bound to the Privacy Act 1988 (Cth), that is Australian Privacy Principles (APPs).
Due to the companys large system of personal and information, Latitude must work according to Privacy, to ensure the safety, protection and privacy of all their customers.
Types of data stolen
The types of data stolen from your entity were personal and sensitive information such as names, 'email address, and 'passport number' all of which may have been exposed. This means that the breach is likely to have significant implications for your data protection and privacy obligations.
From Latitude Financial Services the data; names, email addresses, passport numbers and drivers license numbers were stolen. These stolen data types are considered personal information as it satisfies the definition of personal information in the Privacy Act 1988 (Cth) as it is an opinion or information about an individual who is identifiable to a reasonable extent. These data types are identifiable to a particular individual and therefore, is catergorised as personal information.
The Act defines sensitive information as a subdivision of personal information as it is more confidential and private data regarding distinctive traits that allow for an individual to develop a sense of identity. Some examples include political opinions, sexual orientation, religious belief and genetic information. Due to the intimacy of the data, APPs require that businesses construct a stronger defence system.
Therefore, the stolen data isnt sensitive information but only personal information as it doesnt fit into any of the intimate classifications of sensitive data. However, these stolen details can result in harm such as medical or financial identity theft.
As a result, you have engaged in an interference with APP 11 which states that the obligation to secure and protect personal information. Furthermore, the company must conduct a thorough internal investigation into the breach in which the Australian Information Commissioner may be obligated to make a determination into the breach and its consequences. If Latitude believes that this data breach may cause significant harm, they are required to notify the affected individuals due to the Notifiable Data Breach (NBD) scheme in the Privacy Act and APP 11. The company must set out a stronger defence system to safeguard their personal data to ensure breaching of APP 11 never occurs in the future.
Engagement in an interference with privacy - as defined in the Privacy Act 1988 (Cth)
An interference with the privacy of an individual occurs when a business or organisation is in breach of the Australian Privacy Principles (APPs) regarding the safety of personal data. The companys breach of APP 11 Security of Personal Information occurred because of the weak protection measures implemented to prevent disclosure, misuse, loss and unauthorised access of personal information. The theft of personal information can be considered a significant breach and thus, Latitude Financial Services have engaged in interference with privacy.
Any relevant exceptions to the application of the Australian Privacy Principles that would apply in this case.
The Australian Privacy Principles (APPs) apply to some small businesses, non-profit organisations and private health care practitioners who generate an annual turnover exceeding $3 million Australian dollars.
However, please note that this exception does not apply to contractors or other non-employee individuals who provide services to the organization; thus, these exceptions are not relevant to Latitude Financial Services. This is due to the fact that the personal information was not disclosed for legal, health or safety intentions. Furthermore, the customers would have rarely disclosed or allowed access to their personal information with consent.
Assuming that an interference with privacy did occur, what rights are of individuals affected by the breach, what the obligations of Latitude are following the breach, and what the role of the Australian Information Commissioner is with respect to the breach
Rights of individuals affected by the breach
Under the Notifiable Data Breaches (NBD) scheme and the Privacy Act 1988 (Cth), individuals whose personal information have been breached are entitled to a notification by Latitude Financial Services as this breach could result in a significant amount of harm. Changing passwords, applying more safety measures and observing for illegal access are all aspects that afflicted individuals are entitled to. Moreover, they have the ability to lodge a complaint with the Australian Information Commissioner (OAIC) about their breach of safety.
Your obligations following the breach
The obligations of a business after a breach is enforced under section 26 of the Privacy Act 1988 (Cth).
The obligations on the business are as follows: a definition of an eligible data breach must be disclosed to consumers and the public, under the Privacy Act 1988 (Cth) Section 26WE(2). In addition, there are requirements for notifying impacted individuals (section 26WL) and notifying the Commissioner (section 26 WK).
Under the Privacy Act 1988 (Cth), Latitude Financial Services has the right to notify the affected individuals and the OAIC in response to the breach of personal information. The company is obligated to include steps that individuals need to take after the breach has occurred and how the importance of changing their passwords.
Role of the Australian Information Commissioner
Under Privacy Act 1988 (Cth) the following sections cover the role of the Australian Information Commissioner. Section 40 outlines the ability of the commissioner to conduct an investigation. Section 41 covers when the Commissioner is empowered not to investigate. Section 52 follows when the Commissioner is empowered to make a determination. And finally section 30 of the act presents When the Commissioner may provide a report to the minister.
All these sections in the Privacy Act 1988 (Cth) address the actions the Commissioner contributes to breaches and how the Commissioner governs and enforces the protection and safety towards personal information. To account for the breaches made by Latitude their organisation must comply with the Australian Information Commissioner and provide facts relevant to the investigation.
OAIC has the legal responsibility to investigate the breach of personal information in Latitude Financial Services. They must ensure that Latitude has and will adhere to the APPs and the Privacy Act.
Findings & recommendations
Based on the above, we advise that it is likely you are most likely in breach of the Privacy Act 1988 (Cth) as you have breached APP 11, exposing Latitude customers personal information.
Latitude Financial Services Current Status
From here, we recommend that the obligation to contact Latitude customers who have potentially been exposed to the cyber incident and inform them of the next steps they must take.
In addition, we advise that Latitude Financial Services contact and notify the Australian Information Commissioner (OAIC) of the breach of personal information and data as soon as possible. As this is a legal obligation of the Privacy Act 1988 (Cth) as failure to do so can result in penalties and fines.
Without contacting OAIC, about the breaches and steps you are planning to take as a result this could amend customers' relationships and potentially hold your reputation as an entity.
Thank you for contacting us with this enquiry. Please do not hesitate to contact us if you have further questions about this matter.
Kind regards,
Cyber Risks Officer
BUSINESS LAW AND COMMERCIAL LAW:
PROFESSIONAL SKILLS ASSESSMENT TASK (ASSESSMENT 3)
SEMESTER 1, 2024
ASSESSMENT TASK TEMPLATE (REVISED 23 MARCH 2024)
INSTRUCTIONS
This template must be used for the completion of Assessment 3 and your assessment must be submitted in either .doc or .docx file format. Your Assessment 3 dropbox will not accept submission if your file is not in either of those file formats. Failure to have your file in the required format at submission time is not an excuse for late submission.
This template forms the basis of a memorandum, which is a common type of business document. This assessment task therefore requires you to place your legal knowledge and legal analysis into a common business document form. Keep in mind that (in accordance with your assessment instructions) you are writing this memorandum from the perspective of you occupying a specific business position, you are writing it to specific business people, and it is intended to fulfil a specific business purpose. Your memorandum should therefore not be written in an abstract way.
GENERATIVE AI DECLARATION
If you have used generative AI (ChatGPT any version is the only tool permitted), you must complete a generative AI declaration here. Please adapt the template text reproduced below. If you do not complete a generative AI declaration here, you are taken to declare that you did not use generative AI in any way in relation to the completion of this assessment task.
Generative AI declaration template text: I used <ADD AI tool> (<ADD link if needed>) to <ADD how used> (<ADD number> iterations/drafts). I modified the outputs in <ADD ways>.
ASSESSMENT 3 TEMPLATE
Your Assessment 3 template follows on the next page. Your word count includes everything that follows from the next page onwards. Your word count will be checked.
ENVERNO GROUP: INTERNAL MEMORANDUM
FROM: [Instructions to students: insert a fictional name and position here; do not use your real name in order to facilitate the anonymous marking of your assessment.]
TO: [Instructions to students: insert the name of your recipient group here.]
DATE: [Instructions to students: insert the memorandums hypothetical date here.]
REF: [Instructions to students: insert what would be an automatically generated internal reference identifier here, such as ENV20240052]
INTRODUCTION
[Instructions to students: provide a brief introduction to your memorandum here, identifying the nature of the request that has led to you preparing this memorandum, and a summary of your findings. You can use numbered paragraphs if you like, which should be consecutively numbered across the entire memorandum.]
LEGAL ANALYSIS
[Instructions to students: include your fully explained legal analysis, with reference to relevant sources of law, here. Reference to legislation should include the Acts name, and relevant sections/subsections. References to case law can include just the case name or a shortened version of the case name. You may include sub-headings if you like.]
CONCLUSION
[Instructions to students: provide your conclusion here, remembering that your memorandum is intended to provide legal information in a practical business context.]
Yours sincerely,
[Instructions to students: insert your name and a digital signature here.]
