Privacy act draft proposes a maximum penalty of the greater of $50 million, three times the value of any benefit obtained through the misuse of information stolen in data breaches, or 30% of the company's annual domestic turnover.
Data Protection
Certain types of personal data are very valuable to criminals, and can be very damaging to an individual or business if it falls into the wrong hands. As the world becomes more digital and more connected, more of this sort of data is generated and passed between various sources on a regular basis.
Government regulations and supervisory authorities aren’t just about keeping irresponsible parties in line. They also provide vital security guidance to every type of organization that handles sensitive personal, business or government information.
Data protection regulations also ensure that the end user has a transparent view of and a say in the processing of personal data. These safeguards play a significant role in everything from the preservation of civil rights to ensuring that democratic institutions function properly.
Some types of personal data are clear candidates for regulation: medical records, banking information, national ID numbers and so on. But some of these regulations also cover items that might seem relatively innocuous at first glance: home addresses, email addresses, website profile information and so on. For example, the European Union General Data Protection Regulation (GDPR) has stipulations about anything that is unique to an individual to include phone numbers and social media accounts. People have varying levels of privacy preference with these items, but they are often protected by regulation because they can be used for targeted scams and attempts at identity theft.
Given that regulations often take the size and customer count of businesses into consideration in terms of penalties and the scope of protection of personal data, compliance is particularly important for enterprise-scale organizations. You do not necessarily have to have an active business presence in a country or region; simply storing data on or moving it through servers there may subject you to their data protection rules.
The cyber attack stemmed from a phishing email and impacted some 113,000 people. The government supplier was also faulted for not following up on an antivirus alert as well as having outdated systems and inadequate staff training in place.
The suit represents millions of Texas residents that have used Google services since 2015. The state requires that consent be collected from biometric data subjects to use their faces or voices.
External DPO service providers, whilst offering valuable benefits to the organisation, are not a one stop shop for privacy and data protection compliance. Companies must still maintain robust data protection policies, promote good data protection practices and generally uphold the data protection principles.
The crux of the privacy objections is that the executive order does not guarantee that indiscriminate collection will be stopped; it merely attempts to narrow the scope of intelligence activity in EU-US data transfers.
The EU privacy watchdog opened 2022 with an order to Europol to delete stored data on persons not connected to or involved with a crime. But a mid-2022 reform of Europol's governing regulations retroactively legalized this data practice.
The breach of Optus, the second-largest telecoms company in Australia, created a leak of about 10 million records of personal information. The government says that it is time for new privacy rules.
An Indonesia data protection law that has been in development since 2016 includes some of the harshest penalties yet seen in national data privacy regulations, along with a right to compensation for data breaches.
Organizations must elevate their data management and privacy regulations to adhere to governance policies, which will align with privacy laws. This will enable the proper management and storage of personal data and avoid some of the ongoing privacy issues faced today.
GDPR was introduced in 2018 and has significantly impacted privacy, transparency, and business accountability. What could have been done better, and what’s next?