A volunteer emails the donor list to the wrong address. A laptop goes missing from a car. Someone’s password is guessed. Every charity that holds personal information will have a day like this sooner or later. What matters is what happens in the first few hours.
What is a notifiable privacy breach?
The Privacy Commissioner defines it as a breach where personal information your charity holds is accessed, disclosed, altered, lost or destroyed without authorisation, and it’s reasonable to believe an affected person has suffered, or is likely to suffer, serious harm.
The Commissioner’s examples of serious harm are physical harm or intimidation, financial fraud, family violence, and psychological or emotional harm. If your records include addresses, health details or children’s information, take the harm test seriously.
Who to tell, and by when
You must tell the Privacy Commissioner as soon as practicable after anyone in your charity identifies that the breach meets the test. The Commissioner’s expectation is within 72 hours of you becoming aware that the breach is notifiable. It is a guide, not a legal deadline, but treat it as the target.
Three things about the 72 hours are easy to miss:
- The clock starts when you know it’s notifiable. That means you have some knowledge, or have made an assessment, that harm is likely. It does not start when the breach happened.
- It can start before the right person hears. What any employee or agent of the charity knows counts as the charity’s knowledge. So staff and volunteers need to report a problem straight away.
- You don’t need all the facts. Tell the Commissioner what you know now, and send updates as you learn more. If you’re unsure whether to notify, the Commissioner’s advice is to notify.
You also have to tell the people affected. The Commissioner’s page points to section 117 of the Privacy Act for what that notice must include.
The Commissioner has an online tool, NotifyUs, that helps you assess how serious a breach is and can be used to make the notification.
The order I would work in
This order is my suggestion, not an official list.
- Stop it spreading. Change the password, remove the access, recall the email, lock the device.
- Write down what you know. What happened, when you found out, whose information is involved and roughly how many people. Keep adding to it.
- Work out the harm. What could someone do with this information? Use the Commissioner’s examples above.
- Tell the Commissioner if the test is met, or if you’re unsure.
- Tell the people affected, plainly, and say what you’re doing about it.
- Fix the cause, and write down what changed.
What to have ready before it happens
- One person who decides. Everyone else knows who to tell, and that they should tell them at once.
- A short written checklist, like the one above, kept somewhere people can find it on a bad day.
- A record of who accessed what. A system that keeps a record of changes and views makes the first question, “what was touched?”, quick to answer. A shared spreadsheet usually can’t.
- Your suppliers’ promises in writing. If the breach happens at a supplier that holds your information, you are usually the one with the duty to tell the Commissioner and the people affected, so you need the supplier to tell you fast. That’s why I ask for a timeframe in writing from Zoho and any other provider.
Sources
- The Privacy Commissioner’s pages on what a notifiable privacy breach is and how long 72 hours is