Experts say that Australia’s data management and privacy laws must be improved to make public agencies and companies more accountable.
According to Mamoun Alazab, Associate Professor of Charles Darwin University, the recent breach of Optus systems, which has been said to have affected more than 40% of Australians, has illustrated the shortcomings in reporting and accountability for cyber-attacks.
“Australia’s Notifiable Data Breach (NDB) scheme that was introduced in 2018 was not adequate in helping protect individuals who had their personal data stolen.” says Alazab
“The burden of proof of harm is on the individual who had their data stolen. The laws need to be strengthened to make businesses more responsible and accountable,” Associate Professor Alazab said.
“It was only a matter of time before we experienced an attack of this size, and it exposed the problems with responsibility and accountability in the cybersecurity space. Only victims of a data breach are responsible for dealing with the consequences.” he said
Associate Professor Alazab said cybersecurity experts at CDU had been warning about the lack of transparency for years.
CDU Lecturer in Law Dr Jenny Ng, from the Asia Pacific College of Business and Law, said the NDB scheme makes it mandatory for a regulated entity to inform the Office of the Australian Information Commissioner and the affected individuals of a serious data breach.
“However, it remains difficult for the victims of data breaches to establish a successful cause of action in court mainly due to the lack of a specific cause of action under Australian law that would allow a person to bring an action for a breach of privacy,” says Dr Ng
An article in the Future Generation Computer Systems journal last year, co-authored by Associate Professor Alazab, Dr Ng and Dr Seung Hun Hong from the Korea Institute of Public Administration, identified the regulatory gaps in cyber-attack reporting.
“There have been numerous cases in corporate Australia of poor data management and breaches reported under the NDB scheme.” says Associate Professor Alazab
According to Alazab comprehensive monitoring and policing are necessary to address the growing number and sophistication of cyber threats.
“This will not be the last time that Australia’s corporate world will have to face such a large data breach, and it will be judged by its response to it.” he said
In October 2019, Optus mistakenly released 50,000 private mobile phone numbers in the White Pages.
