A Concise Statement released by the Office of the Australian Information Commissioner (OAIC) this week provides important insights into the OAIC’s security expectations in relation to large companies with sensitive data sets. This is evidence that regulators are continuing to lift the bar for compliance in this increasingly important area, and is a reminder to APP entities to regularly check that sufficient security measures are in place, and to also follow up on consultants’ recommendations and monitor compliance. Medibank has not yet filed its response in the proceedings. The Court’s decision in this matter will provide important guidance as to the security steps necessary to comply with Australian Privacy Principle 11.1 and as to the penalties which organisations may face for non-compliance.
On 17 June 2024, the Australian Information Commissioner published a redacted version of the Concise Statement in connection with its civil penalty enforcement action in the Federal Court of Australia against Medibank under section 13G of the Privacy Act 1988 (Cth). The proceedings relate to alleged breaches of Australian Privacy Principle (APP) 11.1, which requires entities to take such steps as are reasonable in the circumstances to protect personal information from misuse, interference, loss and from unauthorised access, modification or disclosure.
The Commissioner alleges that Medibank failed to take reasonable steps to protect the personal information that it held. In Annexure B to the Concise Statement, the Commissioner sets out the steps that it says Medibank should have taken. The alleged deficiencies are set out in the fully redacted Annexure D of the Concise Statement.
The Concise Statement repays careful study for at least four reasons.
First, it tells us (subject to redactions) exactly what is alleged to have gone wrong and what the Commissioner alleges happened to give rise to a data breach affecting 9.7 million Australians.
According to the Concise Statement, an employee of a contractor to Medibank has access to an administrator level account. This account had access to most, if not all, of Medibank’s systems. The credentials to the account were stolen from the person’s “personal computer” using malware.
Medibank allegedly did not use multi-factor authentication.
The “threat actor” was able to log into Medibank’s VPN with the stolen credentials and exfiltrate 520 gigabytes of data, including personal and sensitive information.
Medibank allegedly did not react to various automated alerts triggered by the threat actor’s activity until a “highly sensitive incident” was noticed on 11 October 2022, more than two months after the credentials were stolen.
Second, and perhaps more importantly, the Concise Statement tells us what the Commissioner thinks Medibank should have done. This is a helpful list of OAIC expectations for APP entities which hold large amounts of sensitive information. It is not of course a comprehensive one, as it presumably is confined to the particular steps which are relevant to the proceedings.
The Concise Statement confirms the approach foreshadowed in the Australian Privacy Principles Guidelines (the Guidelines) and the Guide to Securing Personal Information (the Guide) of taking into account the size of the APP entity and the sensitivity of the personal information involved when determining what steps are “reasonable” in the circumstances. The Concise Statement alleges that Medibank’s size and the sensitivity of the affected personal information (which included health information and information about individuals’ race or ethnicity) are relevant to determination of what “reasonable steps” were required. Those matters were also relied upon by the Commissioner in support of the alleged interferences with privacy being “serious”.
In Annexure B the Commissioner alleges that Medibank should have implemented all or some combination of the following 11 things:
The above list highlights the standards to which the Commissioner seeks to hold large companies when it comes to security and authentication practices – but there are pointers here for all organisations, large and small.
It is significant that the Commissioner has called out monitoring the activities of contractors. The Guidelines, the Guide and past determinations make it clear that it is necessary to have appropriate privacy and security terms in place with contractors to comply with APP 11.1. The Concise Statement makes it clear that it is necessary in the Commissioner’s view to also regularly audit, inspect or test contractor compliance with those terms and with expected security practices.
The Concise Statement’s focus on contractual terms is also a good reminder that (without speculating as to what Medibank did), it is best practice to regularly review longstanding information technology and other contracts affecting data security to make sure they meet contemporary security standards.
Clearly, companies should have regard to the Commissioner’s above statements about what should have been done when reviewing their own cybersecurity policies and practices.
Third, the Concise Statement provides guidance as to the OAIC’s construction of “interference with privacy” for the purpose of applying section 13G which is the civil penalty provision to alleged breaches of APP 11.1. Under the Privacy Act at the relevant time, each “interference” potentially attracts a maximum penalty of A$2.2 million.
The Commissioner claims that the alleged contraventions were “serious” because of:
These points are significant because “serious” or “repeated” interferences with privacy trigger the civil penalties under section 13G of the Privacy Act.
The Commissioner puts forward a total of four different approaches to construction of section 13G, and the Court’s choice of approach could affect the maximum penalty by reference to a multiplier of many millions. The Commissioner’s preferred approach is to count the number of interferences by reference to the number of people affected by the relevant acts or omissions (of whom there are alleged to be 9.7 million), with the result that the maximum penalties are extremely large (A$21,340,000,000,000). Further to that at the high end of the scale, the Commissioner alleges that a further multiplier of the number of days in the Relevant Period should also be applied (the above figure multiplied by hundreds of days). At the lower end of the scale, the Commissioner alleges in the alternative that there was a contravention of section 13G and that, further, that contravention was repeated for each day in the Relevant Period.
The Court’s decision as to which of the approaches proffered in the Concise Statement (together with any further contentions by Medibank in relation to the construction of section 13G) is correct and will have a significant impact on the extent of the total risk faced by companies under section 13G as it then stood, and under the revised civil penalty provisions which commenced in late 2022. The numbers reached by multiplying the penalties by reference to the number of individuals affected would be crippling for even the largest of companies – although assessment of civil penalties is not merely an arithmetical exercise.
By way of comparison, in the Commonwealth Bank AUSTRAC enforcement proceedings some 53,000 contraventions caused by a single coding error led to a penalty of A$150 million, with A$700 million being imposed for the totality of the conduct.
Of course, we should note that the penalties under section 13G have been increased from December 2022 to a maximum penalty at least A$50 million per contravention (or possibly more based on turnover or the benefit derived), so for an (alleged) 9.7 million serious interferences the headline number is a staggering A$485 trillion. If the Commissioner’s “per person, per day” formulation is successful, the potential penalty is, obviously, even greater, potentially multiplied by the number of days in the relevant period.
Theoretical calculations aside, the Commissioner’s approach underscores the clear potential for significant penalties for data breaches, given that many data breaches involve the personal information of a large number of people and many go undiscovered for a significant period.
Fourth, the Concise Statement highlights the importance of not only regularly assessing cybersecurity measures, but also following through on the recommendations made by consultants who conduct the assessments. The Commissioner alleges that during the Relevant Period, Medibank engaged external consultants to assess its security practices, and that Medibank did not take sufficient steps to address issues identified in those reports. Of course obtaining external consultants’ views is good practice. The approach taken in the Concise Statement underlines how important it is to follow through on reports and their recommendations. We have not yet heard Medibank’s explanation of what (if anything) it did do in response to the reports, and as to any practical or other obstacles which impeded its response to them.
In light of the Concise Statement (and without speculating as to what Medibank did or did not do), it is prudent for APP entities facing any reports on security which they may face challenges in addressing to obtain not only technical guidance but also legal advice so that senior management can fully understand all of the relevant risks when making resourcing and investment decisions. Engaging the legal team also has the advantage, if done properly, of creating a privileged environment in which legal risks can be openly discussed (although of course there are exceptions to the protection afforded by client legal privilege – they are limited).
Obviously, the Medibank enforcement proceeding is at an early stage and at this point the allegations made by the Commissioner are just that – allegations. Medibank will have an opportunity to file its defence and deny the allegations and at trial (should the matter proceed that far) there will no doubt be much evidence provided and many submissions made about the applicable legal principles, and about other matters including the positive steps which Medibank did take to protect data.
As it develops, this matter will, like the Concise Statement, repay careful study by all those with an interest in cybersecurity. Which should be everyone.
This week marks a significant development in Australia’s privacy law reform process, which is likely to result in some changes becoming law before the next federal election.
The past year has undoubtedly been challenging for companies in the lithium, rare earth and critical minerals sectors. To provide some context, lithium carbonate, lithium hydroxide and spodumene...
Recent cases have highlighted whether an ASX-listed entity must make a market disclosure to the ASX if it receives a confidential compulsory investigation notice under section 155 of the...