Michael Keenan (Stirling, Liberal Party, Minister for Justice) Share this | Hansard source

I do thank the honourable members for their contributions to this debate, particularly the member for Isaacs and the member for Mayo.

The Privacy Amendment (Notifiable Data Breaches) Bill 2016 will amend the Privacy Act 1988 to introduce a mandatory data breach notification scheme. The purpose of the scheme is to ensure that individuals can take steps to protect themselves in the event that their personal information is compromised by any data breach. The bill implements the government's response to the Parliamentary Joint Committee on Intelligence and Security's February 2015 Advisory report on the Telecommunications (Interception and Access) Amendment (Data Retention) Bill 2014.

The bill creates a mandatory data breach notification scheme which applies to Australian government agencies and private sector organisations subject to the Privacy Act. These entities will be required to notify an individual whose personal information is subject to unauthorised access, unauthorised disclosure or loss, where a reasonable person would consider the individual is at likely risk of serious harm as a result.

The extensive consultation undertaken on this bill has ensured that it strikes an appropriate balance between effectively protected individuals whilst remaining workable for business. The bill complements the existing information security requirement in the Privacy Act, and will provide individuals with confidence that they will be notified in the event of a data breach which places them at likely risk of serious harm. In an environment where entities collect and use growing volumes of personal information in their business activities and where individuals enter into increasing numbers of online transactions, the bill is an important consumer protection measure to build on the strong privacy legislation protections already provided for within existing Australian privacy legislation.

Bill read a second time.

See this speech in context