Author: Teamwsib

Get Ready – 2018 is set to be the year for mandatory reporting of data breaches

 

Until now, data breach reporting in Australia has been largely voluntary. While regulated entities have been legally obligated to take reasonable steps to maintain the security of personal information held, there has been no obligation to notify individuals if their personal information is compromised.

A lack of awareness of such breaches has hindered individuals from taking preventative action against crimes and identity theft by, for instance, cancelling credit cards or changing passwords. With incidents of identity theft and crime continuing to rise at an alarming rate, and stolen data—including PayPal and credit card account details and bank login credentials—being made available for sale on dark web marketplaces, data breach is now considered to be a widespread issue and seriously impacting individuals, businesses and government agencies.

Finally though, after many years of stops and starts, the Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth) passed the Senate on 13 February 2017 and received assent on 22 February 2018. The reforms amend the Privacy Act 1988 (Cth) (Privacy Act) to impose mandatory data breach notification on Australian Privacy Principle (APP) entities when there has been an eligible data breach. Failure to comply exposes entities to penalties, including fines of $360,000 for individuals and $1.8 million for organisations. We look at the changes the legislation introduces and the implications of these changes for APP entities.

 

APP entities

State government organisations, local councils and organisations with an annual turnover of less than $3 million are exempt from the Privacy Act. However, mandatory reporting applies to:

• Australian government agencies
• businesses and not-for-profit organisations with an annual turnover of more than $3 million
• private sector health services providers (including alternative medicine practices, gyms and weight loss clinics, which fall under this category)
• child care centres, private schools and private tertiary education institutions
• businesses that sell or purchase personal information along with credit reporting bodies
• some smaller organisations, such as those that handle health data, and
• individuals who handle personal information for a living, including those who handle credit reporting information, tax file numbers and health records.

 

Data breaches

Data breaches occur where there is:

• unauthorised access to, or unauthorised disclosure of, personal information about one or more individuals (affected individuals), or
• where personal information of affected individuals is lost in circumstances that may give rise to unauthorised access or unauthorised disclosure.
• Data breaches may be caused by malicious intentional actions, such as a serious cyber security incident, accidental loss, loss from negligence or loss from improper disclosure.

 

Eligible data breaches

• The mandatory reporting provisions apply where a reasonable person would conclude that there is a likely risk of serious harm to any affected individual as a result of the data breach.
• Serious harm in the context of the reporting requirements may include serious physical, psychological, emotional, economic, reputational and financial harm, as well as any other form of serious harm that the breach could cause to the affected person

 

Notification requirements

An APP entity that suspects or is aware of an eligible data breach must conduct a reasonable and expeditious assessment of the circumstances. Once a breach is determined, the APP entity must notify the Privacy Commissioner, other relevant regulators (such as APRA) and affected individuals as soon as possible. This assessment must take place within 30 days of becoming aware of the eligible breach.

The contents of the notification must include:

• identification and contact details of the entity
• a description of the serious data breach
• the kind/s of information conceived, and
• recommended steps that affected individuals should take in response to the serious data breach.

 

Outsourcing and third party service arrangements

An APP entity that discloses personal information to an overseas recipient will remain accountable for an offshore eligible data breach, even if the APP entity is not itself responsible for the offshore breach. The entity will be required to comply with the reporting requirements as if it was itself holding the information at the time of the eligible breach.

If more than one entity jointly and simultaneously holds the same particular record of personal information, an eligible data breach may give rise to each entity having reporting obligations. This means that in an outsourcing or shared services arrangement—where one entity may store personal information in an online platform provided by another entity—both entities are “holding” the information in line with the definition under s 6(i) of the Privacy Act and have mandatory reporting obligations.

 

Implications for APP entities

The reforms require an immediate review of privacy programs and protocols to accommodate the new requirements and ensure compliance with:

• identifying eligible data breaches
• the investigation process—it must be carried out and completed in the required time frame and all the required information collected
• the allocation of responsibility for investigations and the determination of the breach in terms of severity and reporting requirements
• briefing all outsourced and service providers to implement suitable oversight and required investigation processes when a breach takes place
• the review and possible modification of all service contracts to determine the right of the APP entity to audit compliance with the reforms
• the review of third party processing and storage arrangements to determine the waterfall effect and, in particular, the contracts that use offshore labour (i.e. call centres and claims centres) or where information is stored and held offshore, to determine if contract amendments are required, and
• identification of risks and documenting the processes for managing global companies, such as platform providers and cloud providers, who may share storage and therefore hold personal information on behalf the company.

Behind the scenes at icare

 

WSIB’s close relationship with icare has allowed us to obtain information and understand what’s happening behind the scenes. Here’s what you need to know about the claims and premium transitions underway.

Open claims

icare have advised us that CGU and QBE have been notified that the transition of claims has begun. Existing open claims with CGU and QBE will gradually transition to GIO and EML from August to December 2017. All relevant parties will be notified by email of the actual date of transfer. Existing open claims with EML, Allianz and GIO will be processed as usual.

New claims

Up until the 30^th September, employers with policies aligned with CGU or QBE will continue to lodge new claims with their respective claims service provider. From the 1^st October 2017, their new claims will be lodged with GIO.

After 1^st January 2018, all new claims across all service providers will be lodged with EML under the new claims service model.

If you are unsure about any of the above information or wish to learn more about the changes underway, please contact WSIB at our office on (02) 9587 3500.

Policy Management

WSIB have been advised that icare will now be taking on the processing of Actual Wages Adjustments for policies that expired after 29^th June 2017. The processing of Actual Wages Adjustments will begin from mid -September.

Through attending a Broker Information “Looped In” session with key staff members from icare, WSIB will have updates on the claims transition and policy management changes happening in NSW Workers Compensation Scheme.

Until then if you require any information relating to the changes in the NSW Workers Compensation Scheme, please contact WSIB at our office on (02) 9587 3500

Government ESL Backflip Creates Client Concern

 

The recent decision by the New South Wales State Government to reinstate the emergency services levy (ESL) continues to cause client concerns.

Since the recent decision, our National Insurance Industry Body has met with the New South Wales state treasurer Dominic Perrottet, who confirmed the decision to continue with the ESL on insurance policies and said the Government plans to introduce legislation later this month to reinstate the levy.

This decision is just four weeks away from when the previously proposed changes were due to take place and the Government’s backflip on the ESL has created a number of concerns in the business community.

The Insurance industry reacted with shock and disappointment to the news that the Government had decided against reducing taxes on insurance. With ESL, stamp duties and GST, more than 30% of household insurance premiums and 40% of commercial insurance property premiums go straight to the Government.

In the interim, while discussions continue to establish a firmer position, WSIB are keeping our clients informed on events as they unfold and will ensure you remain our first priority. However we expect a continuation of the current ESL arrangements until the Government makes specifics known in the near future.

What is WSIB Accident Assist?

 

We know how important your car is to you, and a car accident, no matter how minor, can be a stressful experience. However, WSIB is here to help you.

We’ve partnered with Indigo Vehicle Solutions to provide a value-added service called WSIB Accident Assist that means we are able to get you back on the road with minimal inconvenience.

HOW WSIB ACCIDENT ASSIST WORKS

Its simple. While your vehicle is being repaired, we’ll get you back on the road in a replacement vehicle.

If you are not at fault, our team will provide you with a similar vehicle for the duration of your vehicle repair.

If you are at fault, our team can provide a vehicle to you at a preferential rates, or if you have rental cover in your policy, Indigo can organise a vehicle subject to your policy entitlements.

To enable Indigo to recover the money, they will require your co-operation. Please ask for more information.

WHAT TO DO IF YOU’RE INVOLVED IN AN ACCIDENT

Simply call our Accident Assist Team on (02) 9587 3500. Your call will be answered by a trained professional who will take your details and commence the hiring of a vehicle process for you.

A helping hand when you need it most – Call our Accident Assist Team on (02) 9587 3500

Introducing – Saunders Safety & Training

 

Warren Saunders Insurance Brokers are very excited to announce the launch of our new National safety and training division Saunders Safety & Training (SS&T).

In keeping with our unparalleled expertise in the complex world of workers compensation we now also have WHS specialists who not only enjoy outstanding reputations within the WHS industry, but also share a passion for safety, injury prevention and a common desire to protect you and your business.

SS&T specialists are available to completely review your current WHS program and identify any gaps or risks and where necessary, enhance or redevelop your WHS systems and procedures to give you complete peace of mind over your risk management program.

Our workers compensation team will also work closely with our WHS specialists to analyse trends and performance across both areas. Outside of payroll, workers compensation premium can often be an employers most expensive cost. An investment in safety can reduce the long term financial burden of rising premiums due to the sensitive nature of premium formula.

That said, whilst management of your workers compensation program remains vitally important,
prevention is key to reduce work health & safety risk, and workers compensation premium.

Should you feel that you are an “at risk” employer, or would like a review of your current risk and safety program, please do not hesitate to contact our team on (02) 9958 9009 or email info@saunderssafety.com.au

Highest Fine Ever For A Single Offence Under OHS Laws Handed Down By A Victorian Court

Article by Laura Driscoll, Isabella Ledden, Colin Biggers & Paisley, 18 December 2016

 

In Brief – Employers Must Enforce Their Risk Management Systems.

A transport company has been fined $1 million after pleading guilty to breaching section 21 of the Victorian Occupational Health and Safety Act 2004 after it failed to maintain a safe system of work.

Stevedore crushed in horrific workplace incident in Port Melbourne

In May 2014, a stevedore worker was run over by a MAFI (a flat trailer used to carry shipping containers) on the deck of a ship at Webb Dock in Port Melbourne.

The incident occurred while the stevedore was positioning rubber mats for the MAFIs to rest on during transit up a ramp and onto the ship. A fully loaded MAFI can weigh up to 90 tonnes.

The MAFI crushed the worker, amputating his left leg, and causing other severe injuries. A forklift was used by colleagues to lift the MAFI off the worker. He later died at the scene. As stated by WorkSafe Victoria health and safety executive director Marnie Williams, the stevedore worker died “in the most horrible of circumstances…traumatising the people who tried to save him.”

System to manage serious risk in place, but procedures inadequate

Judge Cannon of the Melbourne County Court found that although the transport company had a system in place to manage the serious risks associated with loading and unloading its ships, the most critically inadequate procedure was enforcing a “second pair of eyes on deck”.

The company’s system required a stevedore to stand near the top of the ramp to watch for pedestrians and direct the “prime movers” who are pushing or pulling the MAFIs.

However, at the time of the incident there was no such stevedore performing these duties. As a result, the MAFI was pushed unknowingly towards the now deceased worker.

Stark reminder to all employers

It is not enough for employers to have an awareness of the risks that employees face, nor simply put systems in place to manage them.  Appropriate enforcement of such systems is essential.

If you would like a review of your safety procedures please contact Saunders Safety & Training.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.