Data Breach Policy

1 Purpose

The purpose of this policy is to provide an overview of the Department of Communities and Justice’s (DCJ) procedures in relation to containing, assessing, managing, notifying and reporting on eligible data breaches in accordance with the Mandatory Notification of Data Breach Scheme (the MNDB Scheme) (as established within the Privacy and Personal Information Protection Act 1998 (NSW)).  

This policy complies with section 59ZD of the Privacy and Personal Information Protection Act 1998 (NSW).

Employees should consult the DCJ Data Breach Response Plan for detailed guidance on how to respond to a data breach.

The DCJ Data Breach Response Plan is available on the intranet and outlines specific procedures to follow in the event of a data breach.  DCJ takes privacy seriously and requires all employees to complete three mandatory e-learning modules:

1. Privacy and You
2. DCJ Cyber Security Awareness Essentials
3. Mandatory Notification of Data Breach scheme

Approved users are encouraged to complete annual training in the areas of privacy, cyber security and the NSW data breach notification requirements.

2 Definitions

3 Scope

All DCJ Approved Users must comply with this policy, including:

• all DCJ permanent full time, part time, volunteer, trainee and temporary employees and personnel authorised to access DCJ information systems and assets
• any consultants and persons or organisations authorised to administer, develop, manage and support DCJ Information systems and assets
• third party suppliers, vendors and hosted/managed service providers.

4 Policy statement

The MNDB Scheme (as contained in section 6A of the Privacy and Personal Information Protection Act 1998) commenced on 28 November 2023, requiring all public sector agencies, including DCJ, to take various steps in relation to assessing, containing, managing, notifying and reporting on eligible data breaches.

This policy provides a framework for DCJ’s compliance with the MNDB scheme.

4.1 Data breach

A data breach occurs when personal information, including health information, held by DCJ is lost or subject to unauthorised access or unauthorised disclosure.

A data breach can be accidental or intentional and may arise as a consequence of a cyber-attack, inadvertent disclosure, over-provisioning of access to sensitive systems, or as a result of loss or theft of a physical device.

Types of data breaches include:

• loss or theft of a device containing DCJ information, for example a loss of a USB stick or a case file
• a DCJ database or information repository being compromised or accessed without authorisation, for example the sharing of user login details with a third party, hacking or malware infection
• a DCJ employee or contractor mistakenly providing personal information to an unauthorised person or entity, for example by sending an email containing personal information to the wrong recipient.

A data breach will be considered an ‘eligible data breach’ if the breach is likely to result in serious harm to affected individuals.

Serious harm occurs where the harm arising from the eligible data breach has, or may, result in a real and substantial detrimental effect on an individual. Harm to an individual includes physical, economic, financial, social, emotional, psychological or reputational harm.

Assessment of the likelihood of serious harm arising from a data breach is an objective test. The phrase ‘likely to result’ means that the risk of serious harm to an individual is more probable than not, rather than merely possible.

The NSW Privacy Commissioner’s statutory guidelines will be considered by DCJ in its assessment of all data breaches impacting DCJ.

If a breach is assessed as ‘eligible’, the NSW Privacy Commissioner must be notified. Affected individuals must also be notified unless a relevant exemption applies.

All data breaches are different and should be assessed for notification eligibility on a case-by-case basis.  

4.2 Data Breach Response Plan

The Open Government, Information and Privacy Unit (OGIP) has established a robust Data Breach Response Plan (the Plan) enabling DCJ to respond to data breaches efficiently and expediently. The Plan details the steps and procedures Approved Users are required to take in the event of a data breach. Approved Users are expected to familiarise themselves with this Plan and the associated requirements. 

4.3 Response and management strategy

All Approved Users are required to complete mandatory online data breach training to ensure they have sufficient understanding of what constitutes a data breach and what is required of them when a data breach is identified. This training encourages Approved Users to remain vigilant and enables them to easily identify suspected data breaches and respond accordingly. 

Approved Users are also required to complete mandatory privacy training and cyber security training to raise awareness and understanding of DCJ’s obligations.

All DCJ contractors are subject to privacy obligations, including requirements to handle data breaches in accordance with the Privacy and Personal Information Protection Act 1998 and to immediately notify DCJ of any data breach or any alleged instance of a data breach involving the inadvertent or malicious loss, disclosure or corruption of DCJ information.

DCJ proactively identifies data breaches that may impact DCJ information by actively auditing and monitoring:

• public domains (monitored by Information and Digital Services)
• compliance with contractual obligations by third party suppliers, vendors and hosted/managed service providers (to be monitored by contract managers and business units responsible for engagement of the service provider/s)

If a data breach occurs, Approved Users are immediately required to take all reasonable steps to prevent any further loss or compromise of personal and or health information, and minimise any potential harm to affected individuals.

DCJ business units are required to make an initial assessment as to whether there are reasonable grounds to suspect that the breach is an Eligible Data Breach. If a reasonable suspicion of eligibility arises, the breach must be reported immediately to OGIP using the Reporting Template in the Data Breach Response Plan. All data breaches must be reported to OGIP within seven days of identification and will be triaged and formally assessed under the MNDB scheme.

If members of the community wish to report a data breach impacting DCJ data or systems, they can email databreach@dcj.nsw.gov.au..

4.4 Eligible Data Breaches

Once a suspected eligible data breach is identified, OGIP will establish a Data Breach Response Team (the Response Team). The Response Team will consist of:

• Director, OGIP
• Principal Solicitor/ Manager, Open Government, Information and Privacy Unit
• CISO, Information and Digital Services (only where a cyber security incident has occurred)
• business unit representative (Director or above) of the business unit where the breach originated
• any other person the Response Team nominates, for example a representative from the Communications Unit.

The Response Team will conduct a thorough assessment of the suspected eligible data breach, and consider the following:

• the underlying cause
• the risk of serious harm to affected individuals and recommended steps to mitigate the risk of serious harm (taking into account the type and sensitivity of the compromised data)  
• advice regarding the requirement to notify affected individuals and if so, the manner of any such notification
• advice to the Secretary or their delegate as to whether the Privacy Commissioner is required to notified of the breach.
• where applicable and depending on the nature and severity of the breach, notify external assistance authorities/bodies, for example:
  • Cyber Security NSW
  • iCare
  • IDCARE
  • ID Support
  • Privacy Commissioner
  • Law enforcement agencies
  • Other agencies affected by the data breach.

If the breach is assessed as eligible, the relevant Business Unit, on the advice of the Response Team, will use the templates in the Data Breach Response Plan to notify the Privacy Commissioner and affected individuals where required.

Once the incident response is finalised and notifications complete, the relevant Business Unit will be responsible for conducting a Post Incident Review and completing a Post Incident Review report which must be sent to the Response Team for input before finalisation and reporting to the Secretary or their delegate.

OGIP will maintain an internal register of all eligible data breaches impacting DCJ.  

OGIP will also maintain a public notification register on the DCJ website. This will be used to provide public notifications of eligible data breaches where DCJ is unable to notify, or it is not reasonably practicable to notify, affected individuals.

For further instructions on internal and external reporting requirements and procedures, please consult the Data Breach Response Plan.