The Queensland government has introduced a bill aimed at establishing a mandatory data breach notification system.
The move to implement this scheme comes approximately 15 months after it was recommended by the Coaldrake review, which assessed the culture and accountability within the Queensland government.
By implementing this scheme, Queensland is set to become the second state, alongside New South Wales, to introduce such a data breach notification system.
Attorney-General Yvette D’Ath emphasized the importance of this initiative, stating, “Recent high-profile data breaches demonstrate that the loss or unauthorized access to personal information can potentially lead to significant harm to individuals. That’s why we are establishing this scheme, ensuring that there are clear and consistent requirements for notifying individuals in the event of data breaches involving Queensland government agencies. This empowers individuals to take necessary steps to mitigate the risks associated with data breaches.”
Under this scheme, if a Queensland government agency suspects it has experienced a data breach, it is required to take reasonable containment measures. Typically, the agency has up to 30 days to assess the incident, with the possibility of extending this assessment period through written notice. Certain exemptions, outlined in Division 3, exist for not issuing notifications. These include situations where notification could compromise or worsen the agency’s cybersecurity or lead to further data breaches.
Additionally, agencies will be obliged to maintain a breach register and publish a data breach policy.
A survey conducted in June revealed that Queensland agencies needed to make more preparations for the scheme’s introduction.
The legislation pertaining to this scheme also seeks to align Queensland’s privacy principles with the Australian Privacy Principles, serving as a foundation for potential future reforms in accordance with any federal legislation resulting from the Commonwealth government’s review of the Privacy Act.