Mandatory data breach notification laws have been passed by the NSW legislature’s two chambers. These laws will affect state agencies and departments, statutory bodies, local councils, and some institutions.
After passing the lower house the day before, the Privacy and Personal Information Protection Amendment Bill was approved by the upper house on Wednesday.
The status of the bill is currently “awaiting consent.” After assent, it will take effect one year later.
State Labor “has been calling for these changes for quite some time,” according to Penny Sharpe, the head of the opposition in the Legislative Council.
“I would like to state at the outset that we do not oppose the bill and that we are delighted that the administration has finally presented a proposal before the House to address this significant issue,”
Several sensitive pieces of personal, health, and financial data about NSW residents are held by public sector organisations in NSW.
The Privacy and Personal Information Protection Act does not currently require public sector organisations in NSW to notify data breaches involving personal and health information. I must admit that really shocks me.
Abigail Boyd, a Greens MP, referred to the amendments as “far overdue.”
“The bill does nothing to protect our information from being stolen. It just sets a requirement on State-owned companies and public sector organisations to notify those affected by a breach of data held by those companies or organisations, she explained.
Since the requirement does not currently exist, it is astounding that any legislation is necessary to create it.
The issue of digital rights and privacy, as well as regulation and responsible technology use, will only become more essential, Boyd continued.
The Greens support this bill because it is a modest but constructive step in the right direction.
