The Law

The Privacy Act, including Notifiable Data Breach requirements, applies to private sector organisations with an annual turnover of $3 million or more, however there are certain types of businesses with less than $3 million in annual turnover that are not exempt from the Privacy Act. These include health service providers, businesses that hold tax file numbers and credit reporting bodies. Even though a cyber-attack may occur directly to their third party IT service provider, the responsibility for privacy data breach obligations may still rest with their customer due to:

• Technology providers contracting out of data breach/privacy obligations; and/or;

• Where more than one party is in a position to report a data breach (for example, both the IT service provider and their customer) the Office of the Australian Information Commissioner’s (“OAIC”) position is that the party closest to the end client (therefore, the customer) carries the notification obligations.

Scale of the problem

Third-party IT supply chain breaches are a significant concern in Australia. According to recent reports, 69% of large-scale breaches (affecting 5,000 or more Australians) were caused by cyber security incidents involving third-parties. Additionally, the OAIC has highlighted that the complexity and impact of data breaches are increasing due to the involvement of multiple parties, particularly cloud and software providers.

*Australian Government Annual Cyber Threat Report 2023 - 2024

Exposure Mitigation

To mitigate the cyber risk of third-party IT providers, organisations should consider implementation of the following in conjunction with their wider security programme and the advice received from their IT security adviser:

• Determine that your cyber insurance policy provides cover in the event a third-party IT service provider suffers a cyber-attack;
• Engage providers that have demonstrated robust security controls and appropriate personal information handling measures;
• Define the scope of the personal information handling services to be provided;
• Where possible, define contractual clauses on retention or destruction of data;
• Ensure contractual arrangements specify accountabilities in the event of data breaches that involve multiple parties, such as the responsible party for assessing harm, providing information and notifying the data breach (generally, the OAIC is of the view that the entity with the most direct relationship with individuals affected by the data breach should notify them);
• Ensure effective oversight of third-party providers.

Insurance Solution

Business Interruption causing Business Interruption Loss incurred during the Indemnity Period as a direct result of:

i. the total, partial or intermittent interruption or degradation in service of the Computer System operated by an Outsourced Service Provider, caused by a Security Breach or Administrative Error; or

ii. a Privacy Breach.

Incident Response Expenses incurred as a direct result of a Security Breach or Privacy Breach.