This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.
You can find the current article at its original source at https://www.theguardian.com/australia-news/2018/may/03/commonwealth-bank-information-watchdog-dropped-the-ball-over-huge-data-loss
The article has changed 5 times. There is an RSS feed of changes available.
| Version 2 | Version 3 |
|---|---|
| Commonwealth Bank: information watchdog 'dropped the ball' over huge data loss | Commonwealth Bank: information watchdog 'dropped the ball' over huge data loss |
| (21 days later) | |
| Australia’s information commissioner has “dropped the ball” by not reacting to the loss of data from 19m Commonwealth Bank customer accounts privacy campaigners have said. | Australia’s information commissioner has “dropped the ball” by not reacting to the loss of data from 19m Commonwealth Bank customer accounts privacy campaigners have said. |
| Kat Lane, the vice chair of the Australian Privacy Foundation, has criticised the Office of the Australian Information Commissioner (OAIC) after it failed to tell customers of CBA that their personal account information had been misplaced. | Kat Lane, the vice chair of the Australian Privacy Foundation, has criticised the Office of the Australian Information Commissioner (OAIC) after it failed to tell customers of CBA that their personal account information had been misplaced. |
| “They’re the commissioner that’s supposed to put privacy and control of personal information at the forefront, and everybody’s entitled to know if their personal information is possibly leaked somewhere,” Lane said. | “They’re the commissioner that’s supposed to put privacy and control of personal information at the forefront, and everybody’s entitled to know if their personal information is possibly leaked somewhere,” Lane said. |
| Sign up to receive the top stories in Australia every day at noon | Sign up to receive the top stories in Australia every day at noon |
| “They could have easily disclosed and given details about the risk, and that would have been the mature thing to do, because people could then say ‘OK, the risk is low, but we are entitled to know’. | “They could have easily disclosed and given details about the risk, and that would have been the mature thing to do, because people could then say ‘OK, the risk is low, but we are entitled to know’. |
| “It’s unclear to me how the bank and two regulators came to the view that we weren’t entitled to know. They dropped the ball,” she said. | “It’s unclear to me how the bank and two regulators came to the view that we weren’t entitled to know. They dropped the ball,” she said. |
| The Commonwealth Bank is in damage control after admitting it may have lost control of data – including customer names, addresses, account numbers and transaction details – of almost 19 million customer accounts, covering a period from 2000 to early 2016, and that it never told its customers. | The Commonwealth Bank is in damage control after admitting it may have lost control of data – including customer names, addresses, account numbers and transaction details – of almost 19 million customer accounts, covering a period from 2000 to early 2016, and that it never told its customers. |
| BuzzFeed Australia broke the news on Wednesday evening, reporting the bank had lost control of the data sometime in 2016. | BuzzFeed Australia broke the news on Wednesday evening, reporting the bank had lost control of the data sometime in 2016. |
| The CBA admitted once it discovered the historical customer statements – which were stored on two magnetic tapes – may have gone missing, it began an internal investigation but nothing was found. It eventually determined the data had likely been destroyed, as it had been planning to do. | The CBA admitted once it discovered the historical customer statements – which were stored on two magnetic tapes – may have gone missing, it began an internal investigation but nothing was found. It eventually determined the data had likely been destroyed, as it had been planning to do. |
| Banking royal commission: Coalition reveals one-stop shop for financial complaints | Banking royal commission: Coalition reveals one-stop shop for financial complaints |
| The CBA told the Office of the Australian Information Commissioner (OAIC) at the time, as well as the Australian Prudential Regulation Authority. | The CBA told the Office of the Australian Information Commissioner (OAIC) at the time, as well as the Australian Prudential Regulation Authority. |
| OAIC said it was satisfied the data had likely been destroyed and it did not pursue regulatory action. But it did not inform the public of the breach, either. | OAIC said it was satisfied the data had likely been destroyed and it did not pursue regulatory action. But it did not inform the public of the breach, either. |
| Lane said the OAIC was under no obligation to tell the public about the possible data breach and that was the problem. | Lane said the OAIC was under no obligation to tell the public about the possible data breach and that was the problem. |
| “This is the thing that needs to change,” she said. “We’ve only just taken the first step of getting data breach notification laws in, but we haven’t even made the step of acknowledging that people’s personal information is extremely valuable, and we should be acknowledging that given the Facebook scandal. | “This is the thing that needs to change,” she said. “We’ve only just taken the first step of getting data breach notification laws in, but we haven’t even made the step of acknowledging that people’s personal information is extremely valuable, and we should be acknowledging that given the Facebook scandal. |
| “Our data is incredibly valuable and we should be able to seek compensation. These businesses that hold our personal information should be incentivised heavily by penalties to keep our data confidential. | “Our data is incredibly valuable and we should be able to seek compensation. These businesses that hold our personal information should be incentivised heavily by penalties to keep our data confidential. |
| “Obviously there’s a major failure here, and the data breach notification laws haven’t gone nearly far enough to resolve those failures.” | “Obviously there’s a major failure here, and the data breach notification laws haven’t gone nearly far enough to resolve those failures.” |
| The OAIC has been contacted for comment. | The OAIC has been contacted for comment. |
| A recent history of Australia's banking scandals | A recent history of Australia's banking scandals |
| The Turnbull government introduced the Notifiable Data Breaches (NDB) scheme on 22 February 2018, which requires entities subject to the Privacy Act 1988 – including most Australian government agencies, businesses with an annual turnover of more than $3m, and specific categories of smaller businesses, such as health providers – to notify individuals if their personal data has been involved in a serious breach that is likely to result in “serious harm”. | The Turnbull government introduced the Notifiable Data Breaches (NDB) scheme on 22 February 2018, which requires entities subject to the Privacy Act 1988 – including most Australian government agencies, businesses with an annual turnover of more than $3m, and specific categories of smaller businesses, such as health providers – to notify individuals if their personal data has been involved in a serious breach that is likely to result in “serious harm”. |
| Under the scheme individuals may be fined up to $420,000 for non-compliance, and corporations up to $2.1m. | Under the scheme individuals may be fined up to $420,000 for non-compliance, and corporations up to $2.1m. |
| The 2017 Australian Community Attitudes to Privacy Survey found 94% of Australians believed they should be told if a business loses their personal information. | The 2017 Australian Community Attitudes to Privacy Survey found 94% of Australians believed they should be told if a business loses their personal information. |
| Christian Porter, the attorney general, only found out about the data breach on Tuesday evening. | Christian Porter, the attorney general, only found out about the data breach on Tuesday evening. |
| He has requested a detailed briefing on the issue from the privacy commissioner, including actions taken by OAIC and CBA as a result of the data loss. | He has requested a detailed briefing on the issue from the privacy commissioner, including actions taken by OAIC and CBA as a result of the data loss. |
| “The acting Privacy Commissioner has indicated she is making further inquiries to ensure CBA has taken action subsequent to the 2016 incident to ensure the privacy of customers’ personal information is protected. That is an appropriate course of action,” Porter said in a statement. | “The acting Privacy Commissioner has indicated she is making further inquiries to ensure CBA has taken action subsequent to the 2016 incident to ensure the privacy of customers’ personal information is protected. That is an appropriate course of action,” Porter said in a statement. |
| “This incident occurred before the Coalition’s mandatory reporting requirements for data breaches took effect in February this year.” | “This incident occurred before the Coalition’s mandatory reporting requirements for data breaches took effect in February this year.” |
| Banking | Banking |
| Banking | Banking |
| Business (Australia) | Business (Australia) |
| Commonwealth Bank | Commonwealth Bank |
| news | news |
| Share on Facebook | Share on Facebook |
| Share on Twitter | Share on Twitter |
| Share via Email | Share via Email |
| Share on LinkedIn | Share on LinkedIn |
| Share on Pinterest | Share on Pinterest |
| Share on WhatsApp | Share on WhatsApp |
| Share on Messenger | Share on Messenger |
| Reuse this content | Reuse this content |