Digital privacy

• the human factor in digital privacy; the impact and the cost
• what privacy means, our office’s role and some of the challenges we’re facing in the current environment, and
• how privacy is interlinked with cybersecurity. In other words, what do you need to know as our cyber leaders about keeping our personal information safe, and earning the trust of the people who share it with you?

• On behalf of the Australian Information Commissioner, Angelene Falk, Im very pleased to be able to contribute to this important summit on cybersecurity education.
• The education and skills development of the next generation of cybersecurity professionals is of great personal interest to the Commissioner and she acknowledges Professor Richard Bucklands considerable efforts in advancing that agenda.
• The theme of building a secure digital future goes to the heart of our offices vision, that is, increasing public trust and confidence in the protection of personal information.
• So today, Id like to talk about how everyone here has a crucial role to play in securing our digital privacy, both now and into the future.

The human factor

• In our data-driven economy, our personal information is an essential and valuable economic input.
• And its people who are behind the cyberattacks and who cause the human errors and some say even the system faults that result in data breaches.
• In the context of data breaches, its what we have been calling the human factor.
• While businesses reputations and finances may be affected, we cant ever forget that its people who suffer the ultimate consequences.

Impact of a data breach

• That is when there is unauthorised access or disclosure or loss of their personal information.
• The costs can be significant not just in time and money, but the emotional toll.
• One Queensland case thats been widely reported involved a womans personal information being accessed through a police database and leaked to her abusive former partner.
• This was a data breach that created great distress, significant safety fears and material harm to the individual involved, including the cost of relocating her family.

Impact on people

• It involves more than 60 individual tasks and its up to the consumer to perform almost 50 of these steps themselves.
• These include tasks like changing an email address, changing a phone number, changing log-ins, replacing identity documents, cancelling and replacing credit cards the list goes on.
• The impact of navigating the multiple organisations and tasks required to remedy the effect of the breach can be significant.
• The impact of a data breach can also be delayed, in ways that can exacerbate the harms experienced by the affected individuals.

Some statistics on the costs of data breaches

• According to an Attorney-General's department report in 2016 identity crime and misuse results in costs of $2.6 billion a year.
• This includes direct and indirect losses incurred by individuals and government agencies, the costs recorded by police and the costs of seeking to prevent and respond to identity crime.
• And the cost of a data breach to business is growing now an averageof $3 million per incident in Australia according to the latest Ponemon Institute Survey.
• Where businesses fail to take reasonable steps to protect personal information, significant regulatory costs or fines may also follow.

What is privacy?

• Not just as a legislative concept, but what it means to the individual.
• Privacy is a fundamental human right recognised in theUN Declaration ofHuman Rights.
• It can be anything from your name to your most sensitive medical records.

Privacy rights

• Australia’s Privacy Act1988 gives us rights including:
  • To know why our personal information is being collected, how it will be used and who it will be disclosed to
  • to ask for access to our personal information, and
  • for organisations to properly secure the information and to make sure it is accurate before using or disclosing it.

  
  Personal information is highly valuable — to you, and to the organisations and government agencies we deal with.

Securing personal information

• As the value of personal information to the economy and to innovation has grown rapidly over recent years, so has the volume of that information that is being held by organisations.
• People are moving more of their lives online and businesses of all sizes are collecting more and more information on individuals and aggregating it in data sets that give whole-of-life profiles of their customers.
• Its why we are working closely with the Australian Cyber Security Centre and other agencies to share information on the risks and how to guard against them.

Interface between privacy and cybersecurity

• We need to avoid treating them as separate or discrete domains that are managed by different sets of stakeholders in an organisation.
  • Privacy governs how personally identifiable information should be collected, used, shared and retained and be accessible to the person it is about.
  • Security restricts access to the sensitive data and protects it from unauthorised access during collection, storage and transmission.
  • But the interface between privacy and cybersecurity warrants further consideration.
  • In this way the two areas work hand in hand, each informed by the other.
  • This is creating long-term challenges to our ability to meet our privacy and cybersecurity obligations and the communitys expectations.

Notifiable data breaches

• However, on a brighter note, a key measure that is driving improvements to organisations cybersecurity is the mandatory Notifiable Data Breaches (or NDB) scheme, introduced just over 18 months ago.
• A primary goal of the NDB scheme is to give individuals early warning when their personal information has been compromised, so they can take action to prevent or minimize harm.
• Its now a legal requirement for organisations to carry out an assessment within a short period whenever there has been an actual or suspected data breach.

Assessing harm

• Assessing possible harm is an essential capability in your cybersecurity toolkit.
• But it can be more difficult to assess harm when contact details or health information is breached.
• Organisations entrusted with personal information may need to take a longer term approach to monitoring and responding to the risk of harm to affected individuals in these circumstances.

NDB Statistics 2018-19

• We now have more than a years worth of evidence about the nature of breaches reported to us under the NDB scheme and there are some important conclusions to be drawn for all professionals working with data management and security.
• Malicious or criminal attacks remain the predominant cause (62%).
• Of these, two-thirds were linked to common cyber threats such as phishing, malware, ransomware, brute-force attacks, compromised or stolen credentials and other forms of hacking.
• Whether its sending information to the wrong person or clicking on a phishing link, employees are centrally involved in many breaches.

Data breach prevention — best practice

• For us, best practice in preventing data breaches has five key components. They are:
  • Training your people in basic account and device security, strong password/passphrase use, and how to detect and report threats such as phishing. This should extend to data handling practices and how to report suspected privacy breaches
  • Having a comprehensive understanding of your data holdings, including personal information, and how a data breach could affect your customers, so you can quickly assess the impact when a breach occurs
  • Prioritising investment in preventative technologies and processes to strengthen the overall security posture of the organisation in line with known security risks
  • Thoroughly preparing and rehearsing different potential data breach scenarios so you can manage any incident that occurs and mitigate the impact, and
  • Putting the customer at the centre of your data breach response plan, being transparent and communicating clear facts and advice will help them navigate the situation — and help you restore trust.

  
  Now that the NDB scheme has established a clear baseline of evidence for organisations to act — we need cybersecurity experts to be our champions in helping make the case to boards and senior executives. Your role is critical in ensuring an organisation’s leaders and people are informed and take effective action to manage these risks. Because trust is an essential ingredient in the exchange of personal information.

Global privacy landscape

• At one time, the companys mantra was to Move Fast and Break Things clearly, that approach is not acceptable when it comes to privacy, to the community, government or regulators.
• Last month, our Commissioner and her counterpart in the UK brought together privacy and data protection regulators from the US, Europe, Canada and elsewhere to jointly put Facebook on notice over its proposed Libra cryptocurrency system.
• The Commissioners want assurances that Facebook is building in privacy protections from the ground up.
• This is just one example of how privacy regulators around the world are working together to align best practice and work towards interoperable privacy standards and enforcement, in an era when personal information has no national borders.

Looking to the future: cybersecurity education

• From our experience with the NDB scheme, and your own experience at the coalface, its clear that cybersecurity awareness is increasingly important.
• Its how we can try to manage the human factor and guard against the increasingly sophisticated cyber attacks we are seeing here and around the world.
• So how can the cybersecurity professional become fluent in the language of privacy?
• There are some core privacy considerations that should be part of the educational foundation for our next generation of cyber leaders.

The information lifecycle

• First, how to incorporate the information lifecycle in every aspect of online security.
• A basic principle is to only collect personal information that is essential to requirements, and to be prepared to give a full and detailed justification about why it is being collected, and for sensitive information, getting informed consent to collect it.
• Our experience is that cybersecurity professionals already give detailed attention to the safe and secure storage of personal information.
• But you also need to consider how to manage the personal information when its no longer needed.

Privacy by design

• Just like security by design, this means building privacy into the design specifications and architecture of new systems and processes.
• Its more effective and efficient to manage privacy risks proactively, rather than to retrospectively attempt to alter a product or service to address privacy issues that come to light.
• Privacy by design also involves making privacy the default setting in all the systems and processes you build.
• Individuals should not have to resort to self-help to protect their privacy; the default setting should be privacy preserving.

How people interact with technology

• As cyber experts you need to consider how people interact with technology, in order to anticipate the risks.
• We may be impatient to achieve a result online and fail to take due care, or assume a site is safe because it appears to be safe.
• We may take shortcuts such as using the same password for multiple sites.
• So understanding human behaviour and how to work with the human-technology interface has to be part of your core training.

Conclusion

• I think the rapidly evolving challenges are what makes it such an exciting time to work in our fields of data protection and cybersecurity.
• Cybersecurity professionals have never been in more demand, and your training and capabilities are essential to keeping our personal information secure.
• The upcoming Consumer Data Right gives consumers more choice and control over their personal information held by particular organisations.
• The Consumer Data Right offers great potential for business growth and innovation, provided consumers can have confidence in the way their data is handled.
• Were building in strong privacy safeguards to the system to help make that a reality.