Remedial action
Determine if the breach is still occurring. If so, the appropriate steps should be taken immediately to stop and minimise the effect of the breach. Establish whether there is anything that can be done to recover losses and limit the damage the breach can cause.
Where possible, promptly take steps to reduce any potential harm to individuals. This might involve taking action to recover lost information before it is accessed or changing access controls on compromised stakeholder accounts before unauthorised transactions can occur. It may also involve any compromised security credentials being revoked, and the Information and Communication Technology (ICT) systems affected by a virus or malware being isolated or turned off.
Notification
If the DBRT determines that there has been an Eligible Data Breach, the DBRT will complete the OAIC’s online Notifiable Data Breach form, which will contain the following:
- VAP’s contact details
- a description of the breach
- the kind/s of information concerned
- recommended steps for individuals
The DBRT will also notify affected individuals and inform them of the contents of this statement. The DBRT will determine which of the following three options will be used for this notification:
- Option 1: Notify all affected individuals (where VAP cannot reasonably assess which particular individuals are at risk of serious harm from an Eligible Data Breach that involves personal information about many people, but where VAP has formed the view that serious harm is likely for one or more of the individuals)
- Option 2: Notify only those individuals at risk of serious harm (where VAP can identify that only a particular individual, or a specific subset of individuals, involved in an Eligible Data Breach is at risk of serious harm, and can specifically identify those individuals)
- Option 3: publish the statement on VAP website and publicise it (where neither of the first two options are practicable).
Where appropriate, the DBRT will provide further information in the notification, such as an apology and a summary of actions taken regarding the breach.
There are some exceptions to the notification requirements, which relate to:
- Eligible Data Breaches of other entities
- enforcement related activities
- inconsistency with secrecy provisions
- declarations by the Commissioner
Where applicable, the DBRT will consider any applicable exceptions, and refer as required to the guidance provided on the OAIC website.
Each data breach needs to be considered on a case-by-case basis to determine whether notification is mandatory or desirable (even if notification is not legally required, there may be reasons why VAP may decide to issue a notification).
Notification to the individuals whose personal data has been affected by the incident will include a description of how and when the breach occurred and the data involved. Specific and clear advice will be given on what they can do to protect themselves, and include what action has already been taken to mitigate the risks.
Where illegal activity is known or is believed to have occurred, or where there is a risk that illegal activity might occur in the future, consider notifying third parties such as the authorities, insurers, bank or credit card companies, and service providers, etc.
Consider whether the communications team should be informed regarding a press release and to be ready to handle any incoming press enquiries.
Review
Once notification obligations are completed, the DBRT should conduct thorough review of the incident and the management of the incident. Identify areas of improvement and take action to prevent future breaches and better manage the incident. This may include:
- fully investigating the cause of the breach
- developing a prevention plan
- conducting audits to ensure the plan is implemented
- updating the security/response plan
- considering changes to policies and procedures
- revising staff training practices
The DBRT will also review and assess the data breach management and response and the effectiveness of the Data Breach Management Policy and this Data Breach Response Plan, including:
- whether the data breach or suspected data breach may indicate a systemic problem with VAP practices or procedures
- possible motives for the breach (where intentional)
- other relevant issues, such as the value of the data to VAP or issues of reputational risk
Circumstances in which other relevant bodies may need to be contacted
Where relevant, a nominated representative of VAP’s executive team may also report the incident to other relevant bodies, such as:
- police or law enforcement (where the breach may lead to fraud, violence or other illegal acts)
- Australian Securities and Investments Commission (ASIC), Australian Prudential Regulation Authority (APRA) or the Australian Taxation Office (ATO), (where the breach may lead to fraud, or where financial information is involved)
- the Australian Cyber Security Centre (where the breach is in the form of a cyber-attack)
- VAP’s financial services providers (where VAP financial systems have been compromised)
- VAP’s insurer(s)
- co-holders of personal information (where information is stored on a shared database)
other third parties as appropriate (where required under agreements with third parties such as insurance policies or service agreements)
