Unlock the eSignature Lawfulness for Personal Leave Policy in Australia with airSlate SignNow

How to eSign a document: eSignature lawfulness for Personal Leave Policy in Australia

foreign Cyber risks are now at the forefront of  everybody's mind with a couple of high   profile cases recently boards and executive  committees and everyone really around the   streets in the cities are talking about  cyber risks it's really important now more   than ever to take proactive steps to manage  those risks before things get out of hand.   Regulators and legislators have made it very  clear that the consequences of breaching your   obligations under privacy and data security  legislation is going to be really significant   going forward. As an insurance geek I would like to  jump straight into talking about cyber insurance   but before I do that I'd really like to go to  a discussion to understand the framework in   Australia for data security and privacy so I'll  take it to John so John can you explain the legal   framework in Australia at the moment in relation  to privacy and data security. So Lucy there are   some industry specific laws and standards that  apply things like Prudential standards for APRA   regulated entities and the security of critical  infrastructure legislation but the broad base here   is the Privacy Act which has the most general  requirement to protect personal information   now there there's a reasonable efforts obligation  to protect information from unauthorized use and   various forms of access and disclosure now what's  reasonable depends on the circumstances the office   of the Australian Information Commissioner has  issued some guidance on this and the types of   things that you'd look at are the scale of the  organization's operations and resources the amount   of information that it holds and the type of  information the sensitivity of it the possible the   adverse effects of a breach and the practicality  of taking security steps noting that time and cost   alone won't be a reason not to do something it's  only if it's excessive that that factor really   comes into play and whether the security measure  is itself invasive is for privacy another factor   here though is that there are a lot of Industry  standards that have been published in relation   to dealing with cyber incidents and planning for  cyber incidents and I think that as time goes on   and as the uptake of those standards increases  that will almost set a de facto sort of bar in   terms of what reasonable might be considered to  be. So good segway there because often people who   are affected don't understand what's happened to  their data where it's gone why they're getting   prank calls because their data's gone out into  the ether for individuals actually affected by   these cyber attacks what what's their recourse.  So at the moment the Privacy Act doesn't give   individuals a direct right of action the way that  it happens is that they complain to the OAIC and   the OAIC as a regulator then takes action against  relevant organization I think that's also going   to change there's been a potential reform on the  table for some time to give individuals a direct   statutory cause of action against companies  that interfere with their privacy so it's   it's very much a watch this space but I think the  current climate makes that more likely than not   until then though there's other claims that are  being explored you can imagine that people might   make claims based on breach of contractual terms  relating to the services that are provided to   them or even claims in negligence and as you  know Lucy Australia has a fairly plaintiff   friendly class action regime and a fairly mature  litigation funding industry and they combined as   the right ingredients for significant claims to  be made so I'd expect to see more activity along   those lines in future as people's awareness of  cyber risks and the consequences for them grow.