Senate Finance and Public Administration Legislation Committee [Part 2], , 2:25:13 to 2:29:07
The committee discusses ANAO findings that 123 of 170 notifiable data breaches at Services Australia were not assessed within the 30-day statutory requirement.
Topics: Privacy, Online safety
Speakers: Senator The Hon Jane Hume, Nathan Callaway, Ian Goodwin, Dr Caralee McLiesh, Unknown Speaker
This is for the 2025 report, I think.
>> One moment, Senator, just pull up the I'll just check if my colleagues have answered to that. Mr. Callaway,
>> uh Nathan Callaway, executive director, could you repeat your question, please?
Yeah, I I'm looking at the 2025 report where 123 of 170 confirmed notifiable data breaches were not assessed within the 30-day statutory requirement over the period that was tested. >> Does that sound right? >> So, is that high? 123 out of 170 sounds
like a lot. So what what we found is that there had been a bit of an issue in terms of meeting those statutory time frames and over time we had seen improvement in in the later part of the audit.
>> Right. So okay so who's accountable for compliance and what is the remedial action that is taken when you point out that 123 of the 170 confirmed notifiable data breaches weren't assessed in the
notifiable data breaches scheme as you're probably aware is under the privacy act. Yes. >> And so the Australian information commissioner um is responsible for administering that scheme. >> Um in this case you know services Australia accountable authority is kind of accountable for meeting their obligations under the privacy act. Um but but the notifiable data breaches scheme is administered by the Australian information commissioner.
>> Okay. Do you get to see exactly what those data breaches are, what they entail? Can you give me an example of potentially what a data breach of that 12? Well, of the 170 confirmed data breaches, what's some examples there of the probably the more egregious ones, ones that would concern you?
I I don't have that information at hand, but it could be things like a um say say a general practitioner um has had a has had a data pre breach um within the practice. Um it could be things like um you know a a staff member emailing you know inadvertently emailing private information to to people who shouldn't receive it.
>> Okay. Yeah, I I should probably just add a data breach um can involve many many citizens. So it's not just like one data breach is not just one
>> not one person having their data breached.
>> It can relate to a very large number of citizens.
>> Okay. So of the 170 then were there a number that were lots of people that had their data breached or were there more were you looking at sort of more individual cases? I it's hard to when you're just looking at a number of data breaches, you don't really have a good picture in your head of what it is that we're talking about. >> Are they big data breaches? Are they little data breaches?
>> So, the m the majority or the or the highest um kind of category, let's say, was between 11 and 100 people.
>> 11 and 100 people.
>> So, figure 3.5 in the in the report kind of presents that um none were greater than a million um and >> good, >> which is good. Um and but certainly the most most were between 11 and 100. and then 10 and one and 1,000 people.
>> Okay. So, what you're saying that there were some that were a lot of people and yet the agency didn't do anything about them for a month or didn't respond in the appropriate 30-day time period, recommended 30-day time period, even though there's a lot of people involved. Is that right?