Senate Legal and Constitutional Affairs Legislation Committee [Part 2], , 36:08 to 42:23
The committee scrutinizes discrepancies in data breach reporting and the progress of notifying affected litigants.
Topics: Privacy, Public safety
Speakers: David Pringle, Senator David Shoebridge, Unknown Speaker, Senator Jana Stewart
>> Yes. And I also have some questions about the 88 matters, the 88 packets of data from VIQ. Um could I indulge the the chairs um for for a few minutes to see if you can provide a neat summary of what you understand has happened in that regard?
>> Yes, I'd be happy to do our best. So the first set of data you might recall from previous estimates that came out certainly in relation to uh the Federal Circuit Family Court of Australia was a figure of 136. Now we we understand that's information from VIQ. Obviously we can only glean information from VIQ as to what they uh investigated and found their people did. We understand it's 100 for the FCFCA 136 potentially affected hearings across 122 proceedings. And that's where there's a discrepancy between hearings and proceedings. Obviously, there'll be more hearings than proceedings. Um because you get to have more than one hearing in a proceeding. M
>> Mr. Pringle, before you proceed further, have you been given a copy of the cyber CX report?
>> Yes, I was just going to clarify that further. Um, Senator, so that's the information that first came to us from the VIQ process. Then in the cyber CX report, which we've received more recently, um, they use a figure of 101 records, which is a new metric >> um, that you were discussing with the federal court listed entity before. We understand that to span across both the federal courts matters and our matters and to be those snippets um that were being discussed. Now um it is is likely that these matters will be further clarified um once the OIC has concluded its processes as well but that's the best that we can give you from the cyber
CX report. Um well um the federal court said that there were 88 matters involved and 10 of them were federal court matters which as I understand it means 78 were federal were were your courts matters um um is that right
>> that would be a natural deduction but I'm sorry I don't have express knowledge of the precise number from the cyber CX report for our proceeding. Does the CX
report tell you which matters they are? Does it identify what they are?
>> No, it doesn't say it's this proceeding number and this hearing, for example, that
>> Have you sought that information from the federal court?
>> Uh, no. Again, we've relatively recently uh seen the report. Um, understandably, the the entity would have needed some time to go through its technical aspects and the like. um that's in the process of being properly considered by us and we will certainly ask uh whatever follow-up questions we need.
>> So, so you're you're despite all of the the time that's happened and I accept that much of this has been in the realm of the federal court entity. >> Yes. You're still not able to identify which matters there have been a data breach and you therefore I assume haven't told any litigant or party to proceedings that their matter has been the subject of a I say data breach registar loss says um unauthorized access to documents but I'm saying the same thing >> yes you still haven't two issues there
Senator the first is the number of matters we're aware of the 136 federal circuit family court of Australia potentially affected hearings uh and uh we have reviewed those and formed a preliminary view about them. Um uh whilst we're waiting we were waiting on the cyber CX process [clears throat] and the uh OARC process. Um we are as I think I indicated last estimates balancing up the harm that can be caused by notifying people about matters and the distress that can be caused. So, we need to assess that cyber CX report further.
>> But we don't you don't know if the 101 records um or the 78 matters, however we want to the subset of the 101 records, you don't even know if they they're the same if that's a subset of the 136 potentially affected matters.
>> Um, we would have to interrogate that and ask for a cross check. And have you
asked that of um have you asked have you pro did you provide the information that VIQ gave to you to cyber to the federal
>> the entity gave them uh we've um gave them all that information for their uh for the purposes of their investigation
>> and did the cyber CX report deal with that the discrepancy
>> not to that level of granular granularity that what what what it does is use those broad figures that you've noted. I agree, Senator. I think that's something that could be further interrogated, but I don't have that data or information to hand.
>> Um, well, can I ask you to take on notice what you intend to do to address that discrepancy to answer these most obvious questions? Um, are they the same? Are we talking about the same matters? Is one a subset of the other? Are they cumulative? like it is. I I accept that you've been waiting, as I said, for the federal court entity to do the investigation. That seems a sensible use of resources, but now you're left in an invidious position with what you've been told by VIQ being directly at odds with what you're now hearing from cyber CX.
>> Yes. And we're also conscious that the OIC is is looking at this whole scenario following our report to the Canadian regulator um who then went to the Australian regulator. I think there would be some value in um seeing that report as well. Uh so I'd happy to take those matters on us.
>> Could you take those matters on us and could you with as much granularity as you can identify what steps you intend to take to address these discrepancies and get a full picture of what data went where and what who if any litigants need to be advised of this matter.
>> Yes, Senator. Thank you.
>> Thanks Mr. Pringle. Thanks.
>> Thank you Senator Shoebridge. Senator