Government beefing-up penalties for firms failing to protect customers from hackers

Companies could be fined hundreds of millions of dollars under new laws beefing-up penalties for organisations that fail to protect customers’ personal information from hackers.

Medibank became the second major company in less than a month to be hacked and confirm customers’ personal information had been breached. Picture: NCA NewsWire/Paul Jeffers

Companies could be fined hundreds of millions of dollars under new laws beefing-up penalties for organisations that fail to protect customers’ personal information from hackers.

Following significant data breaches at Medibank and Optus, Attorney-General Mark Dreyfus said Labor would introduce legislation to increase the maximum fine for serious breaches from $2.2m to at least $50m.

Companies could also be fined three times the value of “any benefit obtained” through the misuse of information, or 30 per cent of their adjusted turnover over the period the breach was conducted.

“When Australians are asked to hand over their personal data they have a right to expect it will be protected,” Mr Dreyfus said.

“Unfortunately, significant privacy breaches in recent weeks have shown existing safeguards are inadequate. It’s not enough for a penalty for a major data breach to be seen as the cost of doing business.”

Attorney-General Mark Dreyfus. Picture: NCA NewsWire/Gary Ramage

Mr Dreyfus said Australia needed “better laws” to regulate how companies managed the data they collected, and bigger penalties to incentivise better ­behaviour.

The Privacy Legislation Amendment Bill will also provide the Australian Information Commissioner with greater powers to resolve privacy breaches.

The Notifiable Data Breaches Scheme – which requires organisations to notify anyone likely to be at risk of serious harm by a data breach – will also be strengthened.

The government this week said Australia was significantly lagging the rest of the world in its privacy laws. “We need to do better as a country,” Home Affairs Minister Clare O’Neil said. “We’re in the order of five years behind where we need to be on our cyber laws and our policies and our approaches.”

It is not illegal for companies to pay a ransom to retrieve stolen data. The bill canvassed by Mr Dreyfus will not change that.

Medibank this week became the second major company in less than a month to be hacked and confirm customers’ personal ­information had been breached.

The hackers have shared the details of 100 customers, but claim they have 200GB of data. Medibank confirmed this would include intimate medical ­details and locations of where care was provided.

Optus revealed last month that up to 11 million customers had been exposed to a data leak, which included full names, email addresses, and passport and Medicare numbers.

A review of the privacy act, initiated by the previous government, is expected to recommend further reforms and will be completed by the end of the year.

Australian Chamber of Commerce and Industry chief executive Andrew McKellar said small businesses in particular were struggling to cope with the ­increased risk and associated costs of cyber attacks.

“The rise in the number and severity of cyber attacks has significantly impacted insurance premiums,” he said. “This is increasingly putting cyber-attack coverage out of reach for small businesses in particular.

“With more and more main street businesses generating ­income from online sales, small businesses are having to play catch-up and are often lacking the digital expertise to protect themselves.”

He urged Labor to match the increased penalties with cash ­incentives for businesses to invest in cyber security.

“It’s critical that government continues to incentivise cyber-­security protections,” he said.

“With ongoing supply-side constraints and high input costs, small business margins are being squeezed. While cyber security should remain front of mind, this is often the last thing small business owners are worrying about.”