Eligible data breach and serious harm (ss 26WE, 26WF)
Name:
Date:
Class:
A
Quick Questions
Shade in the A or B circle for each question.
1. Which event is an eligible data breach under the Privacy Act?
2. What is the harm test for an eligible data breach?
3. Which is an example of unauthorised disclosure?
4. True or false: a data breach can be eligible even if no hacker is involved.
5. A database of only anonymous, non-identifying statistics is stolen. Is it an eligible data breach?
B
Match the Pairs
Draw a line connecting each item on the left to its match on the right.
| Left column | Right column | |
|---|---|---|
| 1s 26WE | ANot every breach is eligible. It must involve personal information and be likely to result in serious harm to the individuals concerned. | |
| 2s 26WF | BEligible data breach: loss of information + likely serious harm | |
| 3A staff member emails a spreadsheet of customer names, addresses and medical details to the wrong external person. This is an unauthorised disclosure that is likely to cause serious harm. | CEligible data breach: unauthorised disclosure + likely serious harm | |
| 4A laptop holding unencrypted customer records is lost on a train. Unauthorised access is likely and could cause serious harm. | DSerious harm is wider than money. It can include physical, psychological, emotional, reputational and financial harm, and s 26WF guides the judgement. | |
| 5Any data breach must be reported as an eligible data breach | EExplains how to decide whether serious harm is likely, using relevant matters such as the kind of information, who holds it and how sensitive it is. | |
| 6Serious harm only means financial loss | FDefines an eligible data breach: unauthorised access to or disclosure of personal information, or loss of it where unauthorised access or disclosure is likely, that is likely to cause serious harm. |
C
Definitions
eligible data breach
D
Fill in the Blanks
Complete each line of code by filling in the missing parts.
1.
IF unauthorisedAccess ___ seriousHarm THEN
2.
__ informationLost AND seriousHarm THEN
3.
IF chanceOfHarm _ 50 THEN
4.
IF access __ disclosure OR loss THEN
5.
IF likelySeriousHarm = ____ THEN
E
Spot the Error
Shade in the letter of the line that contains an error.
Question 1
A
IF access is unauthorised
B
AND info is personal
C
AND serious harm is likely
D
THEN breach is not eligible
Question 2
A
type ← unauthorised access
B
info ← personal information
C
harm ← likely to be minor
D
eligible ← type AND harm
Question 3
A
definition ← s 26WK
B
serious_harm ← s 26WF
C
OUTPUT definition, harm
Question 4
A
IF data is lost in a theft
B
AND info is personal
C
AND any harm is possible
D
THEN assess as eligible
Question 5
A
IF laptop with records is safe
B
AND unauthorised access likely
C
AND serious harm is likely
D
THEN breach is eligible
Answer Key
Eligible data breach and serious harm (ss 26WE, 26WF)
Section A: Quick Questions
Q1
A — A hacker downloads customer names, addresses and licence numbers, and serious harm is likely
Q2
B — Access, disclosure or loss is likely to result in serious harm to the individuals concerned
Q3
A — An employee emails a spreadsheet of client health details to the wrong external address
Q4
A — True: loss of information, such as a USB drive left on a train, can be an eligible data breach
Q5
B — Probably not, because it is not personal information and serious harm to individuals is unlikely
Section B: Match the Pairs
Q1
s 26WE → Defines an eligible data breach: unauthorised access to or disclosure of personal information, or loss of it where unauthorised access or disclosure is likely, that is likely to cause serious harm.
Q2
s 26WF → Explains how to decide whether serious harm is likely, using relevant matters such as the kind of information, who holds it and how sensitive it is.
Q3
A staff member emails a spreadsheet of customer names, addresses and medical details to the wrong external person. This is an unauthorised disclosure that is likely to cause serious harm. → Eligible data breach: unauthorised disclosure + likely serious harm
Q4
A laptop holding unencrypted customer records is lost on a train. Unauthorised access is likely and could cause serious harm. → Eligible data breach: loss of information + likely serious harm
Q5
Any data breach must be reported as an eligible data breach → Not every breach is eligible. It must involve personal information and be likely to result in serious harm to the individuals concerned.
Q6
Serious harm only means financial loss → Serious harm is wider than money. It can include physical, psychological, emotional, reputational and financial harm, and s 26WF guides the judgement.
Section C: Definitions
Q1
eligible data breach — Unauthorised access to, disclosure or loss of personal information that is likely to result in serious harm to the individuals it concerns (ss 26WE, 26WF).Section D: Fill in the Blanks
Q1
IF unauthorisedAccess AND seriousHarm THENQ2
IF informationLost AND seriousHarm THENQ3
IF chanceOfHarm > 50 THENQ4
IF access OR disclosure OR loss THENQ5
IF likelySeriousHarm = TRUE THENSection E: Spot the Error
Q1
D — When access is unauthorised, the information is personal and serious harm is likely, the breach is an eligible data breach. The line should say THEN breach is eligible.
Q2
C — An eligible data breach needs serious harm to be likely, not minor harm. The line should be harm ← likely serious harm.
Q3
A — Section 26WE defines an eligible data breach. Section 26WK covers the statement to the Commissioner, so the line should use s 26WE.
Q4
C — The test is that serious harm is likely. Any possible harm is too low a threshold. The line should be AND serious harm is likely.
Q5
A — Loss of information can be an eligible data breach when unauthorised access or disclosure is likely. A laptop that is safe has no loss. The line should say the laptop is lost.