Privacy Amendment (Notifiable Data Breaches) Act 2017

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What does the Privacy Amendment (Notifiable Data Breaches) Act 2017 require after an eligible data breach?

A Notify affected individuals and the OAIC

B Keep the breach secret to protect reputation

2. Which statement describes the Privacy Amendment (Notifiable Data Breaches) Act 2017?

A It amends the Privacy Act 1988 (Cwlth)

B It replaces the Privacy Act 1988 (Cwlth)

3. What is the main purpose of the Notifiable Data Breaches scheme?

A Punish every organisation that stores personal data

B Let affected people act to protect themselves from harm

4. Who must be told about an eligible data breach?

A Only the organisation's own IT staff

B The OAIC and the affected individuals

5. Which organisations does the scheme apply to?

A Organisations covered by the Privacy Act, such as most with turnover over $3 million

B Every organisation and individual in Australia

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Privacy Amendment (Notifiable Data Breaches) Act 2017		Anotify(individuals) -> change passwords, watch accounts
2APP entity		BThe scheme applies only to organisations covered by the Privacy Act (APP entities), such as agencies and businesses with turnover over $3 million. It is not every business.
3Purpose of the scheme: affected people are told about a breach so they can protect themselves from harm.		CThe law that amended the Privacy Act so covered organisations must notify the OAIC and affected people after an eligible data breach.
4Scope of the scheme: it applies to organisations already covered by the Privacy Act, such as businesses with turnover over $3 million.		DAffected individuals must also be notified, not just the regulator. Both the OAIC and the people at risk of serious harm must be told.
5Eligible breach -> notify the OAIC only		EIF turnover > 3000000 THEN covered_by_NDB_scheme
6Every business in Australia must follow the scheme, whatever its size		FA covered organisation bound by the scheme, such as a government agency or a business with annual turnover over $3 million.

Definitions

Privacy Amendment (Notifiable Data Breaches) Act 2017

Fill in the Blanks

Complete each line of code by filling in the missing parts.

The NDB scheme amends the _______ Act 1988.

Notify affected people and the ____.

Purpose: so people can _______ themselves after a breach.

The scheme applies to ___ entities covered by the Privacy Act.

An ________ breach must be notified.

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A Act = Privacy Amendment 2017

B amends = Copyright Act 1968

C adds = breach_notification

Question 2

A scheme = NDB

B law = Privacy Act 1988

C purpose = protect_individuals

D notify(media only)

Question 3

A applies_to = all households

B agencies = covered

C turnover > 3000000 -> covered

Question 4

A org = health_provider

B turnover = 1000000

C covered = False

Question 5

A breach = eligible

B individuals.notify = False

C reason = self_protection

Answer Key

Privacy Amendment (Notifiable Data Breaches) Act 2017

Section A: Quick Questions

A — Notify affected individuals and the OAIC

A — It amends the Privacy Act 1988 (Cwlth)

B — Let affected people act to protect themselves from harm

B — The OAIC and the affected individuals

A — Organisations covered by the Privacy Act, such as most with turnover over $3 million

Section B: Match the Pairs

Privacy Amendment (Notifiable Data Breaches) Act 2017 → The law that amended the Privacy Act so covered organisations must notify the OAIC and affected people after an eligible data breach.

APP entity → A covered organisation bound by the scheme, such as a government agency or a business with annual turnover over $3 million.

Purpose of the scheme: affected people are told about a breach so they can protect themselves from harm. → notify(individuals) -> change passwords, watch accounts

Scope of the scheme: it applies to organisations already covered by the Privacy Act, such as businesses with turnover over $3 million. → IF turnover > 3000000 THEN covered_by_NDB_scheme

Eligible breach -> notify the OAIC only → Affected individuals must also be notified, not just the regulator. Both the OAIC and the people at risk of serious harm must be told.

Every business in Australia must follow the scheme, whatever its size → The scheme applies only to organisations covered by the Privacy Act (APP entities), such as agencies and businesses with turnover over $3 million. It is not every business.

Section C: Definitions

Privacy Amendment (Notifiable Data Breaches) Act 2017 — Amends the Privacy Act so covered organisations must tell the OAIC and affected people after an eligible data breach, so people can protect themselves.

Section D: Fill in the Blanks

The NDB scheme amends the Privacy Act 1988.

Notify affected people and the OAIC.

Purpose: so people can protect
themselves after a breach.

The scheme applies to APP entities covered
by the Privacy Act.

An eligible breach must be notified.

Section E: Spot the Error

B — The 2017 Act amends the Privacy Act 1988, not the Copyright Act. It adds the Notifiable Data Breaches scheme to the Privacy Act.

D — After an eligible data breach, a covered organisation must notify both the OAIC and the affected individuals. Telling only the media does not meet the scheme.

A — The scheme applies to APP entities that the Privacy Act covers, such as government agencies and organisations over the turnover threshold. It does not apply to every household.

C — Health service providers are covered by the Privacy Act even if their turnover is under $3 million, so covered should be True.

B — Affected individuals must be told about an eligible data breach. It should be True so they can protect themselves.