Statement to the Commissioner (ss 26WK, 26WR)

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Who must receive the statement after an eligible data breach?

A The Australian Information Commissioner

B The Australian Federal Police only

2. When must the statement be given to the Commissioner?

A As soon as practicable after becoming aware of the eligible breach

B At the end of the financial year

3. Which detail must be in the statement?

A A description of the eligible data breach

B The passwords of every affected person

4. Which detail must be in the statement?

A The home address of the staff member who caused it

B The identity and contact details of the organisation

5. Which detail must be in the statement?

A The organisation's total yearly profit

B The kinds of information involved in the breach

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1statement.recipient = Commissioner		Astatement = [entity, description, info_kinds, steps]
2send_statement(as_soon_as_practicable)		BIF eligible_breach THEN prepare_statement() AND send_to(Commissioner)
3The statement must include the organisation's identity and contact details, a description of the breach, the kinds of information involved and recommended steps for affected individuals.		CThe statement must be given to the Australian Information Commissioner, not only to customers. Individuals are notified as a separate step.
4Once an organisation confirms an eligible data breach, it must prepare a statement and give it to the Commissioner.		DTiming rule: the statement must be given to the Commissioner as soon as practicable once it is prepared.
5send_statement(to = customers_only)		EThe statement is given to the Australian Information Commissioner, who is the regulator for the Privacy Act.
6WAIT 12 months THEN send_statement()		FWaiting a year is a serious delay. The statement must be given to the Commissioner as soon as practicable.

Definitions

Statement to the Commissioner

Fill in the Blanks

Complete each line of code by filling in the missing parts.

After a breach, prepare a _________

Give the statement to the Australian Information ____________

Send it to the Commissioner as soon as ___________

The statement must include the entity's identity and _______ details

Recommend _____ individuals should take

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A IF breach IS eligible THEN

B PREPARE statement IF asked

C GIVE stmt TO Commissioner

D END IF

Question 2

A eligible ← TRUE

B stmt ← PREPARE statement

C GIVE stmt TO state Police

Question 3

A stmt.entity ← name only

B stmt.breach ← description

C stmt.info ← kinds of data

D stmt.advice ← steps for people

Question 4

A stmt ← NEW Statement

B stmt.entity ← name + contact

C stmt.info ← actual data values

Question 5

A stmt.entity ← name + contact

B stmt.breach ← description

C stmt.info ← kinds of data

D stmt.advice ← steps for staff

Answer Key

Statement to the Commissioner (ss 26WK, 26WR)

Section A: Quick Questions

A — The Australian Information Commissioner

A — As soon as practicable after becoming aware of the eligible breach

A — A description of the eligible data breach

B — The identity and contact details of the organisation

B — The kinds of information involved in the breach

Section B: Match the Pairs

statement.recipient = Commissioner → The statement is given to the Australian Information Commissioner, who is the regulator for the Privacy Act.

send_statement(as_soon_as_practicable) → Timing rule: the statement must be given to the Commissioner as soon as practicable once it is prepared.

The statement must include the organisation's identity and contact details, a description of the breach, the kinds of information involved and recommended steps for affected individuals. → statement = [entity, description, info_kinds, steps]

Once an organisation confirms an eligible data breach, it must prepare a statement and give it to the Commissioner. → IF eligible_breach THEN prepare_statement() AND send_to(Commissioner)

send_statement(to = customers_only) → The statement must be given to the Australian Information Commissioner, not only to customers. Individuals are notified as a separate step.

WAIT 12 months THEN send_statement() → Waiting a year is a serious delay. The statement must be given to the Commissioner as soon as practicable.

Section C: Definitions

Statement to the Commissioner — After an eligible data breach, the organisation must prepare a statement of required details and give it to the Australian Information Commissioner as soon as practicable.

Section D: Fill in the Blanks

After a breach, prepare a statement

Give the statement to the Australian
Information Commissioner

Send it to the Commissioner
as soon as practicable

The statement must include the entity's
identity and contact details

Recommend steps individuals should take

Section E: Spot the Error

B — After an eligible data breach the organisation must prepare the statement on its own. It does not wait to be asked. The line should be ' PREPARE statement'.

C — The statement must be given to the Australian Information Commissioner, not the police. The line should be 'GIVE stmt TO Commissioner'.

A — The statement must give the identity AND contact details of the organisation, not just its name. The line should be 'stmt.entity ← name + contact'.

C — The statement describes the kind or kinds of information involved in the breach. It does not repeat the actual data. The line should be 'stmt.info ← kinds of data'.

D — The statement must recommend steps that the affected individuals should take in response to the breach, not steps for staff. The line should be 'stmt.advice ← steps for people'.