Australian businesses are struggling with contemporary privacy and data protection laws. Many still don’t appreciate (or are choosing to ignore) how Europe’s General Data Protection Regulation (which took effect on 25 May) may affect them. Further, four months after the introduction of mandatory breach disclosure law in Australia, a huge number of Australian businesses are not yet compliant with the Privacy Act or the Notifiable Data Breach Scheme.
Even at the most basic level, Aussie businesses are neglecting to protect the privacy and personal information of their customers and other stakeholders.
Here are two examples drawn from an analysis of the Australian Financial Review’s list of the 100 fastest growing companies in 2017:
The Fast 100 companies are relatively evenly split between small companies (revenue less than $10 million) and medium-size businesses (revenue between $10 million and $249 million). The smallest company listed turns over a little over $1.5 million.
Hyper Text Transfer Protocol Secure (HTTPS) is the secure protocol over which data is sent between a browser and a website. The security is achieved because HTTPS works with Transport Layer Security (TLS or SSL) which takes inbound or outbound data and encrypts it.
As a consumer, you’ll know when you’re on a secure website: you’ll most likely observe a padlock in the address bar.
Though HTTPS is not mandated by legislation or regulation, it performs four important functions:
Without HTTPS, website communications are at risk. The communications traffic moving between visitors and websites is vulnerable to attacks (such as Man-In-The-Middle) by malicious attackers or mischievous intruders. The personal information of visitors transacting on the website could be exploited; the business’ unprotected resources could be compromised; and all data transmissions could be intercepted.
The early adopters of HTTPS technology were financial institutions and online retailers that recognised the security imperative and the benefit of protecting their customers’ transactions. Enterprises in these sectors used HTTPS to visibly demonstrate that where data protection was concerned, they were going above and beyond.
Nearly 20 years on, HTTPS is no longer a point of difference — it’s a business fundamental. Even if your business is one of the few that doesn’t process sensitive information, many browser features and ‘progressive web apps’ will only function with HTTPS.
A point to note is that ‘online transactions’ do not have to involve payment; a transaction includes any exchange of information. If your website collects data — such as through a contact form, chatbot, lead magnet or careers page — it is engaging in online transactions.
Today, digital best practice dictates that every business in every industry should protect their website traffic and transactions with HTTPS.
Subsequently, HTTPS protocol is being applied to nearly 60% of the world’s most popular websites and 70% of all page loads.
Australian businesses are simply not managing and mitigating cyber risks.
HTTPS is just one way a business can demonstrate its commitment to data security, though the absence of HTTPS can signal other measures might also be absent or inadequate.
Businesses that collect personal information and have an annual turnover of $3 million or more must comply with the Australian Privacy Principles. So too must all businesses in certain sectors, including healthcare.
Ninety percent of the companies listed in the Fast 100 exceed the $3 million revenue threshold; the other 10% will probably reach the threshold in the coming year.
Yet analysis indicates close to one-half (44%) of Australia’s fastest-growing companies may not be complying with Australia’s privacy laws: They have not published a privacy policy; they do not include a privacy notification wherever they collect personal information – most obviously, on their contact forms.
Of particular concern is that the greatest number of offending organisations appear to be in the most data-driven sectors — information technology and telecommunications, marketing and business services.
Privacy compliance will require your business, at minimum, to:
Ignorance is neither a defence nor a safeguard against the potentially catastrophic reputational damage that would be caused by a privacy or security breach.
NOW READ: Human error (not hackers) behind most data breaches in Australia
Helaine Leggat is a principal lawyer at Sladen Legal, specialising in cyberlaw.
