ASC Procedure for Responding to a Breach of Privacy (Data Breach) 
Under the Australian Privacy Principles the Australian Sports Commission (ASC) is required to protect personal information and to prevent its unauthorised use or disclosure.
The below document provides guidance on what to do once a privacy breach has been confirmed. If you are unsure if a privacy breach has occurred please complete a Breach Report. 
Breaches of personal information can be caused by a variety of factors, affect different types of personal information and give rise to a range of actual or potential harms to individuals, agencies and organisations.
There is no single way of responding to a personal information security breach. Each breach will need to be dealt with on a case-by-case basis, undertaking an assessment of the risks involved, and using that risk assessment as the basis for deciding what actions to take in the circumstances. There are however steps which must be taken for all suspected breaches.
The four steps to responding to a breach or suspected breach are:
Step 1: Contain the breach
Step 2: Evaluate the risks associated with the breach
Step 3: Notification of breach
Step 4: Review and Prevent further breaches

STEP 1: Contain the breach
Once a breach has been discovered or it is suspected that a personal information security breach has occurred, immediate steps must be taken to limit the breach. 
a) Containing the breach
Take whatever steps possible to immediately contain the breach. For example, stop the unauthorised practice, recover the records, or shut down the system that was breached.
If it is not practical to shut down the system or if it would result in loss of evidence, then revoke or change computer access privileges or correct weaknesses in physical or electronic security.
b) Initiate a preliminary assessment    
Assess whether steps can be taken to mitigate the harm an individual will suffer as a result of a breach.
Move quickly to appoint someone to lead the initial assessment. This person should have sufficient authority to conduct the initial investigation, gather any necessary information and make initial recommendations. If necessary, a more detailed evaluation may subsequently be required.
Determine the need to assemble a team that could include representatives from appropriate parts of the Commission.
c) Does anyone need to be notified immediately?       
Escalate the matter internally as appropriate, including informing the Privacy Officer (privacy@ausport.gov.au). If the breach has been caused by a security breach of the ASC’s ICT systems the IT Security Advisor must also be notified.
Determine who else needs to be made aware of the breach internally, and potentially externally, at this preliminary stage.
In some cases it may be appropriate to notify individuals whose privacy has been breached immediately.
If the breach appears to involve theft or other criminal activity, notification to the Australian Federal Police should occur.
d) Other considerations
Be careful not to compromise the ability of law enforcement agencies to investigate the breach, for example, by making details of the breach public too early.
Be careful not to destroy evidence that may be valuable in determining the cause or would allow the ASC to take appropriate corrective action, and ensure appropriate records of the suspected breach are maintained, including the steps taken to rectify the situation and the decisions made.
 STEP 2: Evaluate the risks associated with the breach
To determine what other steps are immediately necessary you should assess the risks to the individual/s associated with the breach. The following factors should be considered when assessing the risks:
Does the type of information create a greater risk of harm?
Some information is more likely to cause an individual harm if it is compromised, whether that harm is physical, financial or psychological.
For example, health information, government-issued identifiers such as Medicare numbers, driver licence and health care numbers, and financial account numbers such as credit or debit card numbers might pose a greater risk of harm to an individual than their name or address.
Also, a combination of personal information typically creates a great risk of harm than a single piece of personal information.
It may also matter whether the information is permanent or temporary.
Permanent information, such as someone's name place and date of birth, or medical history cannot be 're-issued'.
The permanence of the information may be more significant if it is protected by encryption - overtime, encryption algorithms may be broken, so such information may be at greater longer term risk of being compromised. On the other hand, temporary information may have changed by the time an algorithm is broken.
Determine who is affected by the breach? Employees, contractors, the public, clients, service providers, other agencies or organisations?
Remember that certain people may be particularly at risk of harm. 
What is the context of the personal information involved?
While publicly available information such as that found in a public telephone directory may be less sensitive, this depends on context.
For example, what might be the implications of someone's name and phone number or address being associated with the services offered, or the professional association represented? 
To whom was the information exposed?
Employee records containing information about employment history such as performance and disciplinary matters or a co-worker's mental health might be particularly sensitive if exposed to other employees in the workplace and could result in an individual being the subject of humiliation or workplace bullying.
Have there been other breaches that could have a cumulative effect?
A number of small, seemingly insignificant, breaches could have an accumulative effect. Separate breaches that might not, by themselves, be assessed as representing a real risk of serious harm to an affected individual, may meet this threshold when the accumulative affect of the breaches is considered.
This could involve incremental breaches of the same database. It could also include known breaches from a number of different sources. 
How could the personal information be used?
Could the information be used for fraudulent or otherwise harmful purposes, such as to significantly embarrass the individual?
Could the affected information be easily combined either with each other or with readily publicly available information to create a greater risk of harm to the individual? 
Establish the cause and extent of the breach
Is there a risk of ongoing breaches or further exposure of the information? 
What was the extent of the unauthorised access to, use or disclosure of personal information, including the number and nature of likely recipients and the risk of further access, use or disclosure, including via mass media or online? 
Is there evidence of theft?
Is there is evidence that suggests theft, was the information the target? For example where a laptop is stolen can it be determined whether it was the information on the laptop or the laptop itself that the thief wanted?
Evidence of theft could suggest a greater intention to do harm and heighten the need to provide notification to the individual, as well as possible law enforcement. 
Is the personal information adequately encrypted, anonymised or otherwise not easily accessible?
Is the information rendered unreadable by security measures in place to protect the stored information? Is the personal information displayed or stored in such a way so that it cannot be used if breached? For example, if a laptop containing adequately encrypted information is stolen, subsequently recovered and investigations show that the information was not tampered with, notification to individuals may not be necessary. 
What was the source of the breach?
For example, did it involve external or internal malicious behaviour, or was it an internal processing error? Does it seem to have been lost or misplaced?
The risk of harm to the individual may be less where the breach is unintentional or accidental, rather than intentional or malicious. 
Has the personal information been recovered?     
For example, has a lost laptop been found or returned? If the information has been recovered, are there any signs that it has been tampered with? 
What steps have already been taken to mitigate the harm?
Have staff contained the breach so that its full extent can be assessed? Are further steps required?
Is this a systemic problem or an isolated incident?   
When checking the source of the breach, it is important to check whether any similar breaches could have occurred in the past. Sometimes, a breach can signal a deeper problem with system security. This may also reveal that more information has been affected than initially thought, potentially heightening the risk posed.
How many individuals' are affected by the breach?
If the breach is a result of a systemic problem, there may be more people affected than first anticipated. Even where the breach involves accidental and unintentional misuse of information; if the breach affects many individuals then this may create greater risks that the information will be misused. 
While the number of affected individuals can help gauge the severity of the breach, it is important to remember that even a breach involving the personal information of one or two people can be serious, depending on the information involved.
Assess what is the risk of harm that could result to individuals
Who is the recipient of the information?
Is there likely to be any relationship between the unauthorised recipients and the affected individuals?
For example, was the disclosure to an unknown party or to a party suspected of being involved in criminal activity where there is a potential risk of misuse? Or was the disclosure to a party to which the individual would object or is the subject of a restraining order. Or to co-workers who have no need to have this information?
Or was the recipient a trusted, known entity or person that would reasonably be expected to return the information without disclosing or using it? For example was the information sent to the individual's lawyer instead of being sent to them, or to another party bound by professional duties of confidentiality or ethical standards.
What harm to individuals could result from the breach?
Examples include:
•   threat to physical safety
•   identity theft
•   threat to emotional wellbeing
•   financial loss
•   loss of business or employment opportunities
•   humiliation, damage to reputation or relationships
•   workplace or social bullying or marginalisation.
 
Identify what other harms or risks could arise
Examples include:
•   loss of trust in the ASC
•   loss of competitive advantage
•   loss of assets
•   financial exposure
•   regulatory penalties
•   extortion
•   reputational damage
•   legal proceedings
•   risks to national security
•   embarrassment to the Minister and Commonwealth.
 
STEP 3: Notification of a privacy breach 

Notification can be an important mitigation strategy that has the potential to benefit both the ASC and the individuals affected by a personal information breach. 
It is up to Executive staff in agreement with the Privacy Officer to determine when notification is appropriate. While notification is an important mitigation strategy, it will not always be the appropriate response to a breach. Providing notification about low risk breaches can cause undue anxiety and de-sensitise individuals to notice. Each incident needs to be considered on a case-by-case basis to determine whether breach notification is required.
If a personal information security breach creates a real risk of serious harm to the individual, those affected should be notified.
Prompt notification to individuals in these cases can help them mitigate the damage by taking steps to protect themselves. You should:
•	take into account the ability of the individual to take specific steps to mitigate any such harm 
•	consider whether it is appropriate to inform other third parties about the personal information breach such as the police, professional bodies, the Privacy Commissioner or other regulators or professional bodies. 
Deciding whether to notify affected individuals
In notifying affected individuals, a key consideration is whether notification is necessary in order to avoid or mitigate serious harm to an individual whose personal information has been inappropriately accessed, collected, used or disclosed.
You should consider the following factors when deciding whether to notify: 
•	What is the risk of serious harm to the individual as determined by step 2? 
•	What is the ability of the individual to avoid or mitigate possible harm if notified of a breach (in addition to steps taken by the ASC)? For example, would an individual be able to have a new bank account number issued to avoid potential financial harm resulting from a breach? Would steps such as monitoring bank statements or exercising greater vigilance over their credit reporting records assist in mitigating risks of financial or credit fraud? 
•	Even if the individual would not be able to take steps to fix the situation, is the information that has been compromised very sensitive or likely to cause humiliation or embarrassment for the individual? 
•	What are the legal and contractual obligations to notify and what are the consequences, of notification? 
•	What are the consequences of failing to notify affected individuals? If individuals subsequently find out about the breach through the media for example, what could be the associated loss of trust that the ASC sustains? 

Process of notification
At this stage, you should have as complete a set of facts as possible and have completed the risk assessment in order to determine whether to notify individuals. 
Sometimes the urgency or seriousness of the breach dictates that notification should happen immediately, before having all the necessary facts.
Notification of individuals affected by the breach should occur as soon as reasonably possible.   
If law enforcement authorities are involved, check with those authorities whether notification should be delayed to ensure that the investigation is not compromised.
Delaying the disclosure of details about a breach of security or information systems may also be appropriate until that system has been repaired and tested or the breach contained in some other way.
How to notify
The preferred method of notification is direct either by phone, letter, email or in person - to affected individuals.
Indirect notification, either by website information, posted notices, media, should generally only occur where direct notification could cause further harm, is prohibitive in cost or the contact information for affected individuals is not known.                
Preferably notification should 'stand-alone' and should not be 'bundled' with other material unrelated to the breach, as it may confuse recipients and affect the impact of the breach notification.
Using multiple methods of notification in certain cases may be appropriate.
You should also consider whether the method and content of notification might increase the risk of harm, such as by alerting the person who stole the laptop of the value of the information on the computer if it would not otherwise be apparent.
To avoid being confused with phishing emails, email notifications may require special care. For example, only communicate basic information about the breach, leaving more detailed advice to other forms of communication.
Who should notify?
Typically, the area that has a direct relationship with the individual/s should notify those affected.
This includes where a breach may have involved handling of personal information by a third party service provider, contractor or related body corporate.    Joint and third party relationships can raise complex issues - the breach may occur at a retail merchant but involve credit card details from numerous financial institutions or the card promoter may not be the card issuer (for example, many airlines, department stores and other retailers have credit cards that display their brand, though the cards are issued by a bank or credit card company).
Each situation will vary and you will have to consider what is best on a case by case basis. However some relevant considerations might be:
• Where did the breach occur?
• Who does the individual identify as their "relationship" manager?
• Does the ASC have contact details for the individuals? Are they able to obtain them easily? 

Who should be notified?
Generally it should be the individual/s who are affected.
However, in some cases it may be appropriate to notify the individual's guardian or authorised representative on their behalf.  There may be circumstances where carers or authorised representatives should be notified as well as, or instead of, the individual.
Where appropriate, clinical judgement may be required where notification may exacerbate health conditions, such as acute paranoia.
What should be included in the notification?
The content of notifications will vary depending on the particular breach and the method of notification chosen. In general, the information in the notice should help the individual to reduce or prevent the harm that could be caused by the breach. Notifications should include the types of information detailed below.
a) Incident Description
Information about the incident and its timing in general terms. The notice should not include information that would reveal specific system vulnerabilities.
A description of the personal information involved in the breach. Be careful not to include personal   information in the notification to avoid possible further unauthorised disclosure.
Response to the breach. A general account of what the ASC has done to control or reduce the harm, and proposed future steps that are planned.
b) Assistance offered to affected individuals
What the ASC will do to assist individuals and what steps the individual can take to avoid or reduce the risk of harm or to further protect themselves.
Possible actions include arranging for credit monitoring or other fraud prevention tools, providing information on how to change a government issued identification number, personal health card or driver licence number.
c) Other information sources            
Sources of information designed to assist individuals in protecting against identity theft or interferences with privacy.
For example, guidance on the Office of the Australian Information Commissioner's website (www.oaic.gov.au) and the Attorney-General's Department website (www.ag.gov.au)
d) ASC contact details           
Contact information of staff within the ASC that can answer questions, provide further information or address specific privacy concerns.
e) Whether breach notified to regulator or other external contact(s)       
Indicate whether the ASC has notified the Office of the Australian Information Commissioner or other parties.
f) Legal implications  
The precise wording of the notice may have legal implications, so should be checked accordingly. This could include secrecy obligations that apply to agencies.
g) How individuals can lodge a complaint
With the ASC:
Provide information on ASC internal dispute resolution processes and how the individual can make a complaint to the Commission.
With the Office of the Australian Information Commissioner:
Explain that if individuals are not satisfied with the response by the ASC, that they can make a complaint to the Office of the Australian Information Commissioner:
Telephone   1300 363 992 (local call cost, but calls from mobile and payphones may incur higher charges)
TTY           1800 620 241 (this number is dedicated for the hearing impaired only, no voice calls)
Post           GPO Box 2999
                  Canberra ACT 2601
Email          enquiries@oaic.gov.au
Website       www.oaic.gov.au
 Office of the Australian Information Commissioner
The Privacy Amendment (Notifiable Data Breaches) Act 2017 establishes a Notifiable Data Breaches scheme in Australia. 
The OAIC determines that eligible breaches are where:
1.	there is unauthorised access to or unauthorised disclosure of personal information, or a loss of personal information, that an entity holds 
2.	this is likely to result in serious harm to one or more individuals, and
3.	the entity has not been able to prevent the likely risk of serious harm with remedial action.
At the ASC we would consider a notifiable breach any large scale unauthorised release of Australian's personal information or the single or multiple release of any sensitive or medical data. Serious harm may include serious physical, psychological, emotional, financial, or reputational harm.
Breaches are to be reported to the Office of the Australian Information Commissioner by the ASC Privacy Officer within 30 days.
The Notifiable Data Breach Form must be used and set out:
•	the identity and contact details of the organisation
•	a description of the data breach
•	the kinds of information concerned and;
•	recommendations about the steps individuals should take in response to the data breach.

EU General Data Protection Regulation (GDPR)
The GDPR establishes a Notifiable Data Breaches scheme in the European Union. The ASC is subject to the GDPR as it maintains a facility and staff in Italy. A Notifiable Data Breach is a data breach that is likely to result in harm (high risk to rights and freedoms of natural persons) to a person within the EU (citizen or visitor).
Under the GDPR notifiable breaches that relate to the AIS ETC are to be reported to the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) by the ASC Privacy Officer within 72 hours.
Notification requirements are to: 
(a) describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;  
(b) communicate the name and contact details of the data protection officer (Privacy Officer) or other contact point where more information can be obtained;  
(c) describe the likely consequences of the personal data breach;  and
(d) describe the measures taken or proposed to be taken by the agency to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.  
Others parties to notify
In general, notifying other authorities or regulators should not be a substitute for notifying individuals. However, in some circumstances it is appropriate to notify these third parties.
Police:  If theft or other crime is suspected. The Australian Federal Police should also be contacted if a compromise to national security is suspected.
Insurers or others: If required by contractual obligations.
Credit card companies, financial institutions or credit reporting agencies: If their assistance is necessary for contacting individuals or assisting with mitigating harm.
Professional or other regulatory bodies: If professional or regulatory standards require notification. 
Other internal or external parties not already notified:  staff should consider the potential impact that the breach and notification to individuals may have on third parties and take actions accordingly. For example, third parties may be affected if individuals cancel their credit cards or if financial institutions issue new cards.
Consider:
•      third party contractors or other parties who may be impacted;
•      internal business units not previously advised of the breach, (e.g. communications and media relations, senior management)
•      union or other employee representatives
•      Agencies that have a direct relationship with the information lost / stolen: you should consider whether an incident compromises Commonwealth agency identifiers such as Tax File Numbers (TFNs) or Medicare numbers. Notifying agencies such as the Australian Taxation Office for TFNs or Medicare Australia for Medicare card numbers may enable those agencies to provide appropriate information and assistance to affected individuals, and to take steps to protect the integrity of identifiers that may be used in identity theft or other fraud. 
Media Management
ASC Communications staff have prepared a range of template documents for ASC websites, social media accounts, athletes, media, etc. for quick dissemination should a major breach be confirmed.
Major Data Breach
Where a major or high profile breach of privacy has occurred the following notification process should be followed. 

 
Step 4 – Review and prevent further breaches
Once the immediate steps are taken to mitigate the risks associated with the breach, agencies and organisations need to take the time to investigate the cause and consider whether to review the existing prevention plan. A prevention plan should suggest actions that are proportionate to the significance of the breach, and whether it was a systemic breach or an isolated event. This plan may include:
• a security audit of both physical and technical security
• a review of policies and procedures and any changes to reflect the lessons learned from the investigation, and regular reviews after that (for example, security, record retention and collection policies)
• a review of employee selection and training practices
• a review of service delivery partners (for example, offsite data storage providers).
 
Make a record
Remember to record all decisions, actions and correspondence in a file on the authorised records management system Content Manager.
This is vital for evidentiary purposes should complaints, investigations or legal action follow the breach.
It will also assist staff by providing guidance and lessons in handling any possible future breach.
 
Who can I contact for help?
Edgar Crook, Privacy Officer / Assistant Director, Governance and Compliance
Tel. +61 2 6214 1372  
Email: ASC Privacy Officer  
 
- END –

Version	Created by	Originating programme	Approved by	Date	Revision date	CM reference	
1.0	Privacy Officer	Business Operations	Position title	9 April 2018	9 April 2019	2018/026520/D	
1.1	Position title	Division or programme	Position title	XX Month 2015	XX Month 2015	XXXX XXXX