Data Breach and Privacy

When it comes to the collection, usage, management, storage, safety and disclosure of commercial data and personal information it is important for businesses to assess risk and develop policies to manage and protect the data they hold. Murfett Legal is experienced in assisting clients to develop practical privacy and data collection policies tailored to their business, and advising on cost-effective processes that comply with internal data policies and legislation.

We assist clients to make sense of the laws regulating the collection, management and use of personal information, IP and confidential information including the Commonwealth Privacy Act, the Do Not Call Register Act, the Spam Act, and secrecy provisions in legislation.

Our services include:

• Document and data security, retention and destruction policies.
• Employment and workplace privacy including monitoring and surveillance.
• Online communications, email procedures and “bring your own device” policies.
• Privacy and data management policies, including compliance with usage audits.
• Workplace conduct, communications and social media use policies.

Clients seek our advice for data protection, securing confidential information, intellectual property and trade secrets. We help identify risks and develop strategies to prevent data loss through unauthorised access, disclosure or theft. We also assist clients in the preparation of business continuity, disaster recovery, and cyber security plans and policies to mitigate the impact of breaches and comply with legislation.

Where clients have experienced actual or suspected unauthorised data breaches, we assist with the legal ramifications and collaborate with media relations, forensic specialists and law enforcement authorities where appropriate.

Our services include:

• Data security policies and cyber security incident response plans
• Responding to actual or suspected unauthorised data breaches
• Cybercrime laws and litigation
• Development of data loss policies relating to unauthorised third-party access and theft
• Strategies to mitigate security breaches
• Obtaining court orders
• Litigation related to cyber security, privacy, intellectual property and information breaches

The Australian Privacy Principles (or APPs) form the foundation of the privacy protection framework in the Privacy Act 1988 (Privacy Act). Thirteen Australian Privacy Principles govern standards, rights and obligations around four main areas:

• Collection, use and disclosure of personal information
• Governance and accountability
• Integrity and correction of personal information
• Individual’s rights to access their personal information

There are numerous obligations placed on businesses under the Privacy Act in Australia. We advise clients on all aspects of Australian Privacy Act compliance and data breach protection.

The Privacy Act places a strict obligation on businesses with an annual turnover of more than $3million, or operating in certain areas regardless of turnover, to protect the privacy of individuals and to have an open, transparent and secure approach to the handling of any personal information, including the development and adoption of a Privacy Policy.

An additional requirement of the Privacy Act is that entities must notify individuals when a data breach occurs that could result in serious harm to those individuals. When not handled well, these notifications can destroy a business and harm business reputation.  We advise clients on how to handle these types of incidents to minimise negative impacts that could result.