What is a notifiable privacy breach in New Zealand?

Two definitions

A privacy breach (s 112) is unauthorised or accidental access to, or disclosure, alteration, loss or destruction of, personal information, or an action that stops the organisation accessing it, temporarily or permanently. Ransomware that only locks files still counts.

Notifiable privacy breach: a privacy breach that it’s reasonable to believe has caused serious harm to an affected person, or is likely to.

How to decide whether harm is serious

Section 113 lists what the organisation must consider:

1. any action taken to reduce the risk of harm
2. whether the information is sensitive
3. the nature of the harm that may be caused
4. who has obtained, or may obtain, the information
5. whether it was protected by a security measure
6. any other relevant matters

There’s no formula. Think about the most vulnerable person affected. Health, financial, identity, location and intimate information all point towards serious harm. Strong encryption, quick containment and a trustworthy recipient who confirmed deletion point away from it.

What to do if it’s notifiable

• Notify the Privacy Commissioner through NotifyUs, as soon as practicable.
• Notify affected people, as soon as practicable, unless an exception applies. If individual notice isn’t reasonably practicable, a public notice can be used.
• Record everything: the assessment, decisions and dates.

Failing to notify the Commissioner of a notifiable breach is an offence with a fine of up to $10,000.

If it isn’t notifiable

Record the breach and your reasoning in your breach register anyway. The Commissioner may ask why you didn’t notify, and a written assessment against each section 113 factor is your answer. Our breach assessment record produces one.