sec.51Agency must give statement about eligible data breach to information commissioner

### sec.51 Agency must give statement about eligible data breach to information commissioner The agency must, as soon as practicable after forming the belief mentioned in section 50 — prepare a statement that includes the information stated in subsection (2) ; and give the statement to the information commissioner. For subsection (1) (a) , the statement must, to the extent it is reasonably practicable, include the following information— the information that must be included in a notification given under section 53 (2) (a) to (e) , (h) and (i) ; a description of the kind of personal information the subject of the data breach, without including any personal information in the description; the agency’s recommendations about the steps individuals should take in response to the data breach; whether the agency is reporting on behalf of other agencies affected by the same data breach and, if so, the details of the other agencies; the total number or, if it is not reasonably practicable to work out the total number, an estimate of the total number of each of the following— the individuals whose personal information has been accessed, disclosed or lost; affected individuals for the data breach; either— the total number of individuals notified of the data breach or, if it is not reasonably practicable to work out the total number, an estimate of the total number; or if section 57 is relied on, the total number of individuals who would have been notified if that section had not been relied on or, if it is not reasonably practicable to work out the total number, an estimate of the total number; whether the individuals notified have been advised about how to make a privacy complaint to the agency under section 166A . s 51 amd 2009 No. 48 s 221 sub 2023 No. 32 s 33 (sec.51-ssec.1) The agency must, as soon as practicable after forming the belief mentioned in section 50 — prepare a statement that includes the information stated in subsection (2) ; and give the statement to the information commissioner. (sec.51-ssec.2) For subsection (1) (a) , the statement must, to the extent it is reasonably practicable, include the following information— the information that must be included in a notification given under section 53 (2) (a) to (e) , (h) and (i) ; a description of the kind of personal information the subject of the data breach, without including any personal information in the description; the agency’s recommendations about the steps individuals should take in response to the data breach; whether the agency is reporting on behalf of other agencies affected by the same data breach and, if so, the details of the other agencies; the total number or, if it is not reasonably practicable to work out the total number, an estimate of the total number of each of the following— the individuals whose personal information has been accessed, disclosed or lost; affected individuals for the data breach; either— the total number of individuals notified of the data breach or, if it is not reasonably practicable to work out the total number, an estimate of the total number; or if section 57 is relied on, the total number of individuals who would have been notified if that section had not been relied on or, if it is not reasonably practicable to work out the total number, an estimate of the total number; whether the individuals notified have been advised about how to make a privacy complaint to the agency under section 166A . - (a) prepare a statement that includes the information stated in subsection (2) ; and - (b) give the statement to the information commissioner. - (a) the information that must be included in a notification given under section 53 (2) (a) to (e) , (h) and (i) ; - (b) a description of the kind of personal information the subject of the data breach, without including any personal information in the description; - (c) the agency’s recommendations about the steps individuals should take in response to the data breach; - (d) whether the agency is reporting on behalf of other agencies affected by the same data breach and, if so, the details of the other agencies; - (e) the total number or, if it is not reasonably practicable to work out the total number, an estimate of the total number of each of the following— (i) the individuals whose personal information has been accessed, disclosed or lost; (ii) affected individuals for the data breach; - (i) the individuals whose personal information has been accessed, disclosed or lost; - (ii) affected individuals for the data breach; - (f) either— (i) the total number of individuals notified of the data breach or, if it is not reasonably practicable to work out the total number, an estimate of the total number; or (ii) if section 57 is relied on, the total number of individuals who would have been notified if that section had not been relied on or, if it is not reasonably practicable to work out the total number, an estimate of the total number; - (i) the total number of individuals notified of the data breach or, if it is not reasonably practicable to work out the total number, an estimate of the total number; or - (ii) if section 57 is relied on, the total number of individuals who would have been notified if that section had not been relied on or, if it is not reasonably practicable to work out the total number, an estimate of the total number; - (g) whether the individuals notified have been advised about how to make a privacy complaint to the agency under section 166A . - (i) the individuals whose personal information has been accessed, disclosed or lost; - (ii) affected individuals for the data breach; - (i) the total number of individuals notified of the data breach or, if it is not reasonably practicable to work out the total number, an estimate of the total number; or - (ii) if section 57 is relied on, the total number of individuals who would have been notified if that section had not been relied on or, if it is not reasonably practicable to work out the total number, an estimate of the total number;