59HAssessment of data breach—factors for consideration

59H Assessment of data breach—factors for consideration

59H Assessment of data breach—factors for consideration

Without limiting the factors that may be considered by the assessor carrying out the assessment, the assessor may consider the following—

(a) the types of personal information involved in the breach,

(b) the sensitivity of the personal information involved in the breach,

(c) whether the personal information is or was protected by security measures,

(d) the persons to whom the unauthorised access to, or unauthorised disclosure of, the personal information involved in the breach was, or could be, made or given,

(e) the likelihood the persons specified in paragraph (d)—

(i) have or had the intention of causing harm, or

(ii) could or did circumvent security measures protecting the information,

(f) the nature of the harm that has occurred or may occur,

(g) other matters specified in guidelines issued by the Privacy Commissioner about whether the disclosure is likely to result in serious harm to an individual to whom the personal information relates.

s 59H: Ins 2009 No 54, Sch 1 [1] (transferred from the Freedom of Information Act 1989 No 5). Renumbered and am 2009 No 54, Sch 1 [1]–[11]). Rep 2010 No 71, Sch 1 [10]. Ins 2022 No 74, Sch 1[11].