{"id":16395,"date":"2018-02-22T12:46:49","date_gmt":"2018-02-22T01:46:49","guid":{"rendered":"https:\/\/www.bullhorn.com\/au\/?p=16395"},"modified":"2019-03-02T09:09:33","modified_gmt":"2019-03-01T22:09:33","slug":"the-new-data-privacy-law-your-recruitment-agency-cant-risk-breaching","status":"publish","type":"post","link":"https:\/\/www.bullhorn.com\/au\/blog\/the-new-data-privacy-law-your-recruitment-agency-cant-risk-breaching\/","title":{"rendered":"The New Data Privacy Law Your Recruitment Agency Can\u2019t Risk Breaching"},"content":{"rendered":"

The new Privacy Amendment to the Notifiable Data Breaches (NDB) Bill 2016, which comes into effect on the 22nd of February 2018, is a game-changer recruiters \u201cshould ignore at their peril\u201d, warned the Association of Professional Staffing Companies in Australia (<\/span>APSCo Australia<\/span><\/a>).<\/span><\/p>\n

The purpose of the change is to incentivise entities that hold personal information to secure and dispose of the data properly. This includes particulars such as contact details, credit information, and tax file numbers. The law will require agencies to report a data breach of a single record or more to the Office of the Australian Information Commissioner (<\/span>OAIC<\/span><\/a>) and to inform any individuals affected. So, what does this mean for your recruitment agency?<\/span><\/p>\n

Every Recruitment Agency and Recruiter Must Comply<\/b><\/h3>\n

It\u2019s important to note that while the legislation generally only applies to businesses with a turnover of more than $3M, recruitment agencies are the exception to the rule and every single one in Australia must comply because even small firms hold enough valuable private data to be a concern. In fact, many are more vulnerable because they lack the resources to keep the information they do have secure. And while hacking is often seen as the biggest threat, data breaches can also come from consultants being careless with passwords, using unencrypted files, <\/span>not shredding confidential information<\/span><\/a>, or leaving papers unsecured. Any agency, regardless of size, can be at risk.<\/span><\/p>\n

The Consequences of a Breach<\/b><\/h3>\n

The OAIC must be informed within 30 days of there being sufficient grounds to believe that an eligible breach has occurred, except for minor ones which can be remediated beforehand. The penalties are significant: for serious or repeated non-compliance, there are fines of up to $360,000 for individuals and $1.8M for organisations. Beyond the fines, agencies could face additional costs such as reputational damage, the costs of business interruption, third-party claims, and the risk of clients and candidates turning to competitors.<\/span><\/p>\n

The new rules don\u2019t define what exactly constitutes a serious breach, but they do say that as a result of one, \u201cthere is a likely risk of serious harm to the affected individuals [\u2026] and this can include physical, psychological, emotional, economic and financial harm, and also includes serious harm to reputation\u201d according to the <\/span>Parliament of Australia<\/span><\/a>.<\/span><\/p>\n

What Should Agencies Be Doing to Prepare?<\/b><\/h3>\n

Julie Mills, Managing Director of APSCo Australia, <\/span>warns that, as a minimum<\/span><\/a>, \u201cOrganisations should have commenced preparations by reviewing their data risk profile and considering cyber insurance and an incident response plan.\u201d Consider, for example:<\/span><\/p>\n