FuturePlus: Information Security Management Data Breach Report

This report addresses a data breach scenario involving the charity organization FuturePlus and the mishandling of donor information by its accountant. The report analyzes the legal implications of such a breach, specifically referencing the Privacy Act 1988 (Cth) and its provisions regarding the protection of personal information. It outlines the obligations of organizations under the Australian Privacy Principles (APPs), the potential for penalties under the Crimes Act 1914 (Cth), and the role of the Commissioner in addressing data breaches. The report emphasizes the importance of data security and the consequences of non-compliance, including financial penalties and reputational damage, providing a comprehensive overview of the legal and regulatory landscape surrounding data protection in the context of the FuturePlus scenario.

INFORMATION SECURITY MANAGEMENT
INFORMATION SECURITY MANAGEMENT
Name of Student
Name of University
Author Note

1INFORMATION SECURITY MANAGEMENT
Legal Issues related to Data Mishandling by Accountant
The protection and handling of personal data is maintained by organizations under the
provisions of the Privacy Act 1988. The breach of data happens if there is an unauthorized access
or disclosure of any personal information. Under the provisions of the Privacy Act 13 Australian
Privacy Principles (APPs) are present in which the obligations of entities are set out for the
management of personal information.
Under section 26WK of the Privacy Act 1988 if there is any reasonable ground for
believing that any breach of the data contradicting the Australian Privacy Principles is present an
organization should prepare a statement setting out all the relevant information about the eligible
data breach and any recommendation for any steps to be taken by individuals in relation to the
breach. As per the section after the statement has been prepared the organization a copy of it
should be given to the Commissioner.
As per section 80W of the Privacy Act 1988 the Commissioner has the power to apply to
the Federal Court for an order for the payment of a penalty stating that there has been a
contravention of the civil penalty provision of the Act. The penalty would be specified by way of
penalty units contained in section 44A of the Crimes Act 1914 (Cth). For any data breach by the
organization the Federal Court would be ordering for a penalty under the provisions of the
Crimes Act (OAIC, 2018).

2INFORMATION SECURITY MANAGEMENT
Reference
Privacy Act 1988 (Cth)
Crimes Act 1914 (Cth)
OAIC. (2018). Chapter 6: Civil penalties — serious or repeated interference with privacy and
other penalty provisions. Retrieved 5 August 2019, from https://www.oaic.gov.au/about-us/our-
regulatory-approach/guide-to-privacy-regulatory-action/chapter-6-civil-penalties