Encryption safe harbours and data breach notification laws

Data breach notification laws require organisations to notify affected persons or regulatory authorities when an unauthorised acquisition of personal data occurs. Most laws provide a safe harbour to this obligation if acquired data has been encrypted. There are three types of safe harbour: an exemption; a rebuttable presumption and factor-based analysis. We demonstrate, using three condition-based scenarios, that the broad formulation of most encryption safe harbours is based on the flawed assumption that encryption is the silver bullet for personal information protection. We then contend that reliance upon an encryption safe harbour should be dependent upon a rigorous and competent risk-based review that is required on a case-by-case basis. Finally, we recommend the use of both an encryption safe harbour and a notification trigger as our preferred choice for a data breach notification regulatory framework.

Contextualizing the tensions and weaknesses of information privacy and data breach notification laws

Data breach notification laws have detailed numerous failures relating to the protection of personal information that have blighted both corporate and governmental institutions. There are obvious parallels between data breach notification and information privacy law as they both involve the protection of personal information. However, a closer examination of both laws reveals conceptual differences that give rise to vertical tensions between each law and shared horizontal weaknesses within both laws. Tensions emanate from conflicting approaches to the implementation of information privacy law that results in different regimes and the implementation of different types of protections. Shared weaknesses arise from an overt focus on specified types of personal information which results in ‘one size fits all’ legal remedies. The author contends that a greater contextual approach which promotes the importance of social context is required and highlights the effect that contextualization could have on both laws.

The Simple Laws of Proportion

The Simple Laws of Proportion was shortlisted in the 2010 John Marsden Writing Prize for Young Australian Writers. It was subsequently published online by Express Media in December, 2010.

Carbon capture and storage laws in Australia : project facilitation or a precautionary approach?

Carbon capture and storage (CCS) is considered to be an integral transitionary measure in the mitigation of the global greenhouse gas emissions from our continued use of fossil fuels. Regulatory frameworks have been developed around the world and pilot projects have been commenced. However, CCS processes are largely untested at commercial scales and there are many unknowns associated with the long terms risks from these storage projects. Governments, including Australia, are struggling to develop appropriate, yet commercially viable, regulatory approaches to manage the uncertain long term risks of CCS activities. There have been numerous CCS regimes passed at the Federal, State and Territory levels in Australia. All adopt a different approach to the delicate balance facilitating projects and managing risk. This paper will examine the relatively new onshore and offshore regimes for CCS in Australia and the legal issues arising in relation to the implementation of CCS projects. Comparisons will be made with the EU CCS Directive where appropriate.

The exemplification of governance principles within state asset management laws and policies : the case of Indonesia

Efficient state asset management is crucial for governments as they facilitate the fulfillment of their public functions, which include the provision of essential services and other public administration support. In recent times economies internationally and particularly in South east Asia, have displayed increased recognition of the importance of efficiencies across state asset management law, policies and practice. This has been exemplified by a surge in notable instances of reform in state asset management. A prominent theme in this phenomenon is the consideration of governance principles within the re-conceptualization of state asset management law and related policy, with many countries recognizing variability in the quality of asset governance and opportunities for profit as being critical factors. This issue is very current in Indonesia where a major reform process in this area has been confirmed by the establishment of a new Directorate of State Asset Management. The incumbent Director-General of State Asset Management has confirmed a re-emphasis on adherence to governance principles within applicable state asset management law and policy reform. This paper reviews aspects of the challenge of reviewing and reforming Indonesian practice within state asset management law and policy specifically related to public housing, public buildings, parklands, and vacant land. A critical issue in beginning this review is how Indonesia currently conceptualizes the notion of asset governance and how this meaning is embodied in recent changes in law and policy and importantly in options for future change. This paper discusses the potential complexities uniquely Indonesian characteristics such as decentralisation and regional autonomy regime, political history, and bureaucratic culture

Communicating friendships : a case study of women in an Australian 'seachange' town

This thesis proposes =friendworks‘ as an important sub-group of social networks, comprised of networks of friends. It investigates friendworks of a particular group of adult Australian women as a way of understanding neglected aspects of social networking practices. Friendworks are contextualised to highlight two main themes of interest: population mobility and communication practices. The impact of relocation on individuals, local communities and the wider society is explored through a case study of female friendworks in a seachange community. Research findings point to the importance of friendworks in building and cohering social and emotional support, well-being, belonging and senses of place and community. Different types of communication methods were used by research participants for mediating different kinds of social ties within the friendworks considered here. Communication patterns were influenced by geographical proximity to friends, and the type of social support required of them (emotional, instrumental or companionship). Most findings were consistent with broader social patterns of communication. For example, face-to-face interactions were the dominant and most favoured communication method between local friends, regardless of whether they were weak or strong ties. The fixed-telephone and the internet were commonly in use to maintain old and geographically distant social ties, while mobile phones were used the least among friends in comparison with other communication methods. The key finding of this thesis is that friendworks are an extremely important solid network in contemporary society, providing mooring relations in a mobile world. Paradoxically, however, for women in this study, the mobile phone, which is popularly perceived as a flexible, multi-purpose communication technology for people on the move, was the least versatile of all technologies for maintaining friendworks. The cost of services was the main inhibitor here. The internet was found to be the most versatile communication technology and was used to support various types of social ties: strong, weak, local and distant. This thesis also highlights the value of the concept of friendworks as well as networks for communication research and policy investigating individuals‘ motivations and practices.

The review of Australia's asylum laws and policies: a case for strengthening Parliament's role in protecting rights through post-enactment scrutiny

The central contention of this article is that there is a need for greater involvement of legislators in overseeing a systematic and rights-based scrutiny of the impact of legislation and policy. The recent operation of Australia s asylum laws and policies, in particular provides an illustration of the reforms required. Challenges to the rights of non-citizens in Australia and other jurisdictions serve as a reminder of the extent of change required before rights are firmly entrenched in the processes of government. A useful step forward would be to enhance the role of legislators in setting the criteria and agenda for post-enactment scrutiny in light of issues raised during pre-legislative scrutiny.

The conceptual and operational compatibility of data breach notification and information privacy laws

Mandatory data breach notification laws are a novel and potentially important legal instrument regarding organisational protection of personal information. These laws require organisations that have suffered a data breach involving personal information to notify those persons that may be affected, and potentially government authorities, about the breach. The Australian Law Reform Commission (ALRC) has proposed the creation of a mandatory data breach notification scheme, implemented via amendments to the Privacy Act 1988 (Cth). However, the conceptual differences between data breach notification law and information privacy law are such that it is questionable whether a data breach notification scheme can be solely implemented via an information privacy law. Accordingly, this thesis by publications investigated, through six journal articles, the extent to which data breach notification law was conceptually and operationally compatible with information privacy law. The assessment of compatibility began with the identification of key issues related to data breach notification law. The first article, Stakeholder Perspectives Regarding the Mandatory Notification of Australian Data Breaches started this stage of the research which concluded in the second article, The Mandatory Notification of Data Breaches: Issues Arising for Australian and EU Legal Developments (‘Mandatory Notification‘). A key issue that emerged was whether data breach notification was itself an information privacy issue. This notion guided the remaining research and focused attention towards the next stage of research, an examination of the conceptual and operational foundations of both laws. The second article, Mandatory Notification and the third article, Encryption Safe Harbours and Data Breach Notification Laws did so from the perspective of data breach notification law. The fourth article, The Conceptual Basis of Personal Information in Australian Privacy Law and the fifth article, Privacy Invasive Geo-Mashups: Privacy 2.0 and the Limits of First Generation Information Privacy Laws did so for information privacy law. The final article, Contextualizing the Tensions and Weaknesses of Information Privacy and Data Breach Notification Laws synthesised previous research findings within the framework of contextualisation, principally developed by Nissenbaum. The examination of conceptual and operational foundations revealed tensions between both laws and shared weaknesses within both laws. First, the distinction between sectoral and comprehensive information privacy legal regimes was important as it shaped the development of US data breach notification laws and their subsequent implementable scope in other jurisdictions. Second, the sectoral versus comprehensive distinction produced different emphases in relation to data breach notification thus leading to different forms of remedy. The prime example is the distinction between market-based initiatives found in US data breach notification laws compared to rights-based protections found in the EU and Australia. Third, both laws are predicated on the regulation of personal information exchange processes even though both laws regulate this process from different perspectives, namely, a context independent or context dependent approach. Fourth, both laws have limited notions of harm that is further constrained by restrictive accountability frameworks. The findings of the research suggest that data breach notification is more compatible with information privacy law in some respects than others. Apparent compatibilities clearly exist as both laws have an interest in the protection of personal information. However, this thesis revealed that ostensible similarities are founded on some significant differences. Data breach notification law is either a comprehensive facet to a sectoral approach or a sectoral adjunct to a comprehensive regime. However, whilst there are fundamental differences between both laws they are not so great to make them incompatible with each other. The similarities between both laws are sufficient to forge compatibilities but it is likely that the distinctions between them will produce anomalies particularly if both laws are applied from a perspective that negates contextualisation.

Pegasus Town : innovative marketing of a new property venture

Purpose – This paper aims to outline the challenges and tasks involved in a organising and marketing a new venture from conception to sales. It presents an interesting situation with which readers can identify and apply knowledge and skills associated with entrepreneurship and marketing and link this with the key learning objectives of a new venture marketing study unit. Design/methodology/approach – The case is constructed around key principles of marketing and entrepreneurship linked to a description of a contemporary venture written from a participant observer perspective supplemented with knowledge from interviews and archival research. Findings – The case shows how effective a diligent, creative approach to developing and selling a new venture can be. It demonstrates that effective marketing requires more than rote adoption of basic principles – it requires creative thinking and enterprising adaption of relevant principles to address the specific and well defined objectives of the venture. Research limitations/implications – The case is not intended to prescribe a particular marketing method or process; rather it is meant to stimulate creativity in the use of marketing knowledge and skills. Practical implications – The case represents an effective resource for both formal and informal teaching and learning. It demonstrates the requirement for innovative and creative adoption of marketing concepts to fit the demands of a new venture. Originality/value – The case specifically addresses an identified need for learning resources and information tailored to the area of entrepreneurial new venture marketing.