Stakeholder perspectives regarding the mandatory notification of Australian data breaches

The advent of data breach notification laws in the United States (US) has unearthed a significant problem involving the mismanagement of personal information by a range of public and private sector organisations. At present, there is currently no statutory obligation under Australian law requiring public or private sector organisations to report a data breach of personal information to law enforcement agencies or affected persons. However, following a comprehensive review of Australian privacy law, the Australian Law Reform Commission (ALRC) has recommended the introduction of a mandatory data breach notification scheme. The issue of data breach notification has ignited fierce debate amongst stakeholders, especially larger private sector entities. The purpose of this article is to document the perspectives of key industry and government representatives to identify their standpoints regarding an appropriate regulatory approach to data breach notification in Australia.

The mandatory notification of data breaches : issues arising for Australian and EU legal developments

Public and private sector organisations are now able to capture and utilise data on a vast scale, thus heightening the importance of adequate measures for protecting unauthorised disclosure of personal information. In this respect, data breach notification has emerged as an issue of increasing importance throughout the world. It has been the subject of law reform in the United States and in other jurisdictions. This article reviews US, Australian and EU legal developments regarding the mandatory notification of data breaches. The authors highlight areas of concern based on the extant US experience that require further consideration in Australia and in the EU.

Finding a way through the ethical and legal maze : withdrawing medical treatment and euthanasia

This article examines Finnis' and Keown's claim that the intention/foresight distinction should be used as the basis for the lawfulness of withholding and withdrawing medical treatment, rather than the act/omission distinction which is currently used. I argue that whilst the intention/foresight distinction is sound and can apply to palliative pain relief hastening death, it cannot be applied to withholding and withdrawing medical treatment. Instead, the act/omission distinction remains the better basis for the lawfulness of withholding and withdrawal, and law reform is consequently unnecessary.

Notification of data breaches under the continuous disclosure regime

Consumer personal information is now a valuable commodity for most corporations. Concomitant with increased value is the expansion of new legal obligations to protect personal information. Mandatory data breach notification laws are an important new development in this regard. Such laws require a corporation that has suffered a data breach, which involves personal information, such as a computer hacking incident, to notify those persons who may have been affected by the breach. Regulators may also need to be notified. Australia currently does not have a mandatory data breach notification law but this may be about to change. The Australian Law Reform Commission has suggested that a data breach notification scheme be implemented through the Privacy Act 1988 (Cth). However, the notification of data breaches may already be required under the continuous disclosure regime stipulated by the Corporations Act 2001 (Cth) and the Australian Stock Exchange (ASX) Listing Rules. Accordingly, this article examines whether the notification of data breaches is a statutory requirement of the existing continuous disclosure regime and whether the ASX should therefore be notified of such incidents.

Australian data breach notification : avoiding the State/Federal overlap

Mandatory data breach notification has become a matter of increasing concern for law reformers. In Australia, this issue was recently addressed as part of a comprehensive review of privacy law conducted by the Australian Law Reform Commission (ALRC) which recommended a uniform national regime for protecting personal information applicable to both the public and private sectors. As in all federal systems, the distribution of powers between central and state governments poses problems for national consistency. In the authors’ view, a uniform approach to mandatory data breach notification has greater merit than a ‘jurisdiction specific’ approach epitomized by US state-based laws. The US response has given rise to unnecessary overlaps and inefficiencies as demonstrated by a review of different notification triggers and encryption safe harbors. Reviewing the US response, the authors conclude that a uniform approach to data breach notification is inherently more efficient.

The legal role of medical professionals in decisions to withhold or withdraw life-sustaining treatment : Part 1 (New South Wales)

This is the first article in a series of three that examines the legal role of medical professionals in decisions to withhold or withdraw life-sustaining treatment from adults who lack capacity. This article considers the position in New South Wales. A review of the law in this State reveals that medical professionals play significant legal roles in these decisions. However, the law is problematic in a number of respects and this is likely to impede medical professionals’ legal knowledge in this area. The article examines the level of training medical professionals receive on issues such as advance directives and substitute decision-making, and the available empirical evidence as to the state of medical professionals’ knowledge of the law at the end of life. It concludes that there are gaps in legal knowledge and that law reform is needed in New South Wales.

The legal role of medical professionals in decisions to withhold or withdraw life-sustaining treatment : Part 2 (Queensland)

This is the second article in a series of three that examines the legal role of medical professionals in decisions to withhold or withdraw life-sustaining treatment from adults who lack capacity. This article considers the position in Queensland, including the parens patriae jurisdiction of the Supreme Court. A review of the law in this State reveals that medical professionals play significant legal roles in these decisions. However, the law is problematic in a number of respects and this is likely to impede medical professionals’ legal knowledge in this area. The article examines the level of training medical professionals receive on issues such as advance health directives and substitute decision-making, and the available empirical evidence as to the state of medical professionals’ knowledge of the law at the end of life. It concludes that there are gaps in legal knowledge and that law reform is needed in Queensland.

The legal role of medical professionals in decisions to withhold or withdraw life-sustaining treatment : part 3 (Victoria)

This is the final article in a series of three that examines the legal role of medical professionals in decisions to withhold or withdraw life-sustaining treatment from adults who lack capacity. This article considers the position in Victoria. A review of the law in this State reveals that medical professionals play significant legal roles in these decisions. However, the law is problematic in a number of respects and this is likely to impede medical professionals’ legal knowledge in this area. The article examines the level of training that medical professionals receive on issues such as refusal of treatment certificates and substitute decision-making, and the available empirical evidence as to the state of medical professionals’ knowledge of the law at the end of life. It concludes that there are gaps in legal knowledge and that law reform is needed in Victoria. The article also draws together themes from the series as a whole, including conclusions about the need for more and better medical education and about law reform generally.

The politics of charity

For the first time since 1601, a number of leading common law nations have almost simultaneously chosen to revise and place on the statute books the law relating to charity. The Politics of Charity examines the reasons for this and for the varying legislative outcomes. ----- ----- ----- This book examines the legal framework and political significance of charity, as developed within England & Wales, contrasts this with the experiences of other common law nations and explores the resulting implications for government/sector relationships in those countries. It suggests that charity law lies at the heart of the relationship between government and the non profit sector, that there is an unmistakeable political agenda driving charity law reform and that the differential in legislative outcomes reflects important differences in the policies pursued by the governments concerned.----- ----- ----- Looking at fundamentally different approaches of government towards the sector in the UK, Ireland, the US, New Zealand, Canada, Singapore and Australia, O’Halloran argues the results will have implications for the present workings of parliamentary democracy.----- ----- ----- The Politics of Charity will be a valuable resource for academics, regulators and legal practitioners as well as advanced and postgraduate students in law, politics and public policy.

What once was old is new again: reviving an early-modern form of interdisciplinarity for socio-legal studies

Socio-legal studies are an essentially interdisciplinary enterprise. However, there is currently only one form of interdisciplinarity that most socio-legal scholars (and criminologists) recognise and work with. This form is derived from the idea that 'society itself' - and by this most scholars mean 'civil society' - drives the law. However, another, rival understanding of society, which we term the authoritarian-liberal statist understanding that slipped from view in the late seventeenth century and remained obscure from then until now, may be used to generate another form of interdisciplinarity for sOcio-legal studies (and for criminology). However, this rival understanding of society does not simply allow us to reconfigure our notion of 'society'; it radically changes the role society plays in relation to the law. Two crucial points emerge from this rival account: first, society can no longer be understood as separable from (even though interacting with) the law; and second, society can no longer be understood as driving the law.

Entry into Valhalla : contextualising the learning of legal ethics through the use of Second Life machinima

An ability to recognise and resolve ethical dilemmas was identified by the Australian Law Reform Commission as one of the ten fundamental lawyering skills. While the ‘Priestley 11’ list of areas of law required to qualify for legal practice includes ethics and professional responsibility, the commitment to ethics learning in Australian law schools has been far from uniform. The obligation imposed by the Priestley 11 is frequently discharged by a traditional teaching and learning approach involving lectures and/or tutorials and focusing on the content of the formal rules of professional responsibility. However, the effectiveness of such an approach is open to question. Instead, a practical rather than a theoretical approach to the teaching of legal ethics is required. Effective final-year student learning of ethics may be achieved by an approach which engages students, enabling them to appreciate the relevance of what they are learning to the real world and facilitating their transition from study to their working lives. Entry into Valhalla comprises a suite of modules featuring ‘machinima’ (computer-generated imagery) created using the Second Life virtual environment to contextualise otherwise abstract concepts. It provides an engaging learning environment which enables students to obtain an appreciation of ethical responsibility in a real-world context and facilitates understanding and problem-solving ability.

Enduring documents : improving the forms, improving the outcomes

Most Australian states have introduced legislation to provide for enduring documents for financial, personal and health care decision making in the event of incapacity. Since the introduction of Enduring Powers of Attorney (EPAs) and Advance Health Directives (AHDs) in Queensland in 1998, concerns have continued to be raised by service providers, professionals and individuals about the uptake, understanding and appropriate use of these documents. In response to these concerns, the Department of Justice and Attorney-General (DJAG) convened a Practical Guardianship Initiatives Working Party. This group identified the limited evidence base available to address these concerns. In 2009, a multidisciplinary research team from the University of Queensland and the Queensland University of Technology was awarded $90,000 from the Legal Practitioners Interest on Trust Account Fund to undertake a review of the current EPA and AHD forms. The goal of the research was to gather data on the content and useability of the forms from the perspectives of a range of stakeholders, particularly those completing the EPA and AHD, witnesses of these documents, attorneys appointed under an EPA, and health professionals involved in the completion of an AHD or dealing with it in a clinical context. The researchers also sought to gather information from the perspective of Aboriginal and Torres Strait Islander (ATSI) individuals as well people from culturally and linguistically diverse (CALD) groups. Although the focus of the research was on the forms and the extent to which the current design, content and format represents a barrier to uptake, in the course of the research, some broader issues were identified which have an impact on the effectiveness of the EPA and AHD in achieving the goals of planning for financial and personal and health care in advance of losing capacity. The data gathered enabled the researchers to achieve the primary goal of the research: to make recommendations to improve the content and useability of the forms which hopefully will lead to an increased uptake and appropriate use of the forms. However, the researchers thought it was important not to ignore broader policy issues that were identified in the course of the research. These broader issues have been highlighted in this Report, and the researchers have responded to them in a variety of ways. For some issues, the researchers have suggested alterations that could be made to the forms to address the particular concerns. For other issues, the researchers have suggested that Government may need to take specific action such as educating the broader community with some attention to strategies that engage particular groups within communities. Other concerns raised can only be dealt with by legislative reform and, in some of these cases, the researchers have identified issues that Government may wish to consider further. We do note, however, that it is beyond the scope of this Report to recommend changes to the law. This three stage mixed methods project aimed to provide systematic evidence from a broad range of stakeholders in regard to: (i) which groups use and do not use these documents and why, (ii) the contribution of the length/complexity/format/language of the forms as barriers to their completion and/or effective use, and (iii) the issues raised by the current documents for witnesses and attorneys. Understanding and use of EPAs and AHDs were generally explored in separate but parallel processes. A purposive sampling strategy included users of the documents as principals and attorneys, and professionals, witnesses and service providers who assist others to execute or use the forms. The first component of this study built on existing knowledge using a Critical Reference Group and material provided by the DJAG Practical Guardianship Initiatives Working Party. This assisted in the development of the data collection tools for subsequent stages. The second component comprised semi-structured interviews and focus groups with a targeted sample of current users of the forms, potential users, witnesses and other professionals to provide in-depth information on critical issues. Outreach to Aboriginal and Torres Strait Islander Elders and individuals and workers with CALD groups ensured a broad sample of potential users of the two documents. Fifty individual interviews and three focus groups were completed. Most interviews and focus groups focused on perceptions of, and experiences with, either the EPA or the AHD form. In the interviews with Indigenous people and the CALD focus groups, however, respondents provided their perceptions and experiences of both documents. In general, these respondents had not used the forms and were responding to the documents made available in the interview or focus group. In total, seventy-seven individuals were involved in interviews or focus groups. The final component comprised on-line surveys for EPA principals, EPA attorneys, AHD principals, witnesses of EPAs and AHDs and medical practitioners with experience of AHDs as nominated and/or treating doctors. The surveys were developed from the initial component and the qualitative analysis of the interview and focus group data. A total of 116 surveys were returned from major cities and regional Queensland. The survey data was analysed descriptively for patterns and trends. It is important to note that the aim of the survey was to gain insight into issues and concerns relating to the documents and not to make generalisations to the broader population.

Rethinking regulatory design : The Australian National Classification Scheme review

This paper considers issues of methodological innovation in communication, media and cultural studies, that arise out of the extent to which we now live in a media environment characterised by an digital media abundance, the convergence of media platforms, content and services, and the globalisation of media content through ubiquitous computing and high-speed broadband networks. These developments have also entailed a shift in the producer-consumer relationships that characterised the 20th century mass communications paradigm, with the rapid proliferation of user-created content, accelerated innovation, the growing empowerment of media users themselves, and the blurring of distinctions between public and private, as well as age-based distinctions in terms of what media can be accessed by whom and for what purpose. It considers these issues through a case study of the Australian Law Reform Commission's National Classification Scheme Review.

The conceptual and operational compatibility of data breach notification and information privacy laws

Mandatory data breach notification laws are a novel and potentially important legal instrument regarding organisational protection of personal information. These laws require organisations that have suffered a data breach involving personal information to notify those persons that may be affected, and potentially government authorities, about the breach. The Australian Law Reform Commission (ALRC) has proposed the creation of a mandatory data breach notification scheme, implemented via amendments to the Privacy Act 1988 (Cth). However, the conceptual differences between data breach notification law and information privacy law are such that it is questionable whether a data breach notification scheme can be solely implemented via an information privacy law. Accordingly, this thesis by publications investigated, through six journal articles, the extent to which data breach notification law was conceptually and operationally compatible with information privacy law. The assessment of compatibility began with the identification of key issues related to data breach notification law. The first article, Stakeholder Perspectives Regarding the Mandatory Notification of Australian Data Breaches started this stage of the research which concluded in the second article, The Mandatory Notification of Data Breaches: Issues Arising for Australian and EU Legal Developments (‘Mandatory Notification‘). A key issue that emerged was whether data breach notification was itself an information privacy issue. This notion guided the remaining research and focused attention towards the next stage of research, an examination of the conceptual and operational foundations of both laws. The second article, Mandatory Notification and the third article, Encryption Safe Harbours and Data Breach Notification Laws did so from the perspective of data breach notification law. The fourth article, The Conceptual Basis of Personal Information in Australian Privacy Law and the fifth article, Privacy Invasive Geo-Mashups: Privacy 2.0 and the Limits of First Generation Information Privacy Laws did so for information privacy law. The final article, Contextualizing the Tensions and Weaknesses of Information Privacy and Data Breach Notification Laws synthesised previous research findings within the framework of contextualisation, principally developed by Nissenbaum. The examination of conceptual and operational foundations revealed tensions between both laws and shared weaknesses within both laws. First, the distinction between sectoral and comprehensive information privacy legal regimes was important as it shaped the development of US data breach notification laws and their subsequent implementable scope in other jurisdictions. Second, the sectoral versus comprehensive distinction produced different emphases in relation to data breach notification thus leading to different forms of remedy. The prime example is the distinction between market-based initiatives found in US data breach notification laws compared to rights-based protections found in the EU and Australia. Third, both laws are predicated on the regulation of personal information exchange processes even though both laws regulate this process from different perspectives, namely, a context independent or context dependent approach. Fourth, both laws have limited notions of harm that is further constrained by restrictive accountability frameworks. The findings of the research suggest that data breach notification is more compatible with information privacy law in some respects than others. Apparent compatibilities clearly exist as both laws have an interest in the protection of personal information. However, this thesis revealed that ostensible similarities are founded on some significant differences. Data breach notification law is either a comprehensive facet to a sectoral approach or a sectoral adjunct to a comprehensive regime. However, whilst there are fundamental differences between both laws they are not so great to make them incompatible with each other. The similarities between both laws are sufficient to forge compatibilities but it is likely that the distinctions between them will produce anomalies particularly if both laws are applied from a perspective that negates contextualisation.

The Australian nonprofit sector legal and accounting almanac 2011

Summaries of legal cases, legislation and developments in law and accounting relevant to nonprofit organisations and charity law during 2011; including articles on special issues such as accounting standards and the chart of accounts; law reform (e.g. the new national regulator, the Australian Charities and Not-for-profits Commission); and taxation.