Privacy Act 1988
View history note
Hide history noteScope
26WE(1)
This section applies if:
(a) both:
(i) an APP entity holds personal information relating to one or more individuals; and
(ii) the APP entity is required under section 15 not to do an act, or engage in a practice, that breaches Australian Privacy Principle 11.1 in relation to the personal information; or
(b) both:
(i) a credit reporting body holds credit reporting information relating to one or more individuals; and
(ii) the credit reporting body is required to comply with section 20Q in relation to the credit reporting information; or
(c) both:
(i) a credit provider holds credit eligibility information relating to one or more individuals; and
(ii) the credit provider is required to comply with subsection 21S(1) in relation to the credit eligibility information; or
(d) both:
(i) a file number recipient holds tax file number information relating to one or more individuals; and
(ii) the file number recipient is required under section 18 not to do an act, or engage in a practice, that breaches a section 17 rule that relates to the tax file number information.
Eligible data breach
26WE(2)
For the purposes of this Act, if:
(a) both of the following conditions are satisfied:
(i) there is unauthorised access to, or unauthorised disclosure of, the information;
(ii) a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates; or
[ CCH Note: No 12 of 2017, s 3 and Sch 1 item 6(1) provides that para (a) is applicable to an access or disclosure that happens after the commencement of this item.]
(b) the information is lost in circumstances where:
(i) unauthorised access to, or unauthorised disclosure of, the information is likely to occur; and
(ii) assuming that unauthorised access to, or unauthorised disclosure of, the information were to occur, a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates;
[ CCH Note: No 12 of 2017, s 3 and Sch 1 item 6(2) provides that para (b) is applicable to a loss that happens after the commencement of this item.]
then:
(c) the access or disclosure covered by paragraph (a), or the loss covered by paragraph (b), is an eligible data breach of the APP entity, credit reporting body, credit provider or file number recipient, as the case may be; and
(d) an individual covered by subparagraph (a)(ii) or (b)(ii) is at risk from the eligible data breach.
26WE(3)
Subsection (2) has effect subject to section 26WF .
Disclaimer and notice of copyright applicable to materials provided by CCH Australia Limited
CCH Australia Limited ("CCH") believes that all information which it has provided in this site is accurate and reliable, but gives no warranty of accuracy or reliability of such information to the reader or any third party. The information provided by CCH is not legal or professional advice. To the extent permitted by law, no responsibility for damages or loss arising in any way out of or in connection with or incidental to any errors or omissions in any information provided is accepted by CCH or by persons involved in the preparation and provision of the information, whether arising from negligence or otherwise, from the use of or results obtained from information supplied by CCH.
The information provided by CCH includes history notes and other value-added features which are subject to CCH copyright. No CCH material may be copied, reproduced, republished, uploaded, posted, transmitted, or distributed in any way, except that you may download one copy for your personal use only, provided you keep intact all copyright and other proprietary notices. In particular, the reproduction of any part of the information for sale or incorporation in any product intended for sale is prohibited without CCH's prior consent.
