1. Interpreting Privacy Principles: Chaos or Consistency?
Symposium
Interpreting Privacy Principles: Chaos or Consistency?
17 May 2006, Sydney
Interpreting the Security Principle
Nigel Waters, Principal Researcher

2. Methodology of Investigation
Identify issues
Identify ‘cases’ expressly involving the security principle
Primary source - WorldLII Privacy Law Project
Identify issues – from Guidelines, previous analysis/papers, own experience
Identify ‘cases’ expressly involving the security principle – by e.g. key words in case summaries (Cases include Commissioner/tribunal/court decisions; settled complaint summaries; reports of own-motion investigations; audit reports)
Primary source - WorldLII Privacy Law Project

4. Methodology of Investigation
Search for relevant material
Iterative process
Will review all published cases
Initial focus on information privacy laws
Progressively extension to other relevant laws
Search across and within main privacy caselaw and commentary databases
Iterative process – as other cases reviewed, new issues identified
Project will aim to review all published cases
Initial focus on principal information privacy laws - will also progressively extend scope to other relevant laws – e.g. surveillance laws, laws with secrecy provisions

5. Security measures are designed to mitigate
… Unauthorised Use of p.i.
… Unauthorised Disclosure of p.i. …
… Loss or corruption of p.i.
Security measures are designed to mitigate
the RISK of …
… by someone with authorised access
i.e. exceeding their authority
… by an unauthorised third party
e.g. by hacking or phishing
Misuse
Including: Authorised but improper use?

6. Security Principle - Issues
Reasonableness
Generic Industry standards vs customised standards for personal information?
Generic ‘all mode’ vs mode/technology-specific standards
Human (Personnel) security
Reasonableness
Implies proportionality
Need to take account of tensions between security and: Efficiency, Convenience, Accountability,Historical/archival objectives
Some of these tensions also involves quality, retention and correction principles
‘Need to know’ principle
Generic Industry standards vs customised standards for personal information?
How far can users rely on security industry standards without at least analysing their adequacy for personal information, and if necessary refining and adapting the standards?
Should privacy regulators be more involved in specification and design of security tools?
Generic ‘all mode’ vs mode/technology-specific standards
e.g. are same standards required for paper/computer records and for Information in transit by different means - post/fax/ /data/voice transmission? (Communications security)
Many of the issues are the same, but new technologies give rise to additional issues and may affect the conclusion (e.g. whole subset of issues about passwords/PINS, encryption and logging and audit trails (cases inc cost – FH case – applicable to non IT security?)
Human (Personnel) security
Selection, training, monitoring (employee privacy issues)

7. Security Principle - Issues
Liability – organisation vs employee vs contractors
Relationship between security and disclosure
Carelessness
Liability – organisation vs employee vs contractors
In what circumstances can organisation walk away from responsibility for effect of a security breach?
Relationship between security and disclosure
An ‘event’ that breaches use/disclosure/quality principle does not necessarily mean a breach of security principle.
Does there have to have been an event for there to have been a breach of the security principle?
Does a complainant have to have been personally affected by an event to have standing to bring a complaint about a security breach?
Carelessness
Many examples – highlight NV case