What counts as a data breach?
A data breach is when confidential taxpayer information is accessed by an unauthorised third party. Tax professionals hold a lot of client, staff and business information, which makes them a growing target.
Breaches come from stolen computers or paper records, people with legitimate access misusing it, fraudulently obtained credentials such as myID, hacking or phishing, accidental disclosure such as an email to the wrong person, and cloud services accessed without permission.
Remember
- Includes accidents and paper, not just hacking.
- Misuse by someone with legitimate access counts.
Facts and sources for this part
- A data breach is when confidential taxpayer information is accessed by an unauthorised third party. Tax professionals hold a lot of client, staff and business information, which makes them a growing target for identity thieves. [S11]
- Breaches can come from stolen computers or paper records, people with legitimate access misusing it, credentials such as myID being fraudulently obtained, hacking or phishing, accidental disclosure such as an email to the wrong person, and cloud services being accessed without permission. [S11]
How would you notice?
Signs include lodgments on client accounts you did not make, changes to client files you did not make, being unable to log in or finding account verification emails deleted, and devices running abnormally.
Tell your staff these signs. The person who first notices is often not the principal.
Remember
- Unexpected lodgments.
- Deleted verification emails.
- Slow or glitching devices.
Facts and sources for this part
- Signs of a breach include lodgments on client accounts you did not make, changes to client files you did not make, being unable to log in or finding account verification emails deleted, and devices running abnormally. [S11]
The first steps
The OAIC's four steps are: contain the breach, assess it, notify if required, and review it to prevent future breaches. Have a written response plan with roles and responsibilities, and review and test it.
Phone the ATO Client Identity Support Centre on 1800 467 033 so protective measures can be put on client accounts. Tell affected clients and staff, contact your software provider, and remove access people no longer need.
Remember
- Contain, assess, notify, review.
- ATO first: 1800 467 033.
- IDCARE (1800 595 160) offers free support to victims.
Facts and sources for this part
- The OAIC's four steps after a breach are: contain it, assess it, notify if required, and review it to prevent future breaches. [S21]
- The ATO says it is crucial to have a data breach response plan, with roles and responsibilities, and to review and test it. [S11]
- After a breach, phone the ATO Client Identity Support Centre on 1800 467 033 so protective measures can be put on client accounts, tell affected clients and staff, contact your software provider, secure your systems and remove access people no longer need. [S11]
- IDCARE provides free advice and confidential support to victims of data breaches and identity theft. Its number is 1800 595 160. [S11]
Does the Notifiable Data Breaches scheme apply to you?
The scheme covers organisations with an annual turnover of more than AU$3 million, and TFN recipients. Most small businesses (annual turnover of $3 million or less) are not covered by the Privacy Act, but some are.
Tax practitioners who hold TFN information are covered for breaches that involve TFN information. A small business that must secure TFN information need not notify about breaches that affect other types of information.
Remember
- Hold client TFNs? Assume the scheme applies to those records.
- Check turnover and other triggers; get advice if unsure.
Facts and sources for this part
- Tax practitioners who hold tax file number information are covered by the Notifiable Data Breaches scheme for breaches that involve TFN information. [S23] [S35]
- The scheme covers organisations with an annual turnover of more than AU$3 million and TFN recipients. A small business that must secure TFN information need not notify about breaches that affect other types of information. [S19]
- Most small businesses (annual turnover of $3 million or less) are not covered by the Privacy Act 1988, but some are. A small business can opt in to the Act. [S35]
Is it an eligible data breach?
A breach is eligible when there is unauthorised access or disclosure (or loss), it is likely to cause serious harm to someone the information is about, and remedial action has not prevented that likely harm. Likely means more probable than not, judged from a reasonable person's viewpoint.
If prompt action means serious harm is no longer likely, it is not an eligible data breach and nobody has to be notified.
Remember
- Three tests: access, serious harm likely, not fixed.
- Fast remediation can end the duty to notify.
Facts and sources for this part
- A breach is an eligible data breach when there is unauthorised access or disclosure (or loss), it is likely to cause serious harm to someone the information is about, and remedial action has not prevented that likely harm. [S20]
- Likely means more probable than not. Whether serious harm is likely is judged from the viewpoint of a reasonable person in the entity's position. [S19]
- If prompt action means the breach is no longer likely to cause serious harm, it is not an eligible data breach and nobody has to be notified. [S19]
How fast, and who do you tell?
The Commissioner expects an assessment of a suspected breach to take no longer than 30 days, and much less where possible. When a breach is eligible, you must notify the people at risk of serious harm and give a statement to the Commissioner as soon as practicable.
You use the OAIC's online Notifiable Data Breach form. Separately, you must tell the TPB within 30 days if you have reasonable grounds to believe there has been a significant breach of the Code.
Remember
- Assess quickly; 30 days is a maximum, not a target.
- OAIC and clients under the scheme; TPB for significant Code breaches.
Facts and sources for this part
- The Commissioner expects an assessment of a suspected breach to take no longer than 30 days, and much less where possible. [S19]
- When a breach is eligible, you must notify the people at risk of serious harm and give a statement to the Commissioner as soon as practicable. You use the OAIC's online Notifiable Data Breach form. [S19] [S20]
- You must tell the TPB within 30 days if you have reasonable grounds to believe there has been a significant breach of the Code. A breach is significant if, for example, it results or is likely to result in material loss or damage to another entity. [S9]
Three real examples
A laptop and documents were stolen from a tax agent's car, and the agent's own identity was then used to lodge fraudulent PAYG summaries on clients' accounts. In another ATO case, a link in an authentic looking email released a crypto virus that locked an agent's systems.
The OAIC gives an example of an accountant who accidentally emailed a spreadsheet with the TFNs and addresses of past clients to his whole contact list. If you pay a ransom, the fraudsters may unlock your systems, but you could be targeted again.
Remember
- Physical theft, phishing and a wrong-recipient email are all breaches.
- Paying a ransom does not end the risk.
Facts and sources for this part
- In one ATO case, a laptop and documents were stolen from a tax agent's car. The agent's own identity was then used to lodge fraudulent PAYG summaries on their clients' accounts. [S11]
- In another ATO case, an agent clicked a link in an authentic looking email and a crypto virus locked their systems. If you pay a ransom the fraudsters may unlock your systems, but you could be targeted again. [S11]
- The OAIC gives an example of an accountant who accidentally emailed a spreadsheet with the TFNs and addresses of past clients to his whole contact list. He feared the information could be used for identity theft. [S19]
Scenario: the wrong attachment
A staff member emails a spreadsheet of client names, addresses and tax file numbers to the wrong person outside the practice.
First contain it: ask the recipient in writing to delete it and confirm. Then assess whether serious harm is likely, given what the file holds and who received it. If the recipient confirms deletion in writing and there is no sign of misuse, remedial action may mean it is not an eligible breach, but record your reasoning.
Remember
- Contain, then assess likelihood of serious harm.
- Write down the reasoning either way.
Facts and sources for this part
- If prompt action means the breach is no longer likely to cause serious harm, it is not an eligible data breach and nobody has to be notified. [S19]
- A breach is an eligible data breach when there is unauthorised access or disclosure (or loss), it is likely to cause serious harm to someone the information is about, and remedial action has not prevented that likely harm. [S20]
- The OAIC's four steps after a breach are: contain it, assess it, notify if required, and review it to prevent future breaches. [S21]
Scenario: the stolen bag
A bag with a work laptop and paper files is stolen from a car. The laptop is not encrypted.
The principal phones the ATO Client Identity Support Centre, lists the affected clients, and checks recent lodgments for anything unexpected. Clients and staff are told, the software provider is contacted, and the notification question is assessed without delay.
Remember
- Phone the ATO first so protections can be applied.
- Make the client list quickly.
Facts and sources for this part
- After a breach, phone the ATO Client Identity Support Centre on 1800 467 033 so protective measures can be put on client accounts, tell affected clients and staff, contact your software provider, secure your systems and remove access people no longer need. [S11]
- In one ATO case, a laptop and documents were stolen from a tax agent's car. The agent's own identity was then used to lodge fraudulent PAYG summaries on their clients' accounts. [S11]
- The Commissioner expects an assessment of a suspected breach to take no longer than 30 days, and much less where possible. [S19]
Checklist: a breach response card
Who leads. Who phones the ATO. Who lists affected clients. Who contacts the software provider and the bank. Who decides on notification, and by when. Who tells the TPB if the Code is breached. Where the template notices are kept.
Keep the card where the principal can find it when systems are down, which means on paper as well.
Remember
- One person leads; roles are written down.
- Keep a paper copy.
Facts and sources for this part
- The ATO says it is crucial to have a data breach response plan, with roles and responsibilities, and to review and test it. [S11]
- After a breach, phone the ATO Client Identity Support Centre on 1800 467 033 so protective measures can be put on client accounts, tell affected clients and staff, contact your software provider, secure your systems and remove access people no longer need. [S11]
- IDCARE provides free advice and confidential support to victims of data breaches and identity theft. Its number is 1800 595 160. [S11]
- You must tell the TPB within 30 days if you have reasonable grounds to believe there has been a significant breach of the Code. A breach is significant if, for example, it results or is likely to result in material loss or damage to another entity. [S9]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
Which is a sign your practice may have been breached?
Show the answer
Right answer: C, Lodgments on client accounts that you did not make. The ATO lists lodgments on client accounts that you did not action as an indicator of a breach. [S11]
Question 2 of 3
When is a breach an eligible data breach?
Show the answer
Right answer: C, Unauthorised access or disclosure, likely serious harm, and remedial action has not prevented it. There must be unauthorised access or disclosure, it must be likely to cause serious harm, and remedial action must not have prevented that harm. [S20]
Question 3 of 3
Which statement about TPB breach reporting is right?
Show the answer
Right answer: A, You must notify the TPB within 30 days of having reasonable grounds to believe there is a significant Code breach. Breach notifications must be made within 30 days of the day you first have, or ought to have, reasonable grounds to believe there is a significant breach. [S9]