Greetings from Melbourne!

I received an anxious message from one of my colleagues in Singapore on Saturday night, explaining that she was personally impacted by the SingHealth data breach (this incident was reported in the IAPP Daily Dashboard earlier this week).

As she said to me: "They have my name, home address, identity card number, race, gender, birth date — what do I do?"

Indeed, "what do I do?" is the question for anyone impacted by this or similar data breaches. In the case of my Singaporean colleague, the nature of personal information accessed was enough to give rise to risks of fraud and identity theft — and those types of information are not easy to change (even if she wanted to). I didn’t feel that my suggestions to "monitor your accounts," "change your passwords," and "ask SingHealth what it is going to do to help you" provided too much comfort.  

This is one reason I am registering for the iappANZ workshop with ID Care’s Professor David Lacey in Melbourne 2 Nov. (the day after the iappANZ Summit), "The Regulation and Reality: Pragmatic Approaches and Pitfalls for Data Breach Responders." Hopefully, it will help me answer those "what do I do?" questions after a data breach. You can register for Professor Lacey’s workshop here and also for the iappANZ Summit and Dr. Fiona Tweedie’s data workshop, "Enabling Openness While Protecting Privacy" (more details here).

The SingHealth data breach casts a spotlight on the current debate in Australia about My Health Record and the question that all Australians need to consider: Should I opt out? How do I balance the benefits of my medical history being available to my health care professionals against the data privacy risks (including all those "secondary" uses and potential disclosures)? Stilgherrian’s article in this week’s issue of the APAC Digest also highlights data privacy risks beyond identity theft and fraud — some thought-provoking reading.

All the best to you all,
Carolyn Lidgerwood