Notes from the iappANZ, September 2, 2016

Long after the facts of the highly publicized Ashley Madison data security breach recede into numerous ubiquitous search engines and is overtaken by potentially larger and more newsworthy data and security breaches, the practical lessons learned from the Ashley Madison breach about a global approach to data protection enforcement will remain.

As many of you may know, in August, the Privacy Commissioner of Canada and the Australian Privacy Commissioner released their findings from a joint investigation into the Ashley Madison breach. The joint investigation was made possible and conducted under the APEC Cross-border Privacy Enforcement Arrangement. Ashley Madison is headquartered in Canada, operates the site in more than 50 countries and houses its database mostly in Canada and not in Australia. About 670,000 out of the 36 million affected subscribers were in Australia. The Australian Privacy Commissioner had found that Ashley Madison’s operation had an “Australian link” and therefore comes within the scope of the Australian Privacy Act. 

The joint enforcement activity demonstrates the genuinely global reach of data protection regulators and the type of matters they decide to participate in. Just as the online commercial and social environment is increasingly global so are the regulatory responses. 

This is reflected well in the global nature of the input in our September issue and issues that naturally occupy the minds of the numerous privacy professionals contributing and reading this Digest. This issue has a number of articles about well publicised data breaches, including the Ashley Madison matter, lessons learned and some new thinking about data breach and its effective management in the current environment. Contributions come from various parts of APEC, such as Hong Kong, India, New Zealand and Australia and provide a point of reference to important developments in the EU.