FOIREQ18/00045 001
DBN16/00062
Chen, Brandon
16-May-2018 4:24 PM
Title
CBA - Commonwealth Bank of Australia Limited
Receipt Details
File Type:
Privacy
Received Date:
06-Jun-2016 5:22 PM
Sub Type:
Voluntary
Received By:
Boag, Annan
How Received:
Registered Date:
17-Jun-2016 5:22 PM
Owned By:
Boag, Annan
Registered By:
Boag, Annan
Closed Date:
24-Oct-2016 11:05 AM
Closed By:
Boag, Annan
Case Details
Stage:
Closed
File Security:
UNCLASSIFIED
Primary Client Group:
Organisation
Parent Case Entity
Data Breach Notification
Code:
Case PrimaryPerson:
CBA - Commonwealth Bank of Australia Limited
Number of people
0
affected:
DBN Date aware of
1-Jun-2016
incident:
Case Outcome:
no view required
Risk Rating:
High
Risk Rating Q1_A:
Other PI
Risk Rating Q2_A:
Masses (over 100)
Risk Rating Q3_A:
Unaware of breach
Risk Rating Q4_A:
Investigating
Risk Rating Q5_A:
No
Risk Rating Q6_A:
Relevant
Risk Rating Q7_A:
Unlikely
Risk Rating Q8_A:
Possibly
MOU Flag:
N/A
Date of Breach:
1-Jun-2016
Sensitive Information:
No
Affected People
No
Notified:
External contacts
Yes
Notified:
Case Parties - 2
Notified By Client:
CBA - Commonwealth Bank of Australia Limited
Notified By Contact:
S 47F - personal
Summary
i
CBA advised of storage media that was misplaced during transport to destruction contractor. CBA
provided verbal briefing to OAIC 6 June 2016. CBA has decided not to notify individuals because it is
s 47E(d)
It also believes there is a low risk the
information will be accessed because it is in a format that would require specialist equipment and
expertise to recover. CBA to provide OAIC with updates on its investigation.
Issues - 1
Page 1 of 4
16/05/2018
FOIREQ18/00045 002
Issue Description: APP> APP 11 - Security of Personal Information CP
Is Primary Issue: Yes
Issue Type: Primary
Actions - 20 (All Completed)
Action
Owner
Due
Completed
Register Case
Boag, Annan
20-Jun-2016
17-Jun-2016
Move to DBN Allocation
Boag, Annan
20-Jun-2016
17-Jun-2016
basket
Prepare and Send
Boag, Annan
21-Jun-2016
17-Jun-2016
Acknowledgment Letter
(DBN)
Not required - verbal notification and acknowledgment
Allocate DBN
Allocation -
20-Jun-2016
17-Jun-2016, Boag, Annan
(Assessment)
DBN
Assess Data Breach
Boag, Annan
20-Jun-2016
17-Jun-2016: Proceed with DBN
Notification
Seek updates and follow up with CBA
Allocate Case (DBN)
Boag, Annan
20-Jun-2016
17-Jun-2016
Prepare
Boag, Annan
20-Jun-2016
17-Jun-2016
Acknowledgment
(DBN)
Not required - verbal notification and acknowledgment 6 June 2016
Await Manager
Toohey, Karen
21-Jun-2016
17-Jun-2016, Boag, Annan: Not
Approval of Ack Letter
Required
(DBN)
Send
Boag, Annan
20-Jun-2016
24-Oct-2016: No Response Required
Acknowledgement
Letter (DBN)
File Note
Boag, Annan
06-Jun-2016
21-Jul-2016
Section 45
File Note
Boag, Annan
26-Sep-2016
23-Sep-2016
Call with Section 47F
and Section 47F
, CBA. Provided update on investigation. Most likely
scenario is that lost media was found and disposed as rubbish. As such, together with difficulties involved
in accessing data, they assess very low risk to individuals involved and propose not to notify.
Acknowledged this. Requested update be provided in writing.
File Note
Boag, Annan
29-Sep-2016
28-Sep-2016
Call with Section 47F
and Section
. Discussed OAIC request for CBA to provide written
notification of incident to OAIC. Agreed noti
47F
fication would be provided in confidence given commercial
sensitivity for CBA associated with this incident. CBA also noted that although it would initially describe
incident in general terms it is very happy to clarify any aspect of the incident at OAIC's request.
Page 2 of 4
16/05/2018
FOIREQ18/00045 004
Section 47F CBA 1 May 2018.docx
DNB16 00062 File note of phone call with Annan
10-May-2018 10:00 PM
Grierson, Amie
Boag 1 May 2018.docx
DNB16 00062 File note of phone call with Section 47F
10-May-2018 10:00 PM
Grierson, Amie
Section 47F CBA 1 May 2018.docx
DNB16 00062 File note of phone call with Section 47F
10-May-2018 10:00 PM
Grierson, Amie
Section 47F CBA 1 May 2018.docx
Cross References - 3
Case
Comments
CII18/00005
FOIREQ18/00046
FOIREQ18/00045
Comments - 1
Created
By
Comment
24-Oct-2016 11:05 AM
Boag, Annan
Case Closed by Section 47E(d)\annan.boag on 24-Oct-
2016 11:05
Page 4 of 4
16/05/2018
FOIREQ18/00045 005
From:
Karen Toohey
To:
Annan Boag
Subject:
FW: CBA matter [SEC=UNCLASSIFIED]
Date:
Tuesday, 24 May 2016 5:03:39 PM
To discuss
From: Section 47F
Sent: Tuesday, 24 May 2016 4:43 PM
To: Karen Toohey <xxxxx.xxxxxx@xxxx.xxx.xx>
Cc: Section 47F
Subject: CBA matter
Dear Karen
I write further to your conversation with Section 47F on Friday. We are expecting to receive the
preliminary independent investigation report from KPMG shortly and would now like to arrange
to meet with you to brief you further on this matter. We intend to conduct some initial analysis
of the report once it is received so it would be our preference to meet early next week. Please
let me know if this is suitable and we can exchange some possible times.
If you have any queries please let me know.
Kind regards
S 47F personal privacy
_________________________________________________ Commonwealth Bank
Section 47F
Sydney NSW 2001
Phone - Section 47F
Mobile -Section 47F
Email - Section 47F
************** IMPORTANT MESSAGE *****************************
This e-mail message is intended only for the addressee(s) and contains information which
may be
confidential.
If you are not the intended recipient please advise the sender by return email, do not use or
disclose the contents, and delete the message and any attachments from your system.
Unless
specifically indicated, this email does not constitute formal advice or commitment by the
sender
or the Commonwealth Bank of Australia (ABN 48 123 123 124) or its subsidiaries.
FOIREQ18/00045 006
We can be contacted through our web site: commbank.com.au.
If you no longer wish to receive commercial electronic messages from us, please reply to
this
e-mail by typing Unsubscribe in the subject line.
**************************************************************
