From:
Sent:
Tuesday, 5 June 2018 15:52
To:
Subject:
RE: DBN18/00218 - data breach notification [SEC=UNCLASSIFIED]
Dear
,
After reviewing all the information provided, the OAIC does not intend to take any further action in response to your
data breach notification at this time. Our file is now closed.
Your assessment of the data breach, that risk of serious harm to the subject of the disclosure is unlikely, means
notification to that individual is not necessary in these circumstances.
Thank you for drawing this incident to the OAIC’s attention.
Kind Regards
|
|
Office of the Australian Information Commissioner
GPO Box 5218 SYDNEY NSW 2001 | www.oaic.gov.au
Phone:
| Fax: +
|
From:
Sent: Tuesday, 5 June 2018 10:08 AM
To:
Cc:
Subject: RE: DBN18/00218 - data breach notification [SEC=UNCLASSIFIED]
UNCLASSIFIED
Good morning
My team is responsible for managing the protected disclosure (whistleblower) scheme contained within Part 4A of
the Fair Work (Registered Organisations) Act 2009 (RO Act) on behalf of the Registered Organisations Commission
(ROC).
As the officer responsible for managing that team, I took personal responsibility for handling this matter as soon as I
became aware of the data breach.
A protected disclosure can be made by specified categories of person about the registered organisation with which
they have a connection (s.337A, RO Act). For example, a CPSU member can make a whistleblower disclosure about
the CPSU (but not about the CFMMEU unless they separately have the relevant s.337A connection).
1
Therefore, the likelihood of the identity of a whistleblower being revealed to the subject of the disclosure (i.e. the
organisation or official), depending on the nature of the allegations and the structure of the organisation, may be
quite high – e.g. if it is about conduct by an official, which is not widely known.
For reasons such as this, the ROC always asks for the express written (or email) consent of the whistleblower before
contacting the organisation/official about whom the disclosure has been made. The ROC seeks to avoid a situation
where it might facilitate the identification of the whistleblower and therefore the taking of reprisals.
I made an assessment that the risk of reprisals, as defined in s.337BA of the RO Act, against the whistleblower was
likely to significantly increase if I informed the subject whose conduct was disclosed. This was also in circumstances
where the whistleblower had separately expressly declined to consent to the ROC contacting the organisation.
I also considered that the risk of any harm to the subject of the disclosure did not amount to a risk of serious harm
but that, conversely, there would be a risk of serious harm to the whistleblower if details were provided to the
subject.
I therefore request that if the OAIC is considering contact with the subject of the disclosure (or requesting that the
ROC do so), that the OAIC consult with the ROC on the wording of that contact to minimise the risk to the
whistleblower.
If you require any further details, please feel free to contact me at your convenience.
Best regards
Registered Organisations Commission
GPO Box 2983, MELBOURNE VIC 3001 |
Did you know? We have a free email subscription service to send out important updates and newsletters. Subscribe
here
www.roc.gov.au
Please consider the environment before printing this message
2
From:
Sent: Tuesday, 5 June 2018 9:36 AM
To:
Cc:
Subject: DBN18/00218 - data breach notification [SEC=UNCLASSIFIED]
Our reference: DBN18/00218
Thank you for your time on the phone yesterday afternoon. As discussed, our office is seeking further information to
explain ROC’s decision to only notify the protected discloser named in the correspondence sent to the incorrect
email address, rather than both individuals named in the correspondence.
We would appreciate this information by 12 June 2018. Please do not hesitate to let me know if you have any
questions.
Regards,
|
|
Office of the Australian Information Commissioner
GPO Box 5218 SYDNEY NSW 2001 | www.oaic.gov.au
Phone:
| Fax:
|
Protecting information rights – advancing information policy
***********************************************************************
WARNING: The information contained in this email may be confidential.
If you are not the intended recipient, any use or copying of any part
of this information is unauthorised. If you have received this email in
error, we apologise for any inconvenience and request that you notify
the sender immediately and delete all copies of this email, together
with any attachments.
***********************************************************************
Notice:
The information contained in this email message and any attached files may be confidential information,
and may also be the subject of legal professional privilege. If you are not the intended recipient any use,
disclosure or copying of this email is unauthorised. If you received this email in error, please notify the
3
sender by contacting the department's switchboard on 1300 488 064 during business hours (8:30am - 5pm
Local time) and delete all copies of this transmission together with any attachments.
***********************************************************************
WARNING: The information contained in this email may be confidential.
If you are not the intended recipient, any use or copying of any part
of this information is unauthorised. If you have received this email in
error, we apologise for any inconvenience and request that you notify
the sender immediately and delete all copies of this email, together
with any attachments.
***********************************************************************
4
