Mandatory Notification of Data Breach Scheme

An ‘eligible data breach’ occurs when there is:

• Unauthorised access to, or unauthorised disclosure of, personal information held by Council that would be likely to result in serious harm to an individual to whom the information relates
• The loss of personal information held by Council in circumstances where unauthorised access or disclosure is likely to occur and which would be likely to result in serious harm to an individual to whom the information relates.

A data breach most commonly results in unauthorised access to, or the unauthorised collection, use, or disclosure of, personal information.

• Accidental loss or theft of classified material data or equipment on which such data is stored (e.g. loss of paper record, laptop, tablet or mobile phone, compact disk or USB stick)
• Unauthorised use, access to or modification of data or information systems (e.g. sharing of user login details (deliberately or accidentally) to gain unauthorised access or make unauthorised changes to data or information systems)
• Unauthorised disclosure of classified material or personal information (e.g. email sent to an incorrect recipient or document posted to an incorrect address or addressee), or personal information posted onto our website without consent
• Compromised user account (e.g. accidental disclosure of user login details through phishing) or malware infection

Personal information is any information that identifies you and could include:

• a written record which may include your name, address and other details about you
• photographs, images, video or audio footage

Council holds varying amounts of personal information, from ratepayer contact information to staff personnel details. You can refer to Council’s Privacy Management Plan or Agency Information Guide for further information.