Australia unveils privacy rule changes after Optus data breach

SYDNEY – Australia on Thursday proposed an overhaul of consumer privacy rules that will help facilitate targeted data sharing between telecommunication firms and banks following a massive data breach at Optus, the country’s second largest mobile operator.

Last month’s cyber attack on Optus, owned by Singapore Telecommunications Ltd (Singtel), was one of Australia’s biggest data breaches, and compromised data of up to 10 million customers including home addresses, drivers’ licenses and passport numbers.

The changes will enable telcos to share government-issued identification documents with banks to allow them to implement enhanced monitoring for customers impacted by data breaches.

“They’ve been carefully designed with strong privacy and security safeguards to ensure that only limited information can be made available temporarily to prevent and respond to cyber security incidents, fraud, scams and related activities,” Treasurer Jim Chalmers said during a media conference.

The government will recommend to the governor-general to amend the privacy regulations, he said.

The proposed changes will also allow for increased fraud detection in the broader financial services sector through existing industry mechanisms to report fraudulent transactions, such as fraud information exchanges.

Chalmers said the government would not disclose details of financial institutions that receive the data from Optus due to data security reasons.

Information received must be destroyed by banks when it is no longer required and can only be used for the sole purpose of preventing or responding to cyber security incidents, fraud, scam activity or identity theft, the treasurer said.

Australia’s telecommunications, financial and government sectors have been on high alert since the cyber attack at Optus and had flagged changes to privacy rules to help banks take immediate actions to prevent fraudulent transactions.

The Australian government, which believes the breach at Optus was due to a basic security gap, had slammed the company for describing the attack as sophisticated and for delays in updating affected customers.