Data Breach Policy

Queensland Treasury Corporation (QTC) is committed to safeguarding its data, including personal information, by protecting it from loss, unauthorised access, misuse, or disclosure. This policy outlines QTC’s process for managing, assessing, and mitigating the impact of a data breach in compliance with the Mandatory Notification of Data Breach (MNDB) scheme under the Information Privacy Act 2009 (Qld) (IP Act).

Policy

It is the responsibility of every QTC staff member to protect the information QTC holds. QTC is committed to the effective management of any data breaches, including the following:

• QTC recognises the value and importance of responding to suspected or actual data breaches quickly and efficiently.
• QTC will take all reasonable and necessary steps to contain data breaches and minimise the harm to impacted individuals.
• QTC employs various measures to ensure data security and compliance with privacy obligations. These measures include staff training, developing processes and policies, and ongoing attestation of these obligations.
• QTC will ensure there are security safeguards in place, as are reasonable in the circumstances, to protect against loss of personal information, unauthorised access, use, modification or disclosure, and any other misuse.
• QTC staff, contractors and vendors have a responsibility to report actual or suspected data breaches in a timely manner.

Scope

This Policy applies to and must be adhered to by:

• all QTC staff
• any consultants and persons or organisations authorised to administer, develop, manage and support QTC’s information systems and assets; and
• third party suppliers, vendors and contractors

All staff have a responsibility to notify the Director of Cyber Risk and Strategy of any data breach immediately after becoming aware that a data breach may have occurred and provide information about the data breach in accordance with QTC’s Data Breach Response Plan.

What is a data breach

A data breach occurs where there is:

• unauthorised access to, or unauthorised disclosure of, personal or confidential information.
• the loss of the information in circumstances where unauthorised access to, or unauthorised disclosure of the information is likely to occur.
• A data breach may be caused by malicious action, human error, or a failure in information handling or security systems.

Examples of data breaches include:

• loss or theft of physical devices (such as laptops and mobile phones) or paper records that contain personal information
• unauthorised access to personal information by a QTC staff member, for example gaining access to a system or database that you are not authorised to access whether intentionally or unintentionally
• a QTC staff member accidentally sends an email containing sensitive personal information to the wrong recipient.
• someone impersonates a trusted individual or organisation to trick a staff member into revealing confidential personal information
• unintentional mishandling of personal information due to lack of training / awareness. For example, not setting up an Information Barrier when required or not adhering to QTC’s “need to know” policy.
•  a third-party service provider or contractor working with QTC experiences a data breach, exposing QTC’s data held by them

What is an eligible data breach

The MNDB Scheme applies where an eligible data breach has occurred.
For a data breach to be considered an “eligible” data breach under the MNDB scheme, there are two tests to be satisfied:

1. There has been unauthorised access to, or unauthorised disclosure of, personal information held by QTC, or there is a loss of personal information held by QTC in circumstances where unauthorised access to, or unauthorised disclosure of, the information, and
2. The unauthorised access to, or disclosure of the information is likely to result in serious harm to an individual to whom the personal information relates (an ‘affected individual’).

QTC recognises that the harm which can potentially arise from a data breach will vary based on the nature of the personal information involved and the context of the breach. Serious harm is defined in schedule 5 of the IP Act as including:

• serious physical, psychological, emotional, or financial harm to the individual because of the access or disclosure; or
• serious harm to the individual’s reputation because of the access or disclosure.

Whether a data breach is ‘likely to result’ in serious harm requires that the risk of serious harm to an individual be more than merely possible; it must be more probable than not to occur. QTC will objectively test whether a data breach is likely to result in serious harm, the outcome of each test will be determined on the facts of the specific breach.

Assessment timeframes

If QTC reasonably suspects, but is not certain, that a data breach may qualify as an eligible data breach, it must assess whether there are reasonable grounds to confirm this. The assessment must be completed within 30 days unless an extension is required. If QTC cannot finalise the assessment within the 30-day timeframe, it may extend the period by a reasonable amount of time necessary to complete the process. However, this extension is subject to providing written notice to the Queensland Information Commissioner.

Process for managing a data breach

QTC has implemented robust security measures to safeguard the data it holds against loss, unauthorised access, use, modification, or disclosure. To effectively prevent and manage data security risks, QTC has established a comprehensive suite of policies and procedures.

As part of its approach, QTC has developed a Data Breach Incident Response Plan, which provides detailed guidance on managing data breaches in line with this policy. This plan is reviewed every two years to maintain its relevance and effectiveness.

The Data Breach Incident Response Plan aligns with this policy and the QTC Privacy Policy, as outlined on the QTC website, and applies to all QTC staff. Additionally, QTC has implemented information and data management policies to guide staff on the proper handling and storage of information, including personal information. For example, the Data, Information, and Records Management Procedure includes specific provisions addressing confidentiality, misuse, security, and the management of records.