Australian Privacy Commissioner Carly Kind has urged law firms to focus on privacy fundamentals as practices navigate new anti-money laundering obligations, increasing cyber threats and the rapid adoption of artificial intelligence.
Speaking with Queensland Law Society Ethics Special Counsel David Bowles as part of Cyber Security Action Month, Commissioner Kind discussed the emerging risks she believes firms should be paying closest attention to, from identity document storage and human error to outsourcing and AI-enabled decision-making.
While lawyers have long been trusted custodians of confidential information, Commissioner Kind said modern privacy obligations extended far beyond confidentiality alone.
Confidentiality is just part of the equation
Asked whether lawyers need extra regulation after managing confidentiality for 800 years through canon law, Commissioner Kind said while confidentiality was important, regulation around privacy had a broader remit.
“Privacy law is both about confidentiality, secrecy, or protecting personal information. It’s also about control and access to personal information as well, and it’s also about security of personal information. So, it has a much broader scope,” she said.
While the legal profession might be familiar with the confidentiality aspects, she said it didn’t necessarily mean there was a familiarity with the other requirements of the legislative framework.
“The other thing I’d say is that even though lawyers are – and I speak as one, of course – well accustomed to duties of confidentiality, that doesn’t necessarily mean they understand the risks inherent in modern information-handling practices, particularly the intersection of information collection and handling and new technologies,” she said.
“That’s why I think the Privacy Act, which is a technology-neutral framework, has obligations that scale to and address those technological challenges as well.”
Why identity documents are now a major risk area
One of the clearest privacy challenges emerging for law firms is the growing volume of sensitive identity information they are being required to collect and store.
Commissioner Kind said a key issue she would impress on small firms was the inherent risks in securing identity documents and information under the recently introduced AML/CTF regime.
“They’re handling very sensitive information, information that can be very difficult for any individual to replace or recover if lost or otherwise compromised. They need those kind of additional, practices and protections in place. I would think that is the clearest area of risk, that is the handling of identity documents,” she said.
On the difficulties created by inconsistent identity document retention requirements, including differing expectations between AUSTRAC and other regulators, the Commissioner said the government was working to better understand the landscape.
“At the federal level, the Attorney-General’s department has been working on trying to map data-retention requirements across every piece of Australian legislation,” she said.
“And there’s something like 1000 data retention requirements, none of which particularly align, unfortunately.”
While firms may have little choice about collecting certain information, Commissioner Kind said they should avoid collecting more personal information than was necessary.
You can’t lose data you don’t hold
In regard to the balance between regulatory compliance and privacy risk, particularly where practices may be required to collect and retain identity documents in some matters but not others, the Commissioner said organisations should minimise the personal information they collected and retained.
“Our primary advice to entities wishing to limit their exposure to cyber risk is you can’t lose data you don’t hold,” she said.
“In all circumstances, obtaining a minimum viable product, the minimum information necessary is best practice, and it’s also going to get you to compliance as well.
“I think our perspective would be: collect for the ones you need to collect for, but don’t expose yourself to additional risk by collecting for the ones that you don’t need to have those identity documents for sure.”
No need for “Rolls-Royce” cybersecurity
For smaller practices concerned about growing cybersecurity expectations, Commissioner Kind said privacy obligations were designed to scale according to the size and circumstances of an organisation.
Guidance exists to help firms protect high-impact personal information, the Commissioner said, with the Office of the Australian Information Commissioner (OAIC) providing extensive resources to help firms.
She said that importantly, all obligations under the Privacy Act scaled to the size and circumstance of an entity.
“We’re not expecting Rolls-Royce cybersecurity protections on a Suzuki-esque law firm and the Act scales in that way,” she said.
“There’s also very basic things that entities can do, such as minimising the collection of personal information, destroying information as it’s no longer needed, implementing strong password protections and ensuring staff only have access to the information they need to do their jobs.
“It’s not about getting the bells and whistles of a cyber security team. It’s really about getting the fundamentals of protecting your personal information right.”
Those fundamentals become even more important when considering the role of people, not just technology, in preventing privacy breaches.
Human error and hackers
Strong cyber security systems alone will not prevent privacy breaches, Commissioner Kind said, noting that recent determinations from the OAIC had shown issues like the culture within an entity, how entities were training staff, and teams were resourced, were also considerations.
While recent high-profile litigation against banks and Optus were in the technical space, others were more around processes, procedures and systems in businesses.
“We wouldn’t expect entities, particularly smaller organisations, to invest heavily in complex technical systems. The focus should be on getting the basics right,” she said.
“Yes, malicious cyber-attacks remain the largest source of data breaches. But beyond that, human error is often what leads to the exposure of personal information and data breaches.”
Unlike IT, privacy obligations can’t be outsourced
Many firms rely on third-party providers and cloud-based systems to manage data and technology infrastructure. However, Commissioner Kind warned that outsourcing services did not mean outsourcing responsibility.
Practices dealing with IT professionals and cloud service providers to store data cannot outsource their privacy obligations, she said.
“That’s because, unlike the European Union, Australia doesn’t currently have a controller-processor framework, although the Attorney-General’s Department has proposed one as part of the Privacy Act reforms. I’m sure many entities would welcome that change.”
While firms could outsource to well-established third-party entities in their supply chain, they still had to be conscious of the risks.
“We would not want entities to think that it’s a ‘set and forget’ approach to controlling their personal information,” she said.
“Not least because, when you have multi-party data breaches where a small entity like a law firm is downstream of a breach at a larger organisation, it is unfortunately the law firm that is going to bear the reputational cost of that breach. That’s because it has the closest relationship with its customers and will be the one that has to deliver the bad news.”
AI and December deadline
Artificial intelligence is another area where firms are navigating new opportunities and new privacy risks.
With AI tools becoming common in legal practice, Commissioner Kind cautioned against entering personal information into free, web-based platforms and highlighted new disclosure obligations due to start in December.
“So, in most circumstances, if you’re using a web-based version of an AI tool, you’re likely disclosing any information you enter, including prompts, to the provider of that tool. You just need consider that disclosure in the context of the Privacy Act,” she said.
“We would probably caution that the use of personal information in commercially available web-based tools, particularly free tools, is not a good idea when it comes to privacy compliance.”
Using locally hosted enterprise models was less of a disclosure risk, but organisations still needed to carefully consider how data was managed internally, she said.
“You may need to make some changes to your privacy policy, particularly with an obligation coming into effect in December this year requiring entities to disclose when they are using automated decision-making, including AI, to make legally significant or other significant decisions.”
Good privacy is good business
For Commissioner Kind, privacy should not be viewed solely through a compliance lens.
When asked if there was one misconception lawyers had about privacy regulation that should she would ask them to reconsider, the Commissioner said she urged entities to think about privacy being good for business.
“I think increasingly we hear from the Australian public that they consider privacy an important element of any good or service they purchase, and we know that the reputational costs to entities of being caught up in a data breach is really considerable and even catastrophic,” she said.
“So where it’s tempting to view this as another compliance obligation, I think looking at privacy compliance as an investment in your company’s reputation and ability to attract and retain customers and clients for the long term, and to build trust with those people is probably, from our perspective, an advisable way to think about privacy compliance.”
Share this article