In a first for Australia and New Zealand, the Office of the Australian Information Commissioner (OAIC) and the New Zealand Office of the Privacy Commissioner (OPC) have teamed up on a joint privacy investigation.
Announcing the joint investigation, the OAIC said the decision followed preliminary inquiries into the personal information handling practices of Latitude Financial’s group of companies.
“This is the first joint privacy investigation by Australia and New Zealand and reflects the impact of the data breach on individuals in both countries,” the OAIC said.
“The investigation will allow the efficient use of both agencies’ resources and reduce the regulatory impact on Latitude,” it said.
“It does not preclude the OAIC and OPC reaching separate regulatory outcomes or making separate decisions regarding the most appropriate regulatory response to a breach.”
The OAIC said its investigation would focus on whether Latitude took reasonable steps to protect the personal information they held from misuse, interference, loss, unauthorised access, modification or disclosure.
It said the investigation would also consider whether Latitude took reasonable steps to destroy or de-identify personal information that was no longer required.
“If the investigation leads to a finding that Latitude has breached one or more of the Australian Privacy Principles, then the Australian Information Commissioner and Privacy Commissioner may make a determination that can include requiring Latitude to take steps to ensure the act or practice is not repeated or continued, and to redress any loss or damage,” the OAIC said.
“If the investigation finds serious and/or repeated interferences with privacy in contravention of Australian privacy law, then the Commissioner has the power to seek civil penalties through the Federal Court of up to $50 million for each contravention.”
