Mark Burdon Thesis
Total Page:16
File Type:pdf, Size:1020Kb
THE CONCEPTUAL AND OPERATIONAL COMPATIBILITY OF DATA BREACH NOTIFICATION AND INFORMATION PRIVACY LAWS Mark Burdon M.Sc. (Econ) Public Policy (Lon), LLB (Hons) (London South Bank University, UK) Submitted in fulfilment of the requirements for the degree of PhD by publications Faculty of Law Queensland University of Technology 2011 Keywords Data Breach Notification Law – Information Privacy Law – Data Protection – Contextualisation - Information Security Law ii Abstract Mandatory data breach notification laws are a novel and potentially important legal instrument regarding organisational protection of personal information. These laws require organisations that have suffered a data breach involving personal information to notify those persons that may be affected, and potentially government authorities, about the breach. The Australian Law Reform Commission (ALRC) has proposed the creation of a mandatory data breach notification scheme, implemented via amendments to the Privacy Act 1988 (Cth). However, the conceptual differences between data breach notification law and information privacy law are such that it is questionable whether a data breach notification scheme can be solely implemented via an information privacy law. Accordingly, this thesis by publications investigated, through six journal articles, the extent to which data breach notification law was conceptually and operationally compatible with information privacy law. The assessment of compatibility began with the identification of key issues related to data breach notification law. The first article, Stakeholder Perspectives Regarding the Mandatory Notification of Australian Data Breaches started this stage of the research which concluded in the second article, The Mandatory Notification of Data Breaches: Issues Arising for Australian and EU Legal Developments (‘Mandatory Notification‘). A key issue that emerged was whether data breach notification was itself an information privacy issue. This notion guided the remaining research and focused attention towards the next stage of research, an examination of the conceptual and operational foundations of both laws. The second article, Mandatory Notification and the third article, Encryption Safe Harbours and Data Breach Notification Laws did so from the perspective of data breach notification law. The fourth article, The Conceptual Basis of Personal Information in Australian Privacy Law and the fifth article, Privacy Invasive Geo-Mashups: Privacy 2.0 and the Limits of First Generation Information Privacy Laws did so for information privacy law. The final article, Contextualizing the Tensions and Weaknesses of Information Privacy and Data Breach Notification Laws synthesised previous research findings within the iii framework of contextualisation, principally developed by Nissenbaum. The examination of conceptual and operational foundations revealed tensions between both laws and shared weaknesses within both laws. First, the distinction between sectoral and comprehensive information privacy legal regimes was important as it shaped the development of US data breach notification laws and their subsequent implementable scope in other jurisdictions. Second, the sectoral versus comprehensive distinction produced different emphases in relation to data breach notification thus leading to different forms of remedy. The prime example is the distinction between market-based initiatives found in US data breach notification laws compared to rights-based protections found in the EU and Australia. Third, both laws are predicated on the regulation of personal information exchange processes even though both laws regulate this process from different perspectives, namely, a context independent or context dependent approach. Fourth, both laws have limited notions of harm that is further constrained by restrictive accountability frameworks. The findings of the research suggest that data breach notification is more compatible with information privacy law in some respects than others. Apparent compatibilities clearly exist as both laws have an interest in the protection of personal information. However, this thesis revealed that ostensible similarities are founded on some significant differences. Data breach notification law is either a comprehensive facet to a sectoral approach or a sectoral adjunct to a comprehensive regime. However, whilst there are fundamental differences between both laws they are not so great to make them incompatible with each other. The similarities between both laws are sufficient to forge compatibilities but it is likely that the distinctions between them will produce anomalies particularly if both laws are applied from a perspective that negates contextualisation. iv Table of Contents CHAPTER 1 - INTRODCUTION ...................................................................................... 1 1.1 DESCRIPTION OF THE RESEARCH PROBLEM .......................................................... 1 1.2 OVERALL OBJECTIVE OF THE THESIS ..................................................................... 4 1.3 SPECIFIC AIMS OF THE THESIS ................................................................................ 5 1.4 THE SIX JOURNAL ARTICLES .................................................................................. 6 1.5 LINKING THE ARTICLES: PROGRESSION OF RESEARCH ........................................ 7 1.6 STRUCTURE OF THE THESIS .................................................................................... 9 1.7 CONCLUSION ........................................................................................................ 10 CHAPTER 2 - LITERATURE REVIEW .......................................................................... 11 2.1 INTRODUCTION ..................................................................................................... 11 2.2 DATA BREACH NOTIFICATION LAW ................................................................... 11 2.2.1 US Data Breach Notification Laws .................................................................... 13 2.2.2 Australian Data Breach Notification Developments ......................................... 33 2.2.3 Other Jurisdictional Developments ................................................................... 41 2.3 INFORMATION PRIVACY LAW .............................................................................. 47 2.3.1 Conceptual Underpinnings ............................................................................... 47 2.3.2 Founding Legal Instruments & Legislative Developments ............................... 53 2.3.3 Key Contemporary Analyses ............................................................................. 63 2.4 SUMMARY – GAPS IN THE LITERATURE ............................................................... 70 CHAPTER 3 - STAKEHOLDER PERSPECTIVES ....................................................... 72 CHAPTER 4 - MANDATORY NOTIFICATION ......................................................... 94 CHAPTER 5 - ENCRYPTION SAFE HARBOURS .................................................... 111 CHAPTER 6 - CONCEPTUAL BASIS .......................................................................... 129 CHAPTER 7 - FIRST GENERATION LAWS ............................................................. 158 CHAPTER 8 - CONTEXTUALIZING TENSIONS AND WEAKNESSES ............ 209 CHAPTER 9 - GENERAL DISCUSSION .................................................................... 278 9.1 LINKING THE ARTICLES: LOGICAL PROGRESSION ............................................ 278 9.1.1 Identification of Key Compatibility Issues ....................................................... 279 9.1.2 Investigation of Conceptual and Operational Foundations ............................. 281 9.1.2.1 Data Breach Notification Law ............................................................. 282 9.1.2.2 Information Privacy Law ..................................................................... 287 9.1.3 Synthesis of Findings ....................................................................................... 292 9.1.4 Summary - Assessment of Compatibility ........................................................ 298 9.2 SIGNIFICANCE OF THE RESEARCH ...................................................................... 300 9.3 LIMITATIONS OF THE RESEARCH........................................................................ 302 9.4 FUTURE RESEARCH DIRECTIONS........................................................................ 302 9.4.1 Revising Data Breach Notification Law .......................................................... 302 9.4.2 Contextualising Information Privacy Law ...................................................... 303 9.4.3 Recommendations for an Australian Data Breach Notification Law .............. 304 9.5 CONCLUDING REMARKS .................................................................................... 305 BIBLIOGRAPHY .............................................................................................................. 308 v List of Publications ♦ Lane B et al, 'Stakeholder Perspectives Regarding the Mandatory Notification of Australian Data Breaches' (2010) 15(1) Media and Arts Law Review 149; ♦ Burdon, M, Lane, B and von Nessen, P, 'The Mandatory Notification of Data Breaches: Issues Arising for Australian and EU Legal Developments' (2010) 26(2) Computer Law & Security Review 115; ♦ Burdon, M, Reid, J and Low, R, 'Encryption Safe Harbours and Data Breach Notification Laws’ (2010) 26(5) Computer