Regulatory enforcement in cyber space: what have we seen and what can we expect?

Australia has a congested, complex and fast-moving regulatory framework covering cyberspace. Our experts will plug you in.

KEY TAKEAWAYS

• The regulatory landscape is congested, with varied obligations that are relevant to cyber security incidents administered by a patchwork of regulators
• The number of cyber security related regulations is increasing.
• At the same time, we are seeing a shift away from government and regulators viewing the attacked as the victim. With this comes increasing exposure to the risk that regulators will take enforcement action against businesses that fail to take adequate steps to prevent cyber-attacks and data breaches.
• These trends are likely to continue. Businesses should keep an eye on overseas developments to remain ahead of the curve.
• Enforcement action can lead to significant penalties and reputational harm. To minimise the risk of regulatory enforcement action, businesses must be proactive in complying with their cyber security obligations.

WHO REGULATES CYBER SECURITY?

The regulatory landscape is congested, with varied obligations that are relevant to cyber security incidents administered by a patchwork of regulators

Australia does not have a unified regulatory framework for managing cyber risks or cyber security incidents.

Instead, cyber security regulations are divided among a mix of sector and/or conduct specific obligations.

SEM217509---option-2-infographic-v3.jpg

Set out below are Australia’s key regulators in the cyber security area, and the conduct they regulate.

All businesses 

Critical Infrastructure

Financial Services

Listed entities 

RECENT REGULATORY TRENDS

While there are already a significant number of regulations for Australian businesses to consider in the context of cyber security, the Commonwealth Government is considering further cyber specific regulations which are likely to increase the regulatory burden on Australian businesses.

This includes:

Cyber Security Strategy 2020: As we have previously noted, the Commonwealth Government is continuing its work on its Cyber Security Strategy 2020, through which it is considering introducing stronger cyber security regulations to make Australia more resilient to cyber security threats. This includes consideration of mandatory governance standards for large business, cyber security codes, mandatory standards for smart devices and standards requiring manufacturers and suppliers to disclose software vulnerabilities.

Critical infrastructure reforms

As we have previously discussed (see our briefings here and here), the Government is also in the process of amending the Security of Critical Infrastructure Act 2018.⁶ Under the proposed amendments, owners of key infrastructure assets will be required to:

• notify the Government of imminent cyber security incidents as soon as possible after becoming aware of them; and
• in the case of a serious incident, comply with an expansive range of directions given by the Minister for Home Affairs.

These powers will apply to a broader class of critical infrastructure, affecting assets in the aviation, banking, financial markets, food and groceries and telecommunications sectors.

Privacy Act

The Government’s review of the Privacy Act has led to a number of significant proposed reforms to privacy legislation, as outlined in an exposure draft⁷ and discussion paper,⁸ which are both currently open for submissions (see our briefing here). Some of these proposals would increase penalties for breaches under the Privacy Act. They would also increase the likelihood of enforcement action by the OAIC, as well as private individuals (including class actions arising from new direct rights of action or statutory torts).

Businesses that fail to understand their cyber security obligations are increasingly at risk of regulatory action. We are seeing a shift away from government and regulators viewing the attacked as the victim.

Regulators have taken enforcement action against businesses for cyber security-related breaches, including by commencing court proceedings and imposing fines. For example:

• ASIC commenced its first action alleging deficiencies in cyber security practices in the Federal Court of Australia against RI Advice, a financial services company. ASIC has alleged that RI Advice failed to take reasonable steps to manage a series of cyber security incidents, and breached s912A of the Corporations Act as a financial services licensee (see our briefing here).
• The ACCC commenced proceedings against an online health booking platform that disclosed personal information to insurance brokers without consumers’ consent, resulting in a $2.9 million fine.⁹ Soon after that, the ACCC prosecuted another tech company for misleading consumers about the collection, retention and use of consumers’ data.¹⁰ While these actions did not relate to cyber-attacks, they demonstrate that the ACCC is focused on misleading business practices which undermine the ability of consumers to make informed decisions regarding the use and collection of their personal data. This could extend to the nature of statements made about data security.
• The OAIC recently issued a determination against a multi-national company for failing to prevent unauthorised third parties from accessing its customers’ personal information in a cyber-attack.

So, what can businesses expect in the future?

FUTURE DIRECTIONS IN ENFORCEMENT

While it is early days in enforcement of cyber regulations, the regulators are making clear that with the increasing prevalence of cyber-attacks and the centrality of data, cyber security is a regulatory priority. This includes enforcement.

• The OAIC has voiced its support for stronger penalties for breaches of the Australian Privacy Principles, particularly for large multinational corporations.¹¹
• The ACCC is well-positioned to prosecute businesses that misrepresent their cyber security posture to consumers. In 2020, the consumer regulator received a $27 million funding boost to address digital security issues.¹²
• ASIC has identified cyber threats and cyber security as a strategic priority for the 2021-2025 period. While ASIC has said it will continue to support improving the cyber resilience of its regulated population in line with the approach of the Government,¹³ the ASIC Commissioner has stated that they will litigate when necessary.¹⁴ ASIC intends to employ ‘decisive, deterrence-based enforcement action’ in order to mitigate cyber risks and maintain the integrity of the financial market.¹⁵
• APRA has said that it will take a ‘much more targeted approach to ensuring CPS 234 is being fully complied with, and holding boards and management accountable where it is not’.¹⁶

An increased focus on the enforcement of cyber security obligations is not a uniquely Australian experience. Rather, the Government has made clear that it is looking overseas in its assessment of Australia’s cyber security strategy.¹⁷

It is therefore possible that Australia will see some of the following overseas cyber trends:

• Actions taken in relation to consumer harm: Enforcement action has been taken against companies that have misled users about a product’s level of security,¹⁸ and those providing services with security flaws.¹⁹
• Model cyber security regulation: The cyber security code being considered by the Government may be modelled on overseas examples. In Europe, for example, the General Data Protection Regulation imposes security requirements for data processing which must include technical and organisational measures appropriate to the risk involved if the data were to be accessed by unauthorised third parties.²⁰
• Focus on cyber ransoms: In addition to 31 other countries, Australia has agreed to focus attention on cyber ransoms by increasing domestic law enforcement measures and sharing information with overseas regulators.²¹

Businesses can remain ahead of the curve by keeping an eye on comparable overseas regulators and enforcement action being taken.

What are some things that you can do to avoid being the target of enforcement action?

HOW TO MINIMISE THE RISK OF REGULATORY ENFORCEMENT ACTION