Can the Privacy Commissioner force me to hand over my company records regarding a data leak?

The situation

I run a small digital marketing firm based in Melbourne, Victoria. Last month, around the 14th of October, we discovered that one of our database servers had been accessed by an unauthorised party. We believe about 500 client files, containing names and email addresses, might have been compromised. Since then, I have been trying to figure out if we were legally required to notify every single person on that list immediately. I spent the last two weeks consulting with our IT contractor to trace the breach, but we are still a bit unsure about exactly what happened. Yesterday, I received a formal letter from the Office of the Australian Information Commissioner. They are asking me to provide copies of our internal security logs and our written response plan from the last six months to see if we followed the right procedures. I am worried that handing over these private business documents might expose us to other legal troubles or penalties under different laws. If the Commissioner sends me a written notice demanding I answer specific questions or hand over my private files about this incident, am I legally obligated to comply even if it involves my sensitive business information?

Detailed Analysis

Because you have discovered a potential unauthorized access to your database involving 500 client files, the Commissioner may have the authority to investigate. Under Section 26WU, if the Commissioner believes you have information or documents relevant to an actual or suspected 'eligible data breach'—which is a serious privacy breach that requires notification—they can take action^[1].

Specifically, the Commissioner may issue a written notice to your firm. The law states the Commissioner may give a notice "requiring the person or entity: (a) to give information... (b) to produce documents... or (c) answer questions"^[1]. This means they can legally force you to hand over those internal security logs and your written response plan that you are currently worried about.

You mentioned a fear that handing over these files might expose you to penalties under other Commonwealth laws (federal laws that apply to all of Australia). However, the law provides you with a specific protection here. Section 26WU(7) states: "A person or entity is not liable to a penalty under the provisions of any other Commonwealth law because the person or entity gives information, produces a document or answers a question when required to do so under this section"^[1]. This means you cannot be punished by another federal authority simply for complying with the Commissioner's demand for these specific documents.

While the Commissioner has broad powers, they must follow certain rules. For example, if they were conducting a general assessment of your compliance with privacy principles, they must be "satisfied that it is reasonable in the circumstances to do so". It is currently unclear if the Commissioner's request meets all the specific procedural requirements for a formal notice, but if the letter you received is a valid notice under the Act, you must comply.

Note that state, provincial, or local laws in Victoria may add further rules regarding business record keeping or data protection.

Statutory Citations

Related Questions

• Can I have a say if the Privacy Commissioner makes new rules for companies?
• Can the Privacy Commissioner check up on how my data is being handled during an investigation?
• Can the Privacy Commissioner force a government department to add a note to my records if they refuse to change them?
• Can the government force the Fair Work Ombudsman to hand over their internal data?
• Can a private debt collection agency legally get my bank details from my lender?