Australia on Thursday proposed an overhaul of consumer privacy rules that will help facilitate targeted data sharing between telecommunication firms and banks following a massive data breach at Optus, the country’s second-largest mobile operator.
Last month’s cyber attack on Optus, owned by Singapore Telecommunications Ltd (Singtel), was one of Australia’s most significant data breaches and compromised the data of up to 10 million customers, including home addresses, drivers’ licenses and passport numbers.
The changes will enable telcos to share government-issued identification documents with banks, allowing them to implement enhanced monitoring for customers impacted by data breaches.
“They’ve been carefully designed with strong privacy and security safeguards to ensure that only limited information can be made available temporarily to prevent and respond to cyber security incidents, fraud, scams and related activities,” Treasurer Jim Chalmers said during a media conference.
He said the government would recommend that the governor-general amend the privacy regulations.
The proposed changes will also allow for increased fraud detection in the broader financial services sector through industry mechanisms to report fraudulent transactions, such as fraud information exchanges.
Chalmers said the government would not disclose details of financial institutions that receive the data from Optus due to data security reasons.
Information received must be destroyed by banks when it is no longer required and can only be used for the sole purpose of preventing or responding to cyber security incidents, fraud, scam activity or identity theft, the treasurer said.
Australia’s telecommunications, financial and government sectors have been on high alert since the cyber attack at Optus and had flagged changes to privacy rules to help banks take immediate actions to prevent fraudulent transactions.
The Australian government believes the breach at Optus was due to a fundamental security gap, and had slammed the company for describing the attack as sophisticated and for delays in updating affected customers.