Australia does not yet have mandatory data breach notification laws (see last year's ALRC proposals) so we don't know about breaches other than those that get public notoriety (eg files dumped in bins, stolen laptops or forgotten CD's.)

But we can learn from those breaches analysed in the USA: Verizon has published its 2009 Data Breach Investigations Report.

Its analysis of data breaches concluded:

• 74% were caused externally, 20% internally;
• 67% were aided by errors, 22% involved privilege misuse;
• 69% were discovered by a third party, 87% were considered avoidable through simple controls.

• Ensure essential controls are met.
• Have data retention policies: find, track, and assess data.
• Collect and monitor event logs.
• Audit user accounts and credentials.
• Test and review web applications.

In Australia the Privacy Commissioner has issued a Voluntary Data Breach Notification Guide.

The Government has asked the Board to consult widely with relevant stakeholders and report to the Government on improvements to the design of the GST system necessary to ensure that cross‑border transactions are treated in an efficient and effective manner. A particular focus will be those design features underpinning the involvement of non‑residents in the Australian GST system with a view to simplifying the design.

The closing date for submissions is 4 September 2009.

The latest newsletter from the Financial Ombudsman Service (here) has 3 case studies worth reviewing to understand the Ombudsman's approach to resolving disputes:

• Financial planning advice: Mr and Mrs A complained about the advice they received from their bank's financial planner about how they could arrange their financial arrangements to allow Mrs A to qualify for the maximum aged pension and maximise their income. After a meeting with the bank’s planner, he provided advice that Mrs A would qualify for the full pension if her term deposit monies were invested in a superannuation fund in her name and recommended investment in a bank balanced superannuation fund.

  Mr and Mrs A accepted the advice and transferred the funds to the recommended fund. Mrs A subsequently reached retirement age and applied for the aged pension. However, she was subsequently advised by Centrelink that her pension entitlement was approximately half the full pension. A review of the financial planner’s advice showed he had erred in his calculation. The lower pension entitlement therefore meant Mr and Mrs A’s overall already modest income fell after implementing the planner’s recommendation. The value of Mrs A’s superannuation investment subsequently fell significantly.

  The Financial Ombudsman Service’s view was that the recommendation made by the planner was inappropriate given Mr and Mrs A’s financial position, their historical investment profile and the resultant reduction in their income. Had the correct pension information been stated, and the appropriate recommendation supplied, it was more likely than not, in the circumstances of this case, that Mr and Mrs A would have retained their existing investment arrangements together with a part pension.

  On that basis, the Financial Ombudsman Service determined that the disputants were entitled to be put back in the position they would have been had the term deposit remained in place and the bank was liable to compensate them on that basis.

• Travel insurance: Mr B was stranded in Thailand in September of last year when the Phuket airport was closed due to an anti-government protest. As a result, Mr B had to purchase new flight tickets, and incurred additional costs. The member denied his claim on the basis that the proximate cause for the loss arose from an excluded clause in the policy that is “a loss that arises from any act of war, or from a rebellion, revolution, insurrection or taking power by the military”. The Financial Ombudsman Service upheld Mr B’s claim on the basis the events should be described as a “riot” or “civil commotion” rather than an “insurrection”.
• Superannuation advice: Mr D alleged that the superannuation consultant agreed to advise the consumers into the future and for an indefinite period of changes to the superannuation rules which would prevent them withdrawing their contributions without incurring tax or other penalties.

  Eight years after initial contact, changes to superannuation rules meant that a component of Mr and Mrs D’s superannuation contributions would be taxed substantially if it were withdrawn. Mr and Mrs D complained that the member breached its contractual obligation to warn them of such changes ahead of their operation, and claimed compensation.

  The Financial Ombudsman Service found that there was no ongoing retainer to provide financial advice, Mr and Mrs had not paid any fees for advice, and that there had been no contact between Mr and Mrs and the member during the eight year period. The Financial Ombudsman Service did not uphold the dispute

The Corporations Legislation Amendment (Financial Services Modernisation) Bill 2009, if passed, will require margin lenders and advisers to obtain a licence and be subject to supervision and enforcement by ASIC. It will also give borrowers access to free external dispute resolution services where they have a dispute with their provider.

ASIC’s Consultation paper 112 Dispute resolution requirements for consumer credit and margin lending ( CP 112) explains how ASIC proposes to apply the dispute resolution requirements for margin lenders and those who provide advice on margin loans, once the Financial Services Modernisation Bill reforms of margin lending, come into effect.

Submissions close on Friday 11 September 2009.