According to a draft data-breach notification bill, law enforcement agencies and telcos will not be required to inform the affected people whose data will be retained by them. Submissions on the draft bill are presently being taken by the government and the process is open until March 2016.

The legislative process will begin after the consultation ends and after a bill passes in the parliament. It will be another year for any notification to take effect. The bill was supposed to be passed in the parliament this year, according to Australian Attorney General George Brandis.

The bill will require all Australian companies, even the overseas companies that receive Australian user data, to notify the affected users in case of a serious data breach that hold risk of harm if it was released. But the draft law has allowed exemptions to law enforcement agencies and telecommunication companies for security reasons.

Personal data of a person can mean anything, including credit card details, user information and a range of online services as well as medical information.

Law enforcement agencies like the Australian Federal Police, the Australian Crime Commission and potentially the Australian Border Force are being considered to be granted exemption from making such notifications if they believe that it would affect their enforcement activities.

Timothy Pilgrim, the acting Australian information commissioner, said that he is completely in favour of such a mandatory provision of data breach notification bill.

“Notification enables people affected by a breach to take steps to protect their personal information; such as cancelling credit cards or updating log-ins with service providers,” the Guardian quoted him as saying. “A mandatory notification scheme will provide confidence to all Australians that, in the event of a serious data breach, they will be given the opportunity to manage their personal information accordingly.”

Contact the writer at feedback@ibtimes.com.au, or let us know what you think below.