In Europe, there’s a legal “right to be forgotten” as part of the, which was the toughest set of privacy rules in the world when it was introduced in 2016, and continues to be a high watermark that privacy advocates measure against. Once a customer informs a company that they’re withdrawing their consent, the company has a month to wipe all traces. In Australia, there’s no such right of erasure.
Some companies do have a policy of complying where possible, and will describe in their privacy policy steps you can take to have your data deleted. But again, certain businesses will be limited in what they can do. The Commonwealth Bank’s, for example, says you can “ask us to delete your personal information if there is no need for us to keep it” and that “there may be legal or other reasons why we need to keep your personal information”.
Even if the breached data doesn’t include passwords, criminals can use a combination of data to attempt to access your accounts and, once they’re in, it can be easy for them to get into other accounts that use some of the same information. By activating two-factor authentication on as many accounts as possible, and by using a password manager to keep a strong unique password for each one, you have the best chance of limiting the damage.
However, if a company is found not to have taken “reasonable steps” to protect the information in the first place, it could face penalties under the Privacy Act, including having to compensate customers. So far, that’s been exceedingly rare in Australia, but law firm Maurice Blackburn believes the string of high-profile breaches in 2022 could result in payments that set an important precedent.