Is sharing personal information of data breach victims with banks sufficient to limit damages?

 Blog Oct 6

Created with Microsoft Bing Image Creator powered by DALL-E

In the wake of the Optus data breach in Australia that affected over 10 million people, the Australian government is proposing amendments to privacy regulations that enable data sharing between telecommunication firms and banks to better protect affected people from fraud and identity theft. If implemented, the new amendments will allow banks to use temporary government-issued identification documents to monitor those impacted by data breaches, with banks limited to using the information only for preventing data breach-related damages (such as fraud and identity theft). Notably, this enables affected telecommunications companies such as Optus to share its users personal data with third parties (the banks) for strictly limited purposes (to prevent further loss from fraud/identity theft). 

However, this is merely a stopgap measure and according to some, such as Anna Johnston (founder of Salinger Privacy), such a system will likely be too time-consuming to be effective, with criminals behind the data breach likely already having profited by the time banks figure out who they are supposed to ‘protect’. She suggests instead that a stronger policy putting greater limits on data retention is needed rather than a ‘right to delete your data’ which few actually use.