The recent Microsoft outage is a useful reminder of just how dependent organisations have become on cloud services. When systems such as Outlook and Exchange Online become unavailable, the immediate response is usually to treat it as an IT issue. Staff cannot access emails, business processes slow down, and everyone waits for Microsoft to resolve the problem. But there is another question that probably isn't being asked often enough. At what point does an organisation being unable to access its personal information become a privacy breach?
Most people associate privacy breaches with information being stolen, accidentally disclosed or accessed by someone who shouldn't have it. However, the Privacy Act takes a broader view of what constitutes a privacy breach, and one part of that definition is particularly relevant to incidents like the Microsoft outage.
The definition of a privacy breach includes an action that prevents an agency from accessing personal information, whether temporarily or permanently. In other words, information doesn't have to be stolen, leaked or destroyed for a privacy breach to occur. An organisation being unable to access personal information can also fall within the definition.
Consider an event that is occurring every day, a house settlement. For most people, buying or selling a home is one of the largest financial transactions they will ever make. Settlement day involves lawyers, banks, real estate agents and often several interconnected property transactions. There is an expectation that everything will happen on time, because a lot depends on it. Now consider the law firm and banks who on Friday were unable to access emails containing settlement instructions, client information or other documents needed to complete a transaction because Microsoft services were unavailable. The purchaser had arranged movers, taken time off work and may already have moved out of their previous home. The vendor was relying on the settlement proceeds to purchase another property, and that transaction may be connected to yet another. What started as a relatively ordinary technology outage has now potentially affected several families. Settlements may have been delayed, additional costs incurred, and people may have found themselves unable to move into their new homes as planned. Not every delayed settlement will have caused serious harm, and there may have been alternative ways to complete the transaction. But what happens when there aren't? What happens when the financial consequences are significant, or the delay leaves someone without somewhere to live?
A breach is notifiable where it has caused, or is likely to cause, serious harm to an affected individual. The assessment considers factors including the sensitivity of the information, the nature of the harm, who may be affected and the circumstances surrounding the incident.
So, if a law firm is unable to access personal information necessary to complete a property settlement, and that loss of access causes or is likely to cause serious harm to an individual, there is a legitimate question about whether the incident meets the notification threshold. It would depend on the circumstances, including whether the loss of access constitutes a privacy breach under the Act and whether the resulting harm is sufficiently serious.
The same thinking applies to other sectors. A healthcare provider unable to access patient information needed for treatment, a financial services organisation unable to act on urgent instructions, or a social services provider unable to retrieve information needed to assist a vulnerable person. The technology problem might be the same, but the consequences for individuals can be very different.
So how long does personal information need to be unavailable before the incident becomes a privacy breach, or more so a notifiable privacy breach. Is it four hours, 24 hours, or perhaps 72 hours? The Privacy Act doesn't say that information must be unavailable for a particular number of hours. The threshold is serious harm, or the likelihood of serious harm, rather than the duration of the outage.
An organisation could be unable to access customer information for two days without the disruption creating a likelihood of serious harm. Another organisation could experience a much shorter outage where the consequences for an individual are significant enough to meet the notification threshold. Duration is relevant because the longer information remains unavailable, the greater the potential for harm. But it isn't the deciding factor.
When it is identified a notifiable privacy breach has occurred the organisation is required to notify as soon as practicable. The Office of the Privacy Commissioner expects organisations to notify it within 72 hours. Therefore, an organisation needs to assess the potential consequences for individuals as the incident develops, rather than simply waiting for systems to come back online.
But there is another practical problem that an outage like this exposes. What happens if an organisation determines that a breach is notifiable, but the very systems it relies on to communicate are unavailable? For many organisations, email is the primary way they communicate with customers, staff, suppliers and regulators. It is also where contact details, incident response procedures and important correspondence are stored. If Microsoft 365 is unavailable, how does the organisation notify affected individuals? How does it coordinate its response internally?
The Privacy Act doesn't suspend notification obligations simply because an organisation's email isn't working. While notification must be made as soon as practicable, organisations still need to consider what reasonable alternative arrangements are available. That might mean using telephone calls, text messages, a separate communications platform or another secure channel appropriate to the circumstances. The Commissioner's online NotifyUs tool may also be available independently of an organisation's email service, although access and follow-up communications need to be considered.
All of this however assumes the organisation can still access the contact details of the people it needs to notify. If those details are stored in the same unavailable systems, even identifying and contacting affected individuals could become difficult. This is where a business continuity plan that simply says "we will notify affected individuals" may not be particularly useful. It is one thing to have a privacy breach response plan. It is another to be able to use it when the systems holding that plan, and the contact details needed to implement it, are inaccessible.
Most organisations have some form of business continuity or disaster recovery plan. These plans tend to focus on restoring systems, recovering data and minimising operational disruption. IT teams talk about recovery time objectives, backup arrangements and service availability. All of these are important, but they don't necessarily tell us how long an organisation can be without access to personal information before individuals start to suffer harm.
A law firm's recovery time objective might be 24 hours, but that may not be much comfort to someone whose property settlement was due to happen that afternoon. A healthcare provider might have a similar recovery objective, but the impact of not being able to access certain patient information could become serious considerably sooner.
Perhaps organisations need to think about recovery times differently. Not just how long the business can tolerate systems being unavailable, but how long the individuals who depend on those systems can tolerate the organisation being unable to access their information.
Most organisations know to involve their privacy officer when there has been a cyberattack, a lost device or an accidental disclosure of personal information. But does the same thing happen when Microsoft 365 becomes unavailable? Is a privacy breach assessment part of the response to a significant service outage, or is the incident simply managed by IT until the provider restores access?
None of this means that the recent Microsoft outage automatically resulted in a notifiable privacy breach for every affected New Zealand organisation. Each organisation would need to assess its own circumstances, the information affected and the potential harm to individuals. A service outage alone doesn't establish that the notification threshold has been met. However, it does highlight an aspect of privacy that is often overlooked.
The recent Microsoft outage is a reminder that privacy isn't only about keeping information confidential. Availability matters too, particularly when people are relying on organisations to use their information to deliver essential services, complete important transactions or make decisions that affect their lives.
Somewhere between an inconvenient IT outage and an individual suffering serious harm, there may be a notifiable privacy breach. Knowing where that point sits for your organisation, and how to respond when it is reached, is something organisations should understand before the next outage, rather than trying to work it out while their systems are down.