Privacy and executive liability - ASIC's second attempt at enforcement

High level rundown of key components of the Privacy Act and Corporations Act relevant to corporations. This presentation will primarily be targeted at organisations who hold an Australian Financial Services (AFS) Licence (e.g. banks, lenders, any organisation providing financial product advice, or otherwise dealing in financial products or operating a managed investment scheme).

Discussion of board and executive requirements. The presentation will then touch on ASIC's first enforcement action against RI Advice, and why the outcome was considered 'underwhelming'.

Then moving on to a look into ASIC's second enforcement action, this time against FIIG Securities Limited.

Here the presentation will do a deep dive into the allegations against FIIG regarding the alleged theft of approx. 385GB of confidential data, what steps FIIG is alleged not to have taken, and how that may result in breaches of the Credit Licensee's obligations under section 912A(1)(a)(d) and (h) of the Corporations Act.

Pending time, the presentation will also refer to the recent cyber attacks on multiple superannuation funds.

Finally, it will address what boards and executives can do to help mitigate the risk of a breach, as well as what AFSLs should have in place to adequately manage cyber risks, including technical and organisational controls, as well as the regulators expectations.