In the modern global economy, businesses are constantly seeking efficiencies and cost savings. A common strategy is to engage service providers, vendors, and platforms based overseas. While the financial benefits can be appealing, Australian company directors should be aware of a significant, and often overlooked, risk that could place their personal assets in jeopardy.
When it comes to handling data, the decision to use an overseas provider is not merely a financial one—it is a critical risk management decision with potentially severe personal consequences.
The Australian Privacy Act and the Accountability Principle
The Privacy Act 1988 governs how Australian organisations handle personal information. A key component of this legislation is the Australian Privacy Principle (APP) 8, which deals with the cross-border disclosure of personal data.
In simple terms, APP 8 establishes an ‘accountability principle’. When an Australian company discloses personal information to a recipient in another country (for example, by using a cloud storage provider or a software-as-a-service platform headquartered overseas), the Australian company is generally held responsible for that data.
This means if your offshore vendor experiences a data breach or handles the data in a way that would violate the Australian Privacy Principles, your company is considered to have breached the Act. You cannot simply transfer the risk along with the data.
The Link to Personal Liability: A Stepping Stone Approach
While the Privacy Act itself primarily imposes penalties on corporations, the risk to directors personally arises from the interplay between the Privacy Act and the Corporations Act 2001.
Under the Corporations Act, directors have a fundamental duty to act with care and diligence and in the best interests of the company. Regulators like the Australian Securities and Investments Commission (ASIC) have made it clear that overseeing cybersecurity is a core part of this duty.
A “stepping stone” approach can be used by regulators to establish personal liability. It works like this:
- The Company Breach: Your company is found to have breached the Privacy Act because its overseas provider suffered a data breach. The company faces significant penalties and reputational damage.
- The Director’s Duty Breach: It is then argued that the data breach was a foreseeable risk and that by failing to implement adequate processes to manage that risk (for example, by not properly vetting the overseas vendor), the directors failed to exercise their required duty of care and diligence.
- Personal Liability: This breach of a director’s duties can lead to personal liability, including civil penalties, disqualification from managing a company, and orders to pay compensation for losses incurred.
What Does “Personally Liable” Mean for You?
The term ‘personally liable’ means that the consequences are not confined to the company’s finances. It could extend to a director’s personal wealth, placing assets such as your family home, vehicle, and savings at risk to satisfy penalties or compensation orders.
The initial strategy to save a few dollars by choosing a cheaper overseas option could, in a worst-case scenario, lead to devastating personal financial loss.
How Can Directors Mitigate This Risk?
Taking a proactive stance on cybersecurity and vendor management is essential. Directors should not see this as a purely technical issue for the IT department, but as a fundamental aspect of corporate governance. Consider the following measures:
- Perform Rigorous Due Diligence: Before engaging any third-party vendor, especially an overseas one, conduct a thorough assessment of their security posture. Do they have internationally recognised security certifications, like ISO 27001? What are their data breach response plans?
- Consider the Legal and Regulatory Landscape: Australia has robust laws against corruption and illegal business practices, with a reliable legal system for enforcement. This may not be the case in other jurisdictions, where such laws might not exist or may not be enforced. If an overseas vendor engages in fraudulent or corrupt activity, your ability to recover funds or seek legal recourse could be minimal or non-existent, whereas in Australia you have a clear pathway to take them to court.
- Insist on Strong Contracts: Ensure your contracts with overseas providers include robust clauses that require them to handle data to a standard equivalent to the Australian Privacy Principles. The contract should clearly define liability in the event of a breach.
- Document Your Decisions: If, after a thorough risk assessment, the board decides to proceed with an overseas vendor, this decision-making process must be meticulously documented. Directors should seek written approval from the board, confirming they are aware of the risks and are satisfied that reasonable steps have been taken to mitigate them. This documentation can be crucial in demonstrating you have fulfilled your duty of care.
- Prioritise Local Expertise: Favouring Australian-based providers can significantly simplify the liability landscape. When you partner with a local vendor, that entity is also bound by the Australian Privacy Act. Should a breach occur on their end, there is a clearer legal framework within Australia to establish their responsibility. This can help to shift the focus of liability towards the other entity, thereby reducing the direct scrutiny on a director’s personal decisions and helping to mitigate the risk of personal liability. Using local vendors, partners, and platforms is a strong strategic choice for simplifying compliance and managing risk.
Securing Your Business and Your Future
The decision to send data overseas carries responsibilities that extend far beyond the initial cost-benefit analysis. For company directors, it introduces a personal liability risk that cannot be ignored.
Understanding your obligations under both the Privacy Act and the Corporations Act is the first step. The next is to ensure your organisation has the robust governance and cybersecurity frameworks in place to manage these risks effectively.
If you are uncertain about your current risk exposure or wish to strengthen your cybersecurity posture, the expert team at Vertex is here to help. We can provide guidance on third-party risk management, cyber security audits, and implementing protections to safeguard your business. Contact Vertex Cyber Security today to learn how we can help you navigate the complexities of cybersecurity with confidence.
