PROCEDURE FOR RESPONSE TO A BREACH OF CONDITIONS OF DATA USE FROM NEWLY CREATED COMBINED DATA SETS. A wide range of circumstances might potentially represent a breach of conditions of data use or the possible or actual breach of individual privacy. Breaches may range from minor infringements, such as failure to report changes in named staff working on a project, to serious breaches such as data being sold for commercial gain or data being unlawfully linked with personal information from another source to re-identify an individual. On becoming aware of any actual or possible breach of conditions, the Data Custodian will immediately notify the relevant Monash Partners (MP) Organisation in writing as required by the Agreement to enable that MP Organisation to manage the data breach. (See Agreement Clause 9) Management of any suspected data breach will include: • Action to ensure that the specific breach is minimised and mitigated, including notifying affected parties as appropriate; and • Action to ensure that the risk of any further breach is minimised through review of the relevant practices and consideration of any necessary rectification. If an alleged or actual breach of conditions or privacy includes data supplied from more than one MP Organisation, it is anticipated that a joint investigation be carried out that involves all Organisations supplying, storing or accessing the dataset, subject to consideration by the affected Organisations, which may choose to seek the advice of their legal counsel. Each Health Information Service will endeavour to develop agreed protocols, which align with their own organisation’s protocols for the management of data breaches. However, Data Sharing Principles support each MP Organisation to manage any data breach in accordance with its internal processes and procedures. The disclosing MP Organisation should endeavour to communicate with the other affected MP Organisation/s to the extent appropriate in the circumstances.
