Franchisors beware: Employment laws toughen again!

On 5 September 2017, the Fair Work Amendment (Protecting Vulnerable Workers) Bill 2017 passed through parliament. When enacted into law, this legislation will have massive ramifications on the franchising industry.

Under the existing laws, a franchisor may potentially be held to be liable for a franchisee’s breach of workplace laws if the franchisor is involved in the contravention.

Along with increasing maximum penalties for employers who deliberately breach minimum wage and entitlement obligations under the Fair Work Act 2009, the proposed new legislation will hold franchisors and holding companies responsible for underpayments by their franchisees or subsidiaries if the franchisor knew, or reasonably should have known, about the contravention and failed to take reasonable steps to prevent it. This greatly expands on the current laws.

The controversial Bill has been heavily debated within the Australian franchise industry, predominantly because in many franchise models the franchisee operates its business independently from the franchisor, who is removed from the day-to-day running of the business such as paying wages and rent, which is the responsibility of the franchisee. The legislation will only apply to franchisors who have a significant degree of influence or control over the affairs of their franchisees. How this influence or control will be assessed is yet to be determined.

Triggered in response to the highly publicised 7-Eleven employee underpayment scandal which has engulfed the franchise sector since 2015, along with several recent employee underpayments by Domino’s and Caltex franchisees, the franchise-specific provisions of the new laws will take effect 6 weeks after the Bill receives royal assent (or in other words, when the legislation becomes enforceable law).

Turning a blind eye is no longer an option for franchisors, who must now pay closer attention to how their franchisees manage employment processes. Franchisors should take this opportunity to:

1. review their standard form Franchise Agreements and Operations Manuals to clearly set out franchisee obligations under workplace laws;

2. consider whether to include employee obligations in initial or ongoing training programs provided to franchisees;

3. consider and revise any policies and resources provided to franchisees covering obligations under workplace laws;

4. monitor franchisees, and if warranted, carry out compliance audits to determine if employees are being paid under the correct award, and correct entitlements such as superannuation and leave. Regular audits may act as a deterrent to other franchisees who will be aware that audits are commonplace and that consequences for non-compliance with employment laws are enforced;

5. encourage feedback as both franchisees and their employees should feel comfortable approaching a franchisor in respect to issues with the system. Employees should not feel that they are prevented from raising employment concerns with the franchisor;

6. listen to concerns that franchisees raise regarding the system and don’t ignore issues. It is in the best interests of franchisors to ensure that franchisees are operating their businesses adequately. If franchisees are struggling to pay their employees the proper entitlements, and if this is a widespread concern, that could indicate the need to review the structure of the franchise system; and

7. treat franchisees with uniformity. Franchisors could be accused of breaching their good faith obligations under the Franchising Code of Conduct if they single out a particular franchisee. If audits are to be carried out and consequences for non-compliance enforced, then all franchisees must be treated equally.

Franchisees and franchisors will need to be prepared to face tougher penalties for breaching employment laws. In some cases the penalties for contravening employment laws will now be up to $630,000 for corporations and $126,000 for individuals per offence. The legislation also brings increased penalties for breaching record-keeping and payslip requirements. “Cash-back” arrangements where an employer delivers a wage to a worker but then asks for part of it to be repaid will also be specifically outlawed.

Depending on the provisions of the particular Franchise Agreement, underpayment of employees may constitute fraudulent conduct in certain circumstances, entitling a franchisor to immediately terminate a Franchise Agreement, or at the very least, acting as grounds for a breach notice to be issued.

If you have any concerns about the underpayment of employees or questions about the proposed new laws, Talk to the Franchising team at Rouse Lawyers. Contact us today!

 

MAIN RESIDENCES IN ESTATE PLANNING – CAUTION REQUIRED

The use of testamentary trusts in estate planning (particularly for clients with a reasonable level of income producing investments) is relatively standard practice. It is not uncommon in preparing the Will to pass all of the assets of the testator into one or more testamentary trusts.

The tax advantages of testamentary trusts are obvious – distributions to minors are not restricted to a $416 limit as applies to discretionary trusts, as well as the income splitting advantages of discretionary testamentary trusts. Of greater importance are the asset protection advantages that a properly designed testamentary trust can provide.

What is often ignored, however, is the special position of main residences under the tax legislation. A complete exemption from any capital gains subject to a number of conditions – the key condition is the disposing owner is an individual that has used the property as their main residence.

CGT on deceased estates

Example Bruce and Fleur purchased their home in 1992 for a cost of $170,000. The property is held as tenants in common. Throughout the period of ownership they have used it exclusively as their main residence. It now has a value of $1,020,000, and after reduction by costs associated with sale, a capital gain of $800,000 is expected. They are now 73 years of age and executed their Will which passes their interest in the home, together with other income producing assets, into a Testamentary Trust initially controlled by the survivor. Shortly afterwards, Bruce passes away.

The general rule is that post-CGT assets (assets acquired on or after 20 September 1985) passing into a deceased estate are deemed to have been acquired at the cost base of the testator. The Main Residence Exemption is extended if the property is sold within two years of death.

But what of the situation where the property passes to a testamentary trust? A trustee is generally not eligible for the Main Residence Exemption.

Special Cost Base Rules

Division 128 alters the standard cost base rules above in nominated circumstances.

One special cost base rule applies where the property was the main residence of the deceased immediately before they died and was not then being used to produce assessable income. In that instance, instead of adopting the deceased cost base, the cost base is equal to its market value. On the other hand, the dwelling were used to produce assessable income at the date of death (for example, by the rental of a room) the cost base would be $85,000 (½ of $170,000), which could give rise to a capital gain of $315,000 if sold immediately after death. A death tax?

Exemption for deceased estates

The rules in respect of the Main Residence Exemption provide a full exemption for post-CGT dwellings if it was a deceased’s main residence just before death and not being used to produce assessable income at that time (use prior to death is not taken into account). It applies to pre-CGT dwellings irrespective of use prior to death.

The full exemption is available where the dwelling is sold within two years of death, or the dwelling is used throughout the period after death by the deceased’s spouse, a person with a right of occupation under the Will, or the beneficiary to whom the dwelling passes under the Will.

Importantly, the exemption not only applies to an individual but also to the trustee of a deceased estate. Although it might be considered that the term “trustee of a deceased estate” is limited to the legal personal representative, the ATO accepts that the trustee of a testamentary trust satisfies that description (ATO ID 2006/34) which is consistent with its long-standing practice in PSLA 2003/12 to treat the trustee of a testamentary trust in the same way as a legal personal representative for CGT.

A key planning point is if the dwelling is being used as the Main residence of a person other than the spouse, a right of occupation must be provided by the Will.

Failing the conditions: if the property is not sold within two years and not used as a main residence by the people described above, a partial exemption is available. But in that instance any period when the dwelling was not the deceased’s main residence is taken into account to reduce the exemption.

Replacement Residences

In the event that the property were sold and a replacement residence acquired, the above exemption would not apply to the replacement residence.

On the other hand, if the original dwelling had passed to an individual who sold it and acquired a replacement residence, the replacement residence would be eligible.

A less-known provision, (Section 118-210) extends the Main Residence Exemption to the trustee of a deceased estate that acquires a dwelling for occupation by an individual. With appropriate drafting of the Will and putting in place appropriate processes to demonstrate the dwelling is acquired for occupation by an individual, this provision extends the Main Residence Exemption to a replacement residence.

As outlined above, the ATO accepts that the trustee of a testamentary trust is a trustee of a deceased estate to qualify for this exemption.

Pass to Spouse

Some may be dubious about the ATO continuing to stand by its long-standing practice and for greater certainty the best option is simply to pass the interest in the residence to the survivor. What must not be overlooked is that such a gift would then be subject to any claims that might be made against the surviving spouse (loss of asset protection benefits). Additional processes must be implemented in that case to preserve the asset protection benefits of a suitably drafted testamentary trust.

The Take-Away

When implementing estate planning the Main residence of the deceased’s should receive special attention to enable access to the Main Residence Exemption on a subsequent sale during the lifetime of the survivor, and the asset protection benefits of a properly designed testamentary trust.

In particular, drafting a suitable form of right of occupation within the terms of the Will is recommended.

If passing the residence to a spouse, additional processes are required.

NOTE: This article is for general information only and should not be relied upon without first seeking advice from one of our specialist solicitors.

Need advice ? Talk to the Tax & Superannuation Team at Rouse Lawyers. Contact us today!

If you’re gonna say it, you better mean it!

Image via news.com.au 

Janine Allis, founder of Boost Juice and Retail Zoo, delivered a punch to two gym owners and Shark Tank hopefuls this week. The guys were pitching a food product to the Sharks, and the packaging revealed it was ‘engineered to accelerate muscle growth and increase energy levels’.

When asked whether they had completed any clinical trials, or had any proof that their food product actually did what the packaging said, the answer was no.

‘Misleading!’ was Allis’ response.

‘At the moment, you’re making health claims that aren’t proven which means it’s against the law. I would seriously think about repackaging because there’s a number of thing son here that are simply against the food standards codes. You need to get good legal advice…’

The Australian Consumer Law (the ACL) is pretty clear on what product packaging can’t do: packaging with statements that are incorrect, or likely to create a false impression, are not allowed.

The proof is in the prosecutions:

-       Nurofen maker, Reckitt Benckiser, was fined $1.7M for breaching the ACL with its ‘specific pain range’, where all products contained the same active ingredient, and did the same thing.

-       Arnott’s was fined by the ACCC for claims on its ‘Light & Crispy’ packaging for adopting a false comparator to inflate a health claim.

-       When Heinz’s US parent company acquired Australian product Golden Circle, Golden Circle packaging continued to represent that Golden Circle products were Australian owned. Heinz gave undertakings to the ACCC, and also donated more than 800,000 affected cans of fruit and vegetables to Australian welfare agencies.

-       Goodman Fielder, maker of non-dairy spread Logicol, engaged in misleading or deceptive conduct claiming on its pack ‘#1 RECCOMENDED for dietary change’. In this instance, it was competitor Unilever Australia (manufacturer of competitor brand Flora Pro-Activ) that sued Goodman Fielder for the breach.

Takeaway

It’s a bitter pill to swallow when you’ve spent considerable time, money and effort designing eye catching, memorable packaging for a product and marketed that product to stockists and consumers, only to find out it breaches consumer laws and must be changed.

Claims about products must be true, accurate and capable of being substantiated, or you run the risk of an ACCC prosecution, or a rival competitor seeking to leverage your mistake to their advantage.

Unsure? Get legal advice – investing in peace of mind may save huge expense down the track.

Contact the team at Rouse Lawyers today.

Law Society Warns Against Will Kits

The Queensland Law Society has issued a warning against do-it-yourself will kits:

“A large percentage of Australians believe that filling out a will kit from their local news agency or downloaded from the internet, will cover them when they pass away. Decades ago that might have been true. But in a modern complex technological world, it is not.

Gone are the days where people simply had a house, a car and a few dollars in the bank. Once upon a time a will might have dealt with those assets. That is no longer the case.

Anyone who relies on a downloaded will to give effect to the distribution of your assets on your death, is taking dangerous risks for yourself, your family and loved ones.

Why?

These days we have far more complex ways of saving for our future. Unlike 40 years ago, we all now have Superannuation. Our banks are no longer that large sandstone building in the middle of town. Banks accounts are online. A growing number of us have insurance as a safety net for our families. Many of us have shares – Australian and international. The list goes on.

Many mistakenly believe that all their assets are covered under a simple will that, once signed, means their wishes will be carried out following their death.

In reality, many of these modern day assets are not covered by a will, and those that are, remain exposed to claims. They can be exposed because the laws change according to where you live and where your asset is kept.

On top of that, we are living longer and that is resulting in more and more people losing capacity. Many people overlook the impact a Power of Attorney can have on assets in a will.

Also unlike 40 years ago, many people are now living in retirement villages or nursing homes. Retirements plans and nursing home care impacts on your estate.

These are just a few of the matters that are not covered by filling out that will kit. Seeking legal advice from your trusted, local solicitor is key to ensuring your wishes are carried out when you lose capacity and pass away.

Solicitors are independent legal advisors with no stake in who gets what from you. They are properly qualified, licensed and fully insured.  Most importantly they are duty bound to act in the best interests of you – their client. Significantly, lawyers are charged with protecting your confidentiality even after you die – no other advisor has this duty.

With Seniors’ Week running from 19-26 August, I strongly urge all adult Queenslanders to ensure you have your wishes recorded with the advice of a qualified solicitor to protect the future of your care, the future of your assets, and to give you peace of mind.

Importantly, take the time to check in with your elderly neighbours and family members to make sure they are okay and have the conversation about getting their affairs in order to ensure their wishes are protected for the future.”

For a no-obligation, confidential discussion with our experienced team regarding all estate planning matters, contact Rouse Lawyers on 07 3648 9900.

This article was originally published by the Queensland Law Society.

Franchise OR LICENCE?

If it looks like a duck, walks like a duck and quacks like a duck, it probably is a duck. The same reasoning can be applied to whether a licence agreement constitutes a franchise agreement – it is a matter of substance over form.

Both licence agreements and franchise agreements can grant people the right to use intellectual property, including trademarks, brands and a business system.
There are differences between the two types of agreement, so if you are thinking of buying into a franchise you need to make sure of your ground. Under the Australian Franchising Code of Conduct, four elements must be met for an agreement to constitute a franchise agreement… 1. there is an agreement, either written, oral or implied 2. one person grants to another person the right to conduct a business offering, supplying or distributing goods or services under a system or marketing plan substantially determined, controlled or suggested by the franchisor 3. the business will be substantially or materially associated with a trademark, advertising or a commercial symbol owned, used or licensed by the franchisor or specified by the franchisor 4. before starting (or continuing) the business, the franchisee must pay or agree to pay the franchisor a fee. The fee can include an initial capital investment, payment for goods or services, or a royalty fee. It excludes payments for goods or services supplied on a genuine wholesale basis or repayment of a loan.

1. there is an agreement, either written, oral or implied 2. one person grants to another person the right to conduct a business offering, supplying or distributing goods or services under a system or marketing plan substantially determined, controlled or suggested by the franchisor 3. the business will be substantially or materially associated with a trademark, advertising or a commercial symbol owned, used or licensed by the franchisor or specified by the franchisor 4. before starting (or continuing) the business, the franchisee must pay or agree to pay the franchisor a fee. The fee can include an initial capital investment, payment for goods or services, or a royalty fee. It excludes payments for goods or services supplied on a genuine wholesale basis or repayment of a loan.

2. one person grants to another person the right to conduct a business offering, supplying or distributing goods or services under a system or marketing plan substantially determined, controlled or suggested by the franchisor 3. the business will be substantially or materially associated with a trademark, advertising or a commercial symbol owned, used or licensed by the franchisor or specified by the franchisor 4. before starting (or continuing) the business, the franchisee must pay or agree to pay the franchisor a fee. The fee can include an initial capital investment, payment for goods or services, or a royalty fee. It excludes payments for goods or services supplied on a genuine wholesale basis or repayment of a loan.

3. the business will be substantially or materially associated with a trademark, advertising or a commercial symbol owned, used or licensed by the franchisor or specified by the franchisor 4. before starting (or continuing) the business, the franchisee must pay or agree to pay the franchisor a fee. The fee can include an initial capital investment, payment for goods or services, or a royalty fee. It excludes payments for goods or services supplied on a genuine wholesale basis or repayment of a loan.

4. before starting (or continuing) the business, the franchisee must pay or agree to pay the franchisor a fee. The fee can include an initial capital investment, payment for goods or services, or a royalty fee. It excludes payments for goods or services supplied on a genuine wholesale basis or repayment of a loan.

All four elements are cumulative – in other words, all elements and all parts of each element must be present before the agreement can be classified as a franchise agreement. It does not matter what the agreement is called. If it meets all four criteria, it will constitute a franchise agreement for the purposes of the code. The main factor distinguishing a licence agreement from a franchise agreement is the degree of control and strict compliance with a business system inherent to franchise agreements. Licence agreements are commonly more relaxed in this regard.

CASE STUDY
The leading case relative to this area was the 2012 Federal Court decision in Rafferty v Madgwicks. In finding that a “rights agreement” was in fact a franchise agreement, the court set out relevant factors that could potentially indicate the existence of a franchise agreement. These included: 1. specific requirements for accounting and record-keeping, signage and merchandising, sales structures and reporting turnover 2. the franchisor’s right to audit account records and to approve marketing material 3. restrictions on the

These included: 1. specific requirements for accounting and record-keeping, signage and merchandising, sales structures and reporting turnover 2. the franchisor’s right to audit account records and to approve marketing material 3. restrictions on the

1. specific requirements for accounting and record-keeping, signage and merchandising, sales structures and reporting turnover 2. the franchisor’s right to audit account records and to approve marketing material 3. restrictions on the

2. the franchisor’s right to audit account records and to approve marketing material 3. restrictions on the

3. restrictions on the franchisee’s sale of competing products or services, use of the brand name and trademarks, and specific marketing or sales territories. For the document to constitute a franchise agreement, the system or marketing plan under the agreement must be substantially determined, controlled or suggested by the franchisor. The degree of control must be carefully considered, along with the extent to which the franchisee’s business involves the sale of the franchisor’s goods or services.

The details of such a system or marketing plan do not need to be set out in the agreement. It will be enough for the business to be proved a franchise if the agreement allows the franchisor to exercise this control.

Just because an agreement is not called or intended to be a franchise agreement, it may nevertheless be caught within the ambit of the code, which is intended to protect franchisees involved in transactions where there is inequality of bargaining power. Therefore it is important to look at the substance of an agreement to determine whether it will be governed by the code. Heavy obligations are placed on both parties under the code, as well as consequences for non-compliance. This makes it essential to always obtain legal advice before entering into commercial agreements to ensure full compliance with the relevant laws.

Need advice about your Franchise Agreement?  Talk to the Franchising team at Rouse Lawyers. Contact us today!

Article was previously published in the July/August edition of Franchise Business Magazine.

Privacy Awareness Week

 

Each year, the Office of the Australian Information Commissioner (OAIC) holds a week of events to promote privacy and encourage best practices by companies and organisations on how they can keep your personal information safe.  Each year has a different theme: This year, the focus of the week is “trust and transparency”.

“This Privacy Awareness Week (PAW) we explore privacy through the theme Trust and Transparency. This speaks to the consumer and community trust that flows to organisations who handle personal information transparently, and with care, throughout the information life cycle.

Personal data can travel through numerous transactions, media and organisations — but it’s always personal — so it’s important that we take care at every step.”

– Timothy Pilgrim, Australian Information Privacy Commissioner

This year, Rouse Lawyers is a proud partner of the Privacy Awareness Week and we are encouraging you to take some time this week to think about how you implement trust and transparency within your organisation.

Achieving Trust and Transparency

Achieving trust and transparency with your staff and customers may seem daunting at first, but by following and implementing a few simple steps, you can be on a path towards achieving this goal.

Implementing a clear Privacy Policy, making that policy easily available on your website and holding regular staff training to encourage positive behaviours towards privacy processes are all examples of ways you can create an environment of trust and transparency.

If you are unsure where to get started, the OIAC website publishes many helpful guides to assist you in being compliant with your privacy obligations (or if you wish to have a more in-depth conversation contact us to discuss any privacy related matter).  One such guide is the Privacy Management Plan; implementing a plan is an excellent way to keep you focussed on creating trust and transparency.

Creating a Privacy Management Plan

STEP 1: EMBED A culture of privacy that enables compliance. Good privacy management stems from good privacy governance. Ensure your leadership and governance arrangements create a culture of privacy that values personal information. – OAIC

Ways to Achieve Step 1:

• Create a Privacy Policy in line with the Privacy Act.  Having a clear and easily accessible Privacy Policy is the first step in building trust with your customers.  When your customers know how you will handle their information safely, they are more likely to engage with your company.
• Include as part of your induction training a module on what is personal information and the steps you take to protect that information.
• Conduct staff training where you discuss when personal information can be disclosed and when it cannot.
• Talk to your staff about risks associated with disclosing personal information.  This will not only assist in protecting personal information you hold but may also prevent a staff member from having their personal information misused.
• Consider any professional or ethical standards that apply to your industry relating to client confidentiality and disclosure of customer information.

STEP 2: ESTABLISH Robust and effective privacy practices, procedures and systems Good privacy management requires the development and implementation of robust and effective practices, procedures and systems.  – OAIC

Ways to Achieve Step 2:

• Conduct regular staff training session where privacy is a focus.   When you discuss privacy compliance with your staff on a regular basis, it is more likely that your staff will implement your privacy processes correctly.
• Create a method on how you will handle privacy concerns raised by your customers.  Does your staff know how to answer customer’s questions?  If your staff is unsure or inadequately trained, your customers may not feel that you are being transparent with how you handle their information.
• Encourage a culture where concerns and complaints are treated seriously.  If your customers feel that you are care about their concerns, they will in turn trust in you with their personal information.
• Start thinking about how you will handle a data breach. Consider developing a written procedure and management plan. New obligations on how you must handle data breaches is set to start in 2018.

STEP 3: EVALUATE Your privacy practices, procedures and systems to ensure continued effectiveness Systematically examine the effectiveness and appropriateness of your privacy practices, procedures and systems to ensure they remain effective and appropriate. – OAIC

Ways to Achieve Step 3:

• Undertake regular audits of your organisation.  Are policies and procedures being implemented correctly?
• Consult periodically with a privacy expert to keep you up-to-date regarding your privacy obligations.
• Evaluate the purpose for collecting any personal information.  Do you require each piece of information?  If not, making the disclosure of that personal information optional is another way to build trust with your customers.

STEP 4: ENHANCE Your response to privacy issues Good privacy management requires you to be proactive, forward thinking and to anticipate future challenges. By continually improving your privacy processes, you will ensure you are responsive to new privacy issues and that implementation will not be a burden. 

Ways to Achieve Step 4:

• Change and adapt your processes and procedures based on the feedback you receive form your staff, customers and internal audits.

We are here to help

Privacy is rarely about secrecy, but is about transparency, security, and choice. It’s about organisations being up-front about their personal information handling practices so that individuals can make informed choices about how they share their information. And it’s about respecting customer trust by maintaining strong security and information handling practices throughout the life cycle of personal data.

Unsure if you are compliant with your obligations concerning personal information or need to create or update your Privacy Policy?  Contact Rouse Lawyers and ask to speak with one of our privacy law experts to discuss how we can assist you with all things concerning privacy law.

Data Security – Show Pony Group Pty Ltd v Black Swallow Boutique Pty Ltd & Ors

Show Pony Group Pty Ltd (“ShowPo”) has settled a dispute with competitor Black Swallow Boutique Pty Ltd (“Black Swallow”) and two individuals, Mr Alexander Baro (chief executive of Black Swallow) and Ms Melissa Aroutunian (a former graphic designer for ShowPo), over the alleged theft of ShowPo’s contact database.

The case highlights the risks of unauthorised use and disclosure of confidential information. It also reveals that sometimes the greatest threat comes from within.

Details of the ShowPo case

ShowPo, a hugely popular online women’s fast fashion retailer, commenced proceedings in the Federal Court of Australia in mid-November 2016. It was alleged that the former employee, Ms Aroutunian, downloaded a copy of  ShowPo’s Client Contact List before leaving ShowPo and provided a copy of that list to Black Swallow. According to court filings, the database contained contact information for all of ShowPo’s customers, competition entrants, suppliers and other contacts. It was estimated that the database contained around 306,000 entries.

ShowPo was successful in obtaining an interim injunction (a temporary court order made subject to the subsequent trial of the proceedings) to prevent the three respondents from using or disclosing the Client Contact List.

The proceedings then headed to Mediation, following which the case was finalised by agreement between the parties.

According to the final orders, dated 24 March and 10 April, each of the respondents is permanently restrained from using or disclosing the Client Contact List, and Black Swallow has been ordered to pay $60,000 in compensation to ShowPo over instalments.

The customers of a business are its lifeblood, and their information is increasingly being obtained and stored online. So, what measures can be taken to protect this essential and sensitive information from unauthorised breach? And what can you do if a breach occurs?

Basic Data Security

It goes without saying that effective password management and data security measures are key steps in protecting any sensitive data.

Ask yourself these questions:

• Do only those employees who need access to the data have access? Do your entry level staff need admin level access? In most cases, not all data needs to be known, accessible or editable by every person in the business. Work with your IT/software provider to restrict unnecessary access.
• Is your data secured on the move and at rest? Use industry standard encryption (eg https) to protect data transactions and ensure your data is encrypted whenever it’s stored.
• Are strong passwords being used? Everyone knows that “Password1234” is not secure. But do your staff or your business use their birthdate, street address, family members’ names or a similar formula to choose a password? Do they change passwords by incrementing a digit at the end? Do they use the same work password for their social media account? Consider training your staff to use a reputable password manager to generate unique passwords for each account or implement mandatory lengths of time when your staff need to change their system passwords.
• Are system passwords being stored securely by staff? Do your staff share passwords with each other? Do they allow others to use their accounts? – Hint: Passwords should not be scribbled on a post-it note and stuck to your computer monitor! If everyone knows Johnny’s password, then everyone can use his account with impunity. Using a reputable password manager can even allow the business to generate secure passwords and grant access to the system without even disclosing the password to the employee.
• When an employee leaves, is their account access immediately suspended and the password reset? Do your staff contracts contain confidentiality provisions, and do you remind them of their obligations post-termination? Even if you part with an employee on good terms, leaving the gate open is never a good idea.
• Does your staff know what to watch out for to avoid falling victim to scam or phising emails?  Consider training your staff on how to identify illegitimate emails by visiting www.scamwatch.gov.au.
• Does your system log user’s access and activities? Do you get automatic alerts if unauthorised access occurs? Server access logs are vital evidence if the worst should happen.
• Are your devices and those used by your staff secure? You wouldn’t leave the house without locking up: Don’t leave your desk (or your smartphone) without doing so! Physical and digital security is critical. Keep all your systems patched with the latest manufacturer and vendor updates.
• Are all your eggs in one basket? Backups, backups and more backups. Ensure they are kept securely too, to guard against deletion, data corruption, and ransomware or cryptoware attacks. Backups also allow you to resume or continue business operations more quickly in the event of a disaster.

In case of emergency…

Knowing what to do if a breach occurs can make the difference between swift recovery and absolute disaster.

• Consider engaging a data security consultant to develop a disaster management plan – you’ll need to manage both your IT and your PR.
• Train your staff to be security conscious and identify and report risky and suspicious behaviour.
• Know how to lock down access to the system to prevent further breach. Continuing to operate on a compromised system can be risky.
• Know how to quickly obtain your evidence and act quickly as soon as you discover a breach. As in the ShowPo case, in some circumstances with quick action it is possible to obtain interim court orders to protect your position before the horse has bolted.

References

Show Pony Group Pty Ltd v Black Swallow Boutique & Ors (Federal Court of Australia, File No. NSD1984/2016) [ https://www.comcourts.gov.au/file/Federal/P/NSD1984/2016/actions ]

If you have concern’s over the security of your client data contact Rouse Lawyers today to discuss how we can assist you.