The Federal Government is set to introduce data disclosure laws in Australia as early as 2008.

The push for data disclosure laws in Australia is part of a review of the Privacy Act being undertaken by the Australian Law Reform Commission (ALRC) which began early this year.

A discussion paper, recommending the introduction of these laws which would force organizations to notify customers of security breaches, will be released next month with the final report to be delivered to the Federal Attorney General, Philip Ruddock, in March 2008.

While a spokesperson for the Attorney General was unwilling to comment prior to the report's release, federal government sources said the laws could be accommodated by amending the current Privacy Act, enabling their introduction by the end of 2008.

Similar legislation dealing with data breaches and disclosure laws are currently being introduced in the United States, with one law (bill AB 779) even requiring retailers to be held responsible for the cost of a security breach. This law is scheduled to go before the Senate Appropriations Committee before August 31, 2007.

Claiming that Australia should follow America's lead with similar laws, Federal Privacy Commissioner, Karen Curtis, said that "we are out of step if we don't look at it."

Curtis supports mandatory reporting of breaches, especially if it involves a lot of customer data and a lot of money.

"Customers should be notified. But it is still early days on how we can do it but I certainly think it is worthwhile looking at," she said.

"I think its good business to notify customers although I don't think notification is appopriate under all circumstances, it really depends on the level of damage created by the breach."

Curtis said the ALRC's recommendations, which will be put forward in the discussion paper in September, will lead to a wider review and more discussion.

"I think the introduction of these laws is a natural evolution of the Act," she added.

Operations at the Office of the Privacy Commissioner have certainly been beefed up since Curtis took the helm. Funding has more than doubled in three years from $4 million to $8 million to assist with corporate compliance efforts and identify gaps in the legislation.

The push for the disclosure of data breaches has been gaining momentum, especially after more than 100 HSBC Australia customers had their banking details exposed in a security breach in March this year.

Despite the breach, HSBC didn't take any steps to notify customers. But as Hydrasight analyst, Michael Warrilow, pointed out there is no requirement for the bank to disclose the breach under current laws.

"This isn't an isolated incident, it happens a lot but we don't hear about it. Until disclosure laws are introduced in Australia it will continue to happen," Warrilow said.