DATA BREACH POLICY

Purpose and Scope

Racing Queensland (RQ) collects and holds Personal Information for the purposes of performing various obligations and business functions. This can include Sensitive Information relating to participants and other persons within the racing industry.

This policy is RQ's overarching policy about how RQ will respond to Data Breaches and Suspected Data Breaches of RQ.  All RQ Workers have a responsibility to comply with this policy. and to uphold confidentiality and protect the information provided to them by the public.  

To assist RQ Workers with practical steps for responding to Data Breaches and Suspected Data Breaches of RQ, RQ has a Data Breach Response Plan.

Definitions

Roles and responsibilities

The following is a summary of those, at RQ, who have responsibilities in relation to Data Breaches and Suspected Data Breaches.

Responding to a Data Breach

All RQ Workers have a responsibility to report a Data Breach or a Suspected Data Breach.

It is RQ’s policy that responding to a Data Breach or Suspected Data Breach involves the following steps and that these steps be implemented in accordance with the Data Breach Response Plan.

Step 1: Preparation

So as to be prepared for appropriate management of Data Breaches and Suspected Data Breaches, RQ requires all RQ employees to undertake training about privacy awareness and data breach management.  This occurs annually for all staff.

Step 2: Identification

Where an RQ Worker becomes aware of a Data Breach or suspects that a Data Breach may have occurred, RQ requires it to immediately report the breach or suspected breach to their manager and the Senior ICT Manager.

The RQ Worker is to give as much information as possible when reporting the matter, including:

• The date when it occurred;
• How it occurred;
• The type of Data Breach or Suspected Data Breach that occurred, i.e. unauthorised disclosure or unauthorised access;
• The type of information that has or may have been accessed/disclosed, such as Personal information; and
• If known, any Affected Individuals.

Step 3: Containment and Mitigation  

It is RQ’s policy that, immediately, and on a continuing basis, all reasonable steps be taken to contain and mitigate a Data Breach to limit any further risk and exposure, including:

• Recovering or retrieving lost data that contains Personal Information;
• Suspending activities that led to the relevant circumstances;
• Securing, restricting access or shutting down to relevant systems; and
• Revoking or changing access codes or passwords.

The containment and mitigation strategies to be utilised by RQ will depend on the severity of the Data Breach, which will be informed by an initial assessment of the breach and any risks that it poses, such as the nature and sensitivity of the information, the amount of information and potential number of Affected Individuals and the seriousness of any harm.

RQ’s policy is that appropriately experienced third parties be engaged, where appropriate, to assist with containment and mitigation of Data Breaches or Suspected Data Breaches which may pose a high risk.

Step 4:  Assessment 

RQ's policy is the Data Breach Response Team be convened where a Data Breach or Suspected Data Breach may be an Eligible Data Breach.

The Data Breach Response Plan sets out key criteria for the Data Breach Response Team to consider when assessing the seriousness of harms in connection with an assessment of a possible Eligible Data Breach, including:

• the kind of Personal Information accessed, disclosed or lost;
• the sensitivity of the Personal Information;
• whether the Personal Information is protected by 1 or more security measures;
• if the Personal Information is protected by 1 or more security measures, the likelihood that any of those security measures could be overcome;
• the persons, or the kinds of persons, who have obtained, or who could obtain, the Personal Information;
• the nature of the harm likely to result from the Data Breach; and
• any other relevant matter, such as the effectiveness of the steps taken to control the Data Breach, whether the Data Breach has affected another agency and whether there any vulnerabilities of the Affected Individuals (e.g. children).

RQ is to take all reasonable steps to ensure that this assessment is completed within 30 days of RQ becoming aware of the Data Breach.

Step 5: Notification

If RQ determines that the Data Breach is an Eligible Data Breach or reasonably suspects that the Data Breach is an Eligible Data Breach, and unless an exemption applies, RQ is to notify:

• The Office of the Information Commissioner Queensland; and
• Affected Individual(s).

An exemption may apply to the notification requirements contained in the IP Act in situations where notification may cause a serious risk of harm to the individuals health or safety, the notification would likely prejudice an investigation or court proceedings, or RQ has taken steps to contain the Data Breach and eliminate the likelihood of Serious Harm.

Notifications to Affected Individuals are to include:

• RQ’s name;
• RQ’s contact details for the individual to contact;
• The date the Data Breach occurred;
• A description of the Data Breach, including the type of Data Breach;
• Information about how the Data Breach occurred;
• A description of the Personal Information the subject of the Data Breach;
• RQ’s recommendations about the steps the individual should take in response to the Data Breach;
• The period during which access or disclosure was made or available;
• The steps RQ has taken or will take to contain and mitigate the Data Breach; and
• Information about how the individual may make a privacy complaint.

Depending on the circumstances and severity of the Data Breach, RQ may also notify:

• The Minister for Racing;
• The Queensland Government Cyber Security Unit (CSU);
• Law enforcement agencies; and
• Any other agency affected by the Data Breach.

Step 6: Review and Remediation 

Within a reasonable time following an Eligible Data Breach, the Data Breach Response Team is to oversee a review of the circumstances that lead to the Eligible Data Breach to determine learnings from the relevant incident and what (if any) measures can be taken to prevent the risks of a similar incident happening again.

Such measures may include updating internal policy and procedure documents (RQ’s Information Security Guideline, Privacy Policy and/or the Data Breach Response Plan), reviewing and changing IT systems and security and further training for RQ Workers.

Data Breach Register

RQ has established and will maintain an internal register that details all Eligible Data Breaches of RQ.

Record-keeping

RQ has processes for documenting the management and response to Data Breaches and Suspected Data Breaches, which includes preparation of a memorandum that details RQ’s analysis of the Data Breach to determine whether it is an Eligible Data Breach.  

Related Legislation and Policies

RQ has a Privacy Policy.   A copy of it is available at this link: Privacy Policy or can be requested from the Privacy Officer whose contact details are below.

Individuals have the right to access and correct their Personal information held by RQ.  This is under the Right to Information Act 2009 (Qld).   For information about this, the Privacy Officer, whose contact details are below, may be contacted.

Further Information and Contacts

For further information about this policy, to report a Data Breach or Suspected Data Breach or for any privacy-related questions generally, please contact:

Privacy Officer
 Racing Queensland
 PO Box 63
 DEAGON QLD 4017

Phone: (07) 3869 9777

Email: rti@racingqueensland.com.au

The Office of the Information Commissioner Queensland also has contact details.:

Telephone: (07) 3234 7373 or 1800 642 753

Email: enquiries@oic.qld.gov.au

Postal address: PO Box 10143, Adelaide Street Brisbane  Q  4000

Published July 1, 2025