- Removal manifest
- Sheet 4 of 7
- Item 3: the data
Getting your data back, and deleting it
When a hosting or cloud contract ends, the OAIC’s guidance points to two jobs: getting your information back in a form you can still use, and confirming that the provider has destroyed it and its copies, backups included. For a business the Privacy Act covers, information handed to a host can still be information the business holds, so the duty to destroy or de-identify what it no longer needs follows the data there.
The OAIC is the official place to check. Not every business is covered: the OAIC explains that most small businesses, those with an annual turnover of $3 million or less, are not covered by the Privacy Act, but some are. Its small business page sets out which ones.
01Information a host stores is still yours to look after
The Australian Privacy Principles’ security rule, APP 11, applies to personal information a business holds. The OAIC’s guidelines explain that ‘holds’ is wider than having the files in your own hands:
“For example, an entity that outsources the storage of personal information to a third party, but retains the right to deal with that information, including to access and amend it, holds that personal information.”
OAIC, APP guidelines, Chapter 11, paragraph 11.6
The OAIC’s guide to securing personal information draws the consequence for breaches. If APP 11 applies to you, so do the requirements of the Notifiable Data Breaches scheme, even when it is the third party that suffers the breach; only one of you is required to notify the people affected. Until the old host’s copies are gone, then, its systems are still part of your picture.
02Three questions for the end of a contract
The OAIC’s guide includes a checklist for businesses that use cloud computing. Most of it is about choosing and running a service, but three consecutive questions near its end are about leaving one:
- “Is your data stored in a format you will be able to access or use if you need to retrieve it or amend it?”
- “Can the cloud service provider confirm whether it copies or otherwise replicates your information for its internal operational purposes (for example, if it moves your information between its IT assets), and what controls it has in place?”
- “Can the provider confirm that your information and any copies (including backups) have been destroyed at the conclusion of the contract? Can you retrieve the information?”
OAIC, Guide to securing personal information, “Cloud computing”
Read in order, they make a short exit plan. The first is about the export: a file you cannot open is not your data back. The second is about knowing where the copies are, because a provider that replicates information across its own systems has more than one copy to destroy. The third pairs the two jobs of this sheet in a single question: confirmation of destruction, and retrieval.
03Getting it back
Some of what sits in a host’s database is also a business record, and the tax rules want it readable for the whole retention period, whoever hosts it. The ATO’s ruling on electronic records says records stored in the cloud are subject to the same record-keeping requirements as paper ones, and that “Data should be capable of being extracted and converted into a standard data format”. Keeping business records through a move takes those requirements one at a time.
That overlap is also why “delete everything” is not always the right instruction. The APP 11.2 duty to destroy or de-identify does not apply where an Australian law or a court or tribunal order requires the information to be kept. Getting the data back first, and deciding what must be kept, comes before asking the old host to clear it.
04Then deleting it
Under APP 11.2, a business must take reasonable steps to destroy personal information, or make sure it is de-identified, once it no longer needs it for any purpose the APPs allow it to be used or disclosed for. The OAIC’s APP 11 guidelines explain destruction, de-identification and the narrow fallback of putting information ‘beyond use’ in full; this sheet does not repeat them.
For a move, the part that bites is the copies the old host keeps for its own safety. The OAIC’s guide asks:
“Are back-ups of personal information also destroyed? Are backups arranged in such a way that destruction of backups is possible?”
OAIC, Guide to securing personal information, “Destroying personal information: irretrievable destruction”
A provider’s answer to the second question depends on how its backups were set up, so it is a question to ask while you are still a customer.
05Write down what was destroyed
Two regulators, for two different reasons, ask for a note of how deletion was done.
| Regulator | What it says | Why |
|---|---|---|
| OAIC | Its examples of organisational measures include “verifying and documenting when and what personal information is destroyed or de-identified.” | Part of the reasonable steps APP 11 asks for. |
| ATO | “Keep all information about any routine procedures you have for destroying electronic records.” | Part of keeping records for the retention period. |
A provider’s written confirmation that your account and its backups have been destroyed, kept with your own records, is one way to have something to point to later. That is this guide’s suggestion, not a form either regulator prescribes.
06If the data was stored overseas
The OAIC notes that when a business uses cloud computing, other privacy principles may apply as well as APP 11, including APP 8 where personal information is disclosed to an overseas recipient, and APPs 12 and 13 on access and correction. For the moment the site actually switches over, see a safe cutover.