Commentary on provisions of Act Section 4: Informing others of security compromises Section 105J: Duty to inform users of risk of security compromise
Section 105J places a duty on providers to take reasonable steps to inform users about security compromises or where there is a significant risk of a security compromise occurring and the user may be adversely affected as a result.
	The purpose of this section is to allow providers to inform users who may be adversely affected by the security compromise, and to give the user the information they would need to take steps to prevent, remedy or mitigate the adverse effect that the security compromise would have on them. An example of the type of steps that a user may take could be changing their password.
	Specifically, the provider must inform the user about the existence of the risk, the nature of the security compromise, the steps which could reasonably be taken by users in response to prevent, remedy or mitigate the adverse effect that the security compromise would have on them, and the name and contact details of a person who may provide further information (subsection (3)).
	By ‘reasonable and proportionate’ this section intends that reasonable steps should be taken by providers which are proportionate to the size and impact of compromise risk, both in relation to the way the information is shared, and the time at which the information is provided. For example, in some circumstances, if a risk can be mitigated quickly it may be more reasonable for short term mitigation measures to be put in place before users are informed, if this provides better protection to the network or service and ultimately the user.