Privacy Commissioner Timothy Pilgrim said he had received 15 voluntary breach notifications from organisations this financial year so far, and had initiated seven investigations of other breaches. Last financial year his office received 46 voluntary notifications and launched 37 investigations into other breaches.

Mr Pilgrim said because organisations were not currently required to report breaches, it was impossible to know how common it was for data to be compromised, for example by being accessed by hackers, through the loss of computer equipment or through negligent or improper disclosure.

Mr Pilgrim said notifications could give customers the opportunity to reduce the impact of the security breach on them, for example by cancelling credit cards or changing account passwords, and could also improve public confidence in the handling of their information.

Security analyst James Turner, of IBRS, believed the introduction of data breach notification laws was an important stage "in our maturity as a society that's increasingly relying on interconnected computer systems".

But he warned of some of the fatigue issues the US faced when it introduced the laws in certain states and said the challenge for government was going to be in "defining what a breach is".

"It's becoming a running joke now about people who are getting this constant stream of letters in their letterbox telling them that their data has been compromised," Mr Turner said.

Mr Turner added that Australians would "genuinely be shocked" by the magnitude of breaches in Australia if data breach notifications laws were introduced.

"I would expect that when [data] breach notification [law] comes through that we're going to suddenly discover that there is a lot of stuff happening that we didn't know about before," Mr Turner said.

Paul Ducklin, of security firm Sophos, said he believed it had taken too long for government to announce any action on data breach laws.

"I thought it was a good idea back in 2008 [and] I've been publicly calling for it for a while now," he said.

On the fatigue issue, he said the best way to fix it was via companies preventing data breaches from occurring in the first place.

Chris Gatford, of security firm Hacklabs, agreed that it had taken too long for laws to be proposed in Australia.

"We are one of the last western society's not holding organisations to account when they lose personally identifiable information of customers, employees or citizens," Mr Gatford said.

He said jurisdictions that had mandatory data breach notifications laws were more security aware. "We have noted this difference quite considerably on our Australian versus international customers," Mr Gatford said.

"We see evidence of hundreds [of data breaches] a quarter [in Australia] and aren't really looking that hard," he said. "I would estimate tens of thousands."

Ty Miller, of security firm Pure Hacking, said 99 per cent of organisations his company performed data breach investigations for in Australia did not disclose the breaches. This was because "it would have a negative impact on their brand and bottom line", he said.

"Data breach notification laws may negatively impact businesses who become compromised since brand damage will occur if the information is made public. This may lead to more small to medium sized businesses folding after a security breach."

Despite this, he said such laws would enable both consumers and business owners to gain a realistic picture of the large number of security breaches that were occurring in Australia.

In 2008, the ALRC recommended organisations be required to notify people whose privacy had been infringed, where the breach caused a "real risk of serious harm". Notification would not be required if it would compromise a criminal investigation or was determined by the regulator to be contrary to the public interest, the ALRC said, and civil penalties, including financial ones, should apply to organisations that failed to make the required notifications.

In the US, almost all states have data breach laws and Congress is considering national proposals. In the European Union, only electronic communications providers such as telecommunications firms are required to notify regulators and customers of breaches. It is considering wider proposals that would cover all sectors.

Submissions in reply to the Australian discussion paper are sought by November 23. Follow IT Pro on Twitter