Schedule 1 Amendments 26WG Whether access or disclosure would be likely, or would not be likely, to result in serious harm—relevant matters For the purposes of this Division, in determining whether a reasonable person would conclude that an access to, or a disclosure of, information: (a) would be likely; or (b) would not be likely; to result in serious harm to any of the individuals to whom the information relates, have regard to the following: (c) the kind or kinds of information; (d) the sensitivity of the information; (e) whether the information is protected by one or more security measures; (f) if the information is protected by one or more security measures—the likelihood that any of those security measures could be overcome; (g) the persons, or the kinds of persons, who have obtained, or who could obtain, the information; (h) if a security technology or methodology: (i) was used in relation to the information; and (ii) was designed to make the information unintelligible or meaningless to persons who are not authorised to obtain the information; the likelihood that the persons, or the kinds of persons, who: (iii) have obtained, or who could obtain, the information; and (iv) have, or are likely to have, the intention of causing harm to any of the individuals to whom the information relates; have obtained, or could obtain, information or knowledge required to circumvent the security technology or methodology; (i) the nature of the harm; (j) any other relevant matters. Note: 10 If the security technology or methodology mentioned in paragraph (h) is encryption, an encryption key is an example of information required to circumvent the security technology or methodology. Privacy Amendment (Notifiable Data Breaches) Act 2017 Authorised Version C2017A00012 No. 12, 2017