Okay, well I am a solicitor in NSW.
You said that (and my responses in caps are):
"Questions that come to mind are:
- Who's liable for for the loss of data if for instance the tapes are stolen from my residence? THIS WILL DEPEND UPON HOW THIS RISK IS APPORTIONED IN YOUR EMPLOYMENT CONTRACT OR WORK POLICIES THAT ARE APPLICABLE IN YOUR WORKPLACE (WHICH MAY BE IN AN ONLINE INTRANET, OR STORED ELSEWHERE). IT'S NOT REALLY A MATTER OF LOOKING FOR "laws, acts, regulations and references" AS YOU SUGGESTED, IT'S MORE A RISK THAT THE CONTRACT DRAFTER WOULD EITHER DELEGATE TO YOU, OR TO YOUR EMPLOYER. SO AS LEON SAID, YOU CANNOT REALLY KNOW WHOSE RISK IT IS WITHOUT SEEING THESE DOCUMENTS FIRST.
- In the above scenario what are the privacy implications of data that may be compromised? THE PRIVACY IMPLICATIONS ARE NOT IMPLICATIONS FOR YOU BUT RATHER FOR THE COMPANY. IT IS THE COMPANY THAT HAS THE OBLIGATION UNDER THE PRIVACY ACT 1988. AS YOU CAN SEE FROM THIS PROVISION THE ONLY TIME AN EMPLOYEE'S ACTIONS ARE REALLY RELEVANT IS IN DETERMINING WHETHER THE ORGANISATION IS LIABLE, NOT YOU AS AN EMPLOYEE. YOUR ACTIONS WILL BE RELEVANT TO DETERMINE THEIR LIABILITY. HAVING SAID THAT, THE ORGANISATION CAN STILL POSSIBLY SUE YOU FOR NEGLIGENCE IN LOSING THE DATA, AGAIN, AS LEON SAYS, UNLESS YOUR EMPLOYMENT CONTRACT EXCUSES YOU OF THAT LIABILITY OR SOME OTHER DOCUMENT YOU HAVE SIGNED WITH THE COMPANY OR SOME INTERNAL POLICY THAT IS INCORPORATED INTO YOUR EMPLOYMENT CONTRACT STATES THAT YOU ARE NOT RESPONSIBLE. IT'S NOT THEREFORE A STRAIGHTFORWARD ANSWER, IT DEPENDS ON ALL THAT INFORMATION TAKEN TOGETHER WHETHER A NEGLIGENCE SUIT AGAINST YOU WOULD BE SUCCESSFUL. FURTHER, THE COMPANY MAY, WHEN TAKING THE INFORMATION FROM OTHERS THAT FORMS THE "DATA", IF IT IS PERSONAL INFORMATION, HAVE INFORMED THE PERSON IT COLLECTED THE DATA FROM THAT IT MAY BE EXPOSED TO THIS RISK, WHICH MAY ABSOLVE THE COMPANY FROM RESPONSIBILITY. BUT I'M GUESSING THAT YOU'RE NOT SO MUCH CONCERNED WITH THE COMPANY'S LIABILITY AS YOU ARE YOUR OWN.
- What are the legal responsibilities of the person being given this "safe-keeping" role? THEREFORE, CONSIDERING MY ANSWERS TO THE ABOVE, THE RESPONSIBILITIES OF THE PERSON BEING GIVEN THE SAFE-KEEPING ROLE ARE UNCLEAR. YOU ARE BEST TO SEEK THE COMPANY TO ABSOLVE YOU OF ANY RESPONSIBILITY FOR LOSS OF DATA THROUGH AMENDMENTS TO YOUR EMPLOYMENT CONTRACT OR OTHER DOCUMENTS YOU MAY HAVE SIGNED OR BY CHANGE OF THE INTERNAL POLICY THAT APPLIES. SO MAY I SUGGEST YOU GATHER ALL THE INFORMATION (CONTRACT, POLICY, ANY FURTHER DOCUMENTS SIGNED BY YOU THAT HR MAY HAVE) AND DETERMINE WHAT THE COMPANY IS EXPECTING OF YOU THROUGH THESE DOCUMENTS AND IF IT IS ONEROUS, SEEK TO HAVE THE OBLIGATION THEREIN CREATED TO BE CHANGED TO YOUR ADVANTAGE. THIS MAY NOT BE EASY IF THE COMPANY IS NOT WILLING TO ABSOLVE YOU OF THIS RESPONSIBILITY.
- Is the company in a legal position to provide an employee with such a responsibility? THE COMPANY CANNOT ESCAPE ITS PRIVACY OBLIGATIONS UNDER THE PRIVACY ACT 1988. HOWEVER IT CAN MAKE YOU RESPONSIBLE THROUGH NEGLIGENCE FOR LOSS OF DATA IF IT HAS CREATED IN YOU THIS OBLIGATION THROUGH YOUR CONTRACTS AND OTHER DOCUMENTS/POLICIES AS OUTLINED ABOVE. WHAT YOU CAN ALSO ASK THE EMPLOYER IS WHETHER THE EMPLOYER INSURES ITSELF AGAINST LOSS OF DATA SO THAT IT WOULD BE UNLIKELY TO CHASE YOU FOR THE MONEY INVOLVED IN THIS LOSS, BUT RATHER TO SEEK COMPENSATION THROUGH AN INSURER TO COVER ITS LOSSES AND THE LOSS SUFFERED THROUGH ANY PRIVACY SUIT."
I understand that this doesn't involve legislation, case law etc, but quite honestly, without further details from you as to the terms and conditions of your employment contract, an extensive look at your employer's policies and any other documents signed by you and held with HR, it's not really possible to advise on your particular circumstances. Suffice to know that the company cannot escape its privacy obligations, that your actions may cause it to be liable and that you may, if not protected through special clauses, be sued for the loss of data unless the employer opts instead to instruct its insurer to defend any privacy claims. However, if the data is not just personal information but also trade secrets, intellectual property and the like, you are more than likely to suffer a suit at the hands of your employer for losses incurred in relation to that without them having recourse to an insurer to cover that loss.
I hope that was the detail you were hoping for.
Let me know if anything's unclear.