George Brandis will move to make it a criminal offence to publish or disseminate “reidentified” government datasets, in a move that digital rights groups say could criminalise important research and security work.

The attorney general announced on Thursday that he would amend the Privacy Act to make it an offence to reidentify government data that had been published in anonymised formats.

“With advances of technology, methods that were sufficient to de-identify data in the past may become susceptible to reidentification in the future,” he said.

“The amendment to the Privacy Act will create a new criminal offence of reidentifying de-identified government data. It will also be an offence to counsel, procure, facilitate, or encourage anyone to do this, and to publish or communicate any reidentified dataset.”

The impetus for the release appears to be a Medicare dataset which could be used to identify particular doctors and service providers which was published by the Department of Health relating to the Pharmaceutical Benefits Scheme on the data.gov.au website.

The Office of the Australian Information Commissioner has announced an investigation into the circumstances of the data breach and the department’s processes for de-identifying data.

In a release from the department also issued on Thursday, a group of researchers led by Dr Vanessa Teague from the department of computing at Melbourne University discovered it was possible to reidentify some service providers and doctors using the dataset.

“The dataset does not include names or addresses of service providers and no patient information was identified,” the release said. “However, as a result of the potential to extract some doctor and other service provider ID numbers, the Department of Health immediately removed the dataset from the website to ensure the security and integrity of the data is maintained.”

The chair of Digital Rights Watch, Tim Singleton, has expressed concern about the move, because the offence could capture a range of innocent activities – including research and security testing.

“This move is extremely concerning and seems to be pre-emptive of the work of the Productivity Commission and its inquiry into data availability and use,” he said. “The minister is alluding to potentially a very broad offence of ‘facilitating’ reidentification.

“The specific wording of ‘counsel, procure, facilitate or encourage’ will need to be framed carefully to exclude innocent acts, such as rigorous penetration testing of encryption software.

“Likewise the whole area of research into de-identification research, such as that undertaken by the CSIRO, could be jeopardised through heavy-handed legislation.”

He urged Brandis to consult broadly with privacy groups to examine how the legislation would be introduced.

Teague, who led the research team that informed the department of the breach, told Guardian Australia the research had been conducted to examine the department’s protection of the data.

A copy of an article published by the researchers outlines how every single Medicare data code was able to be reidentified by linking the dataset with other available information.

“Publishing data can bring great benefits to research but also great risks to privacy,” it said.

“The mathematical details matter: it’s a technically challenging task to understand whether a particular algorithm securely encrypts data or not.

“Datasets containing sensitive information about individuals clearly deserve more caution than others, and may not always be suitable for open public release.”

Teague responded with caution to Brandis’s legislative response.

“The best thing that government could do is encourage Australian cyber security researchers to examine data security,” she said. “To the extent that this proposal is the opposite of that, then the proposal is a mistake.

“If we discourage Australian security researchers to undertake this kind of research then it makes it more difficult for government to ensure that data is protected.”

The health department has contacted the privacy commissioner to inform his office of the breach.

On Wednesday Brandis appointed Timothy Pilgrim permanently to the role of Australian information commissioner. He has been acting in it for more than a year.

He also appointed Pilgrim privacy commissioner, suggesting the Office of the Australian Information Commissioner will continue at a reduced capacity from the previous three statutory office holders.

Brandis said the legislation would be introduced in parliament’s spring sitting to amend the privacy laws.