Australia’s acting information commissioner has urged companies to store customer records safely after an investigation of a telecommunications company that left former customers’ records in a shipping container on publicly accessible land.
The acting information commissioner, Timothy Pilgrim, said he had accepted an “enforceable undertaking” from TeleChoice, which provides credit monitoring services.
Pilgrim initiated an investigation into the company after news reports showed a container owned by the company which appeared to contain files belonging to TeleChoice, the trading name for Business Service Brokers Pty Ltd.
The trove of customer data was stored in a container that was “open and apparently accessible to members of the public in Victorian bushland”. They were initially stored in a fenced property before being moved to the unfenced location in January.
The container was then broken into at some point after the company’s latest maintenance check in 2015. The company was “unable to determine” which customers’ data was stored in the container.
The company conceded it had breached Australian privacy laws, and has said it would improve its data handling practices.
It also said it would reimburse customers of the costs of 12 months of credit monitoring services, and would establish new written policies about the destruction of personal information.
Pilgrim said: “The enforceable undertaking provides a positive outcome for people affected by the breach, with TeleChoice agreeing to, amongst other things, reimburse the cost of a 12-month credit monitoring service for affected individuals who are concerned about the possibility of credit fraud.
“This incident demonstrates the importance of businesses securing the personal information that they hold. Physically locking a container that holds personal information is not sufficient if the container is publicly accessible and unmonitored for extended periods.
“I would encourage all businesses to review their customer records storage. Australian customers expect that organisations will handle their personal information securely, and are entitled to this under the Privacy Act.”
The investigation follows the release of the office of the Australian information commissioner’s (OAIC) annual report, which saw a significant increase in the number of freedom of information requests at a time of uncertainty for the agency.
The federal government announced plans to abolish the OAIC in May 2014, but has failed to gain support in the Senate to pass legislation. The office has continued to receive funding, and Pilgrim was recently reappointed acting information commissioner after the departure of John McMillan and James Popple.
Pilgrim hailed the resolve of his staff during the reporting period, which saw a significant increase in privacy activities after Australia’s new privacy laws were enacted. He also touted the agencies’ handling of FOI matters, and their efforts to reduce a backlog of appeals.
“Throughout the year, I exercised a number of the new enforcement powers that were given to me by the privacy reforms. This included conducting privacy assessments of businesses and accepting the first enforceable undertaking made under the amended Privacy Act,” he said.
“The OAIC made excellent progress in resolving FOI matters, successfully implementing a streamlined information commissioner review (IC review) process, which focuses on early resolution. This process has significantly reduced the backlog of IC reviews that existed at the start of the reporting year and assisted in increasing the number of IC review decisions made during the period – 128, up from 98 in the previous financial year.”
