Skip to main content
Skip to secondary navigation
Menu
Australian Government - Office of the Australian Information Commissioner - Home

Immigration Data Breach Privacy Complaint

Note: The Acting Commissioner has granted a further 14 week extension of time for group members to respond to the Notice to all persons in immigration detention on 31 January 2014. The closing date for submissions is now 4.00pm on 19 October 2018. It is not anticipated that any further extensions of time will be granted.

Quick links

We can also provide you a copy of this Notice in your preferred language on request, by emailing us at repcomplaint@oaic.gov.au.

Please read the Notice and, if you wish to provide a response, complete the Response Form.

The closing date for submissions is 4.00 pm on 19 October 2018.

Introduction

On 10 February 2014, the Department of Immigration and Border Protection (now the Department of Home Affairs) (Department) published, in error, a detention report on its website that contained embedded personal information (Data Breach). More information about the Data Breach is available here.

The report contained the personal information of all 9,258 persons who, as at 31 January 2014, were in immigration detention.

The personal information disclosed in the Data Breach consisted of full names, gender, citizenship, date of birth, period of immigration detention, location, boat arrival details, and the reasons which led to the individual becoming an unlawful non-citizen under the Migration Act 1958.

On 30 August 2015, a representative complaint was made to the Office of the Australian Information Commissioner (OAIC) on behalf of all persons whose information was published by the Department in error (Group Members). The complaint requested the Department provide an apology and compensation.

In the complaint, which was initially made as an individual complaint, the Representative Complainant referred to the Data Breach, and advised that as they were in immigration detention in January 2014, they had reason to believe their personal information was disclosed by the Department.

The Acting Commissioner is preparing to make a determination on this matter under s 52 of the Privacy Act 1988 (Cth), in which she will consider whether a remedy, including any compensation, should be awarded to any individual Group Member who has suffered loss or damage as a result of the Data Breach.

To assist the Acting Commissioner to determine whether individual Group Members should be awarded compensation, OAIC is seeking information from individuals who were:

  • in immigration detention (including Immigration Detention Centres, community placements, and alternative places of detention) on 31 January 2014, and
  • suffered any loss or damage as result of the Data Breach.

Frequently Asked Questions

Do I need to respond to this Notice?

You need to respond to this Notice if you were in immigration detention on 31 January 2014 and you have suffered any loss or damage as a result of the Department’s Data Breach.

The Acting Commissioner will consider whether you are entitled to any remedy, including any compensation, from the Department based on the information and evidence you provide.

If you have not suffered any loss or damage as a result of the Data Breach, you will not be entitled to compensation and you do not need to respond to the Notice.

You also need to respond to the Notice if you wish to ‘opt out’ of the Representative Complaint. If you ‘opt out’ of the Representative Complaint, your complaint will not be considered as part of the Representative Complaint.

If you wish to make an individual complaint about the Data Breach, you need to ‘opt out’ of the Representative Complaint before doing so.

What is ‘loss or damage’?

Loss or damage can include any kind of physical or emotional harm, including stress and anxiety, or any negative impact on your mental or physical health as a result of the Data Breach. It can include injury to feelings or humiliation. It can also include financial harm.

The Acting Commissioner can only assess actual loss or damage you have suffered, and not potential or future loss or damage.

Do I need to provide information about anything other than loss or damage suffered by me as a result of the Data Breach?

No. The Acting Commissioner has already been provided with submissions on behalf of Group Members and the Department in relation to the Data Breach, upon which the Acting Commissioner has formed a preliminary view that the Data Breach did in fact occur, and the personal information of a number of individuals was disclosed as a result of the Data Breach. The Acting Commissioner does not seek any further information from any Group Member in relation to this issue.

I am unsure if the Representative Complaint applies to me

If you were in immigration detention on mainland Australia or on Christmas Island as at midnight 31 January 2014, the Representative Complaint extends to you as a ‘Group Member’.

Group Members include the 5,867 people who were in immigration detention facilities and alternative places of detention (including 3,967 people in immigration detention on the mainland and 1,900 in immigration detention on Christmas Island) as well as the 3,391 people who were living in the community under a residence determination, as at midnight 31 January 2014.

Individuals who were in regional (offshore) processing centres (including the Republic of Nauru and Manus Province, Papua New Guinea) on 31 January 2014 were NOT affected by the Data Breach, and should not respond to this Notice.

If you are unsure about whether you were in immigration detention on 31 January 2014, you should confirm this with the Department before providing your response.

The Department will also have an opportunity to verify that your personal information was involved in the Data Breach after you have made a submission or submitted evidence.

Can my representative respond on my behalf?

Yes, your representative may provide your response on your behalf. However, you should provide your representative with information about your loss or damage in your own words.

Can an estate provide a response on behalf of a deceased person?

Yes.

Can I provide submissions as well as evidence?

Yes, you may provide submissions as well as any available supporting information or evidence to support your claim.

What kind of information or evidence can I provide to support my claim?

You should provide any information you consider to be relevant to the loss or damage you have suffered. Information may be provided in any form you see fit. By way of guidance only:

  • evidence may include a statutory declaration or signed statement in your own words;
  • evidence may be from the time of the Data Breach or when you first found out about the Data Breach;
  • evidence may include medical reports;
  • limited weight may be given to evidence in standard forms and medical reports prepared after the date of this Notice.

How do I provide a Statutory Declaration?

Statutory Declarations can be downloaded on the Attorney General’s Department website at https://www.ag.gov.au/Publications/Statutory-declarations/Documents/CommonwealthStatutorydeclarationform.pdf

If you would like to provide a Statutory Declaration, please print out a copy of the form. Then, in your own words, describe how the Department’s Data Breach has caused you loss or damage (which may include physical, emotional or financial harm).

You need to sign your Statutory Declaration in front of an authorised witness. The second page of the Statutory Declaration explains who can witness your statement (including pharmacists and medical practitioners, for example).

Once you complete your Statutory Declaration, and have had it witnessed by an authorised person, you can upload it onto our online Response Form at https://forms.business.gov.au/smartforms/landing.htm?formCode=oaic-rep-comp.

Alternatively, you can email your Statutory Declaration to us at repcomplaint@oaic.gov.au.

If you cannot easily complete a Statutory Declaration (for example, because you are outside Australia and do not have access to an authorised witness), you could instead provide a signed statement or letter to the Acting Commissioner describing how the Data Breach has affected you.

How can I obtain from the Department my medical records from the time of the Data Breach, or other information regarding the loss or damage I suffered as a result of the Data Breach?

Please visit https://www.homeaffairs.gov.au/about/access-accountability/privacy for further information about requesting information, including medical or other records, from the Department.

You are encouraged to request any information you need from the Department as soon as possible, because the Department may require 3–4 weeks to process your request.

The Department can only provide you with personal records that it holds for you. If you are seeking records in relation to services provided while you were in community detention, you will need to approach the relevant service provider directly.

How do I provide a response?

You may provide your response by completing the Response Form or by emailing your response to us at repcomplaint@oaic.gov.au.

Please include your complaint reference number in any correspondence you provide us (if you have one).

How long do I have to respond?

Please respond to the Notice by 4.00 pm on 19 October 2018.

Any information received after this date may not be considered.

When do I have to opt out by?

If you do not consent to the Representative Complaint being made on your behalf and do not want to be part of it, you can opt out at any time before the Acting Commissioner makes a determination.

What happens if I opt out of the Representative Complaint?

If you opt out of the Representative Complaint, any determinations made by the Acting Commissioner in relation to the Representative Complaint will not apply to you.

If you have known about the Data Breach for more than 12 months, and have not already made an individual complaint to the Acting Commissioner about it, the Acting Commissioner may decide not to investigate any new complaint made by you if you opt out of the Representative Complaint.

I wasn’t aware of the Data Breach, do I need to respond?

The information that the Department published is no longer online. Information about the publication of the data and its removal is available on the Department’s website.

If you have not experienced loss or damage as a result of the Data Breach, you do not need to respond to the Notice.

I am from a refugee and asylum seeker support organisation, how can I help Group Members?

If your organisation wishes to provide free support to Group Members in responding to this Notice or corresponding with the OAIC, please contact us at repcomplaint@oaic.gov.au, and we can make your details available on our website.

What will the OAIC do with my response?

The OAIC is collecting your response for use in the Representative Complaint. The OAIC and the Acting Commissioner will review your response. A copy of your response will also be given to the Department, who is the respondent. Please see the privacy notice on the Response Form for more information about how we will handle your personal information.

Can't use the online Response Form?

If you can’t use the online Response Form, download the Microsoft Word version below.

docxMicrosoft Word version89.13 KB

Complete it and send it to us by post, fax or email.

Post GPO Box 5218
Sydney NSW 2001
If you have concerns about postal security, you could use registered mail.
Fax +61 2 9284 9666
Email repcomplaint@oaic.gov.au
Note that email that is not encrypted can be copied or tracked.

Further information

If you have any further enquiries about this matter, you may contact the OAIC Enquiries Line on telephone 1300 363 992 (between 10am–4pm Australian Eastern Standard Time), or by email to repcomplaint@oaic.gov.au.

Assistance in languages other than English

If you require further assistance about this matter in a language other than English, please call the Translating and Interpreting Service on 131 450 then ask for 1300 363 992.

Note: These calls can be made for a local call cost from fixed residential landlines anywhere in Australia, but calls from mobile and pay phones may incur higher charges.

Translations of Notice