Skip to main content
Skip to secondary navigation
Menu
Australian Government - Office of the Australian Information Commissioner - Home

Immigration Data Breach Privacy Complaint

Quick links

The closing date for submissions is 4.00 pm on 19 April 2018.

Background

The Office of the Australian Information Commissioner (OAIC) is seeking information from individuals who were:

The Data Breach occurred on 10 February 2014, when the Department published, in error, a detention report on its website that contained embedded personal information (Data Breach).

The report contained the personal information of all 9,258 persons who, as at 31 January 2014, were in immigration detention.

The personal information disclosed in the Data Breach consisted of full names, gender, citizenship, date of birth, period of immigration detention, location, boat arrival details, and the reasons which led to the individual becoming an unlawful non-citizen under the Migration Act 1958.

On 30 August 2015, a representative complaint was made to the Office of the Australian Information Commissioner on behalf of all persons (Group Members) whose information was published by the Department in error.

The Commissioner is preparing to make a determination on this matter under s 52 of the Privacy Act 1988 (Cth), in which he will consider whether a remedy, including any compensation, should be awarded to any individual Group Member who has suffered loss or damage as a result of the Data Breach.

If you resided in immigration detention on 31 January 2014, and you suffered any loss or damage as a result of the Department’s Data Breach, you will need to provide the Commissioner with information about this.

It is important that you read our Notice to All Persons in Immigration Detention on 31 January 2014 (Notice) for further information about this process, and what you may need to provide.

This Notice is also available in the languages listed below by selecting the appropriate link. We can also provide you a copy of this Notice in your preferred language on request, by emailing us at repcomplaint@oaic.gov.au.

The closing date for submissions is 4.00 pm on 19 April 2018.

Please read the Notice and, if you wish to provide a response, complete the Response Form. The Notice is available in English and in other languages.

Frequently Asked Questions

Do I need to respond to this Notice?

You only need to respond to this Notice if you were in immigration detention on 31 January 2014 and you have suffered any loss or damage as a result of the Department’s Data Breach.

The Commissioner will consider whether you are entitled to any remedy, including any compensation, from the Department based on the information and evidence you provide.

If you have not suffered any loss or damage as a result of the Data Breach, you will not be entitled to a remedy and you do not need to provide a response to this Notice.

You also need to respond if you wish to ‘opt out’ of the complaint. More information about this option is contained in the Notice.

What is ‘loss or damage’?

Loss or damage can include any kind of physical or emotional harm, including stress and anxiety, or any negative impact on your mental or physical health. It can include injury to feelings or humiliation. It can also include financial harm.

Any loss or damage you wish to claim must be a direct result of the Department’s Data Breach.

The Commissioner can only assess actual loss or damage you have suffered, and not potential or future loss or damage.

I am unsure if this representative complaint applies to me

If you were in immigration detention on mainland Australia or on Christmas Island as at midnight 31 January 2014, this representative complaint extends to you as a ‘Group Member’.

Group Members of this representative complaint include the 5,867 people who were in immigration detention facilities and alternative places of detention (including 3,967 people in immigration detention on the mainland and 1,900 in immigration detention on Christmas Island) as well as the 3,391 people who were living in the community under a residence determination, as at midnight 31 January 2014.

Individuals who were in regional (offshore) processing centres (including the Republic of Nauru and Manus Province, Papua New Guinea) on 31 January 2014 were NOT affected by the Data Breach, and do not need to provide a response to this Notice.

If you are unsure about whether you were in immigration detention on 31 January 2014, you should confirm this with the Department before providing your response.

The Department will also have an opportunity to verify that your personal information was involved in the Data Breach after you have made a submission.

Can my representative respond on my behalf?

Yes, your representative may provide your response on your behalf. However, you will need to provide your representative with information about your loss or damage in your own words, as the Commissioner will assess entitlements to any remedy, including any compensation, on an individual case-by-case basis.

Can I provide submissions as well as evidence?

Yes, you may provide a submission as well as any available supporting information or evidence to support your claim.

What kind of information or evidence can I provide to support my claim?

If you believe you suffered loss or damage as a result of the Data Breach you need to provide the Commissioner with information about your loss or damage.

You should provide any information you consider to be relevant to the loss or damage you suffered. This could include a statutory declaration or signed statement in your own words.

You may also include any evidence you have from the time of the Data Breach, or when you first found out about the Data Breach, (such as medical reports) that contain details about how you reacted to the Data Breach, and any treatment you received as a result of the Data Breach's impact on you.

Any medical reports prepared after the date of this Notice will be given little weight, as will statutory declarations or letters provided on your behalf which are not in your own words.

How do I provide a Statutory Declaration?

Statutory Declarations can be downloaded on the Attorney General’s Department website at https://www.ag.gov.au/Publications/Statutory-declarations/Documents/CommonwealthStatutorydeclarationform.pdf

If you would like to provide a Statutory Declaration, please print out a copy of the form. Then, in your own words, describe how the Department’s Data Breach has caused you loss or damage (which may include physical, emotional or financial harm).

You need to sign your Statutory Declaration in front of an authorised witness. The second page of the Statutory Declaration explains who can witness your statement (including pharmacists and medical practitioners, for example).

Once you complete your Statutory Declaration, and have had it witnessed by an authorised person, you can upload it onto our online Response Form at https://forms.business.gov.au/smartforms/landing.htm?formCode=oaic-rep-comp.

Alternatively, you can email your Statutory Declaration to us at repcomplaint@oaic.gov.au.

If you cannot easily complete a Statutory Declaration (for example, because you are outside Australia and do not have access to an authorised witness), you could instead provide a signed statement or letter to the Commissioner describing how the Data Breach has affected you.

How can I obtain from the Department my medical records from the time of the Data Breach, or other information regarding the loss or damage I suffered as a result of the Data Breach?

Please visit https://www.homeaffairs.gov.au/about/access-accountability/privacy for further information about requesting information, including medical or other records, from the Department.

You are encouraged to request any information you need from the Department as soon as possible, because the Department may require 3–4 weeks to process your request.

The Department can only provide you with personal records that it holds for you. If you are seeking records in relation to services provided while you were in community detention, you will need to approach the relevant service provider directly.

How do I provide a response?

You may provide your response by completing the Response Form or by emailing your response to us at repcomplaint@oaic.gov.au.

Please include your complaint reference number in any correspondence you provide us (if you have one).

How long do I have to respond?

If you would like to provide a response to this Notice, please ensure your response is received by no later than 4.00 pm on 19 April 2018.

Any information received after this date may not be considered.

When do I have to opt out by?

If you have not consented to the Representative Complaint being made on your behalf, you can opt out at any time before the Commissioner makes a determination.

If you wish to opt out, please do so by 4.00 pm on 19 April 2018 to ensure that your decision can take effect before the Commissioner makes a determination.

What happens if I opt out of the representative complaint?

If you opt out of the Representative Complaint, any determinations made by the Commissioner in relation to the Representative Complaint, including any determination relating to damages, will not apply to you.

If you have known about the Data Breach for more than 12 months, and have not already made an individual complaint to the Commissioner about it, the Commissioner may decide not to investigate any new complaint made by you if you opt out of the Representative Complaint.

I wasn’t aware of the Data Breach, do I need to respond?

The information that the Department published is no longer online. Information about the publication of the data and its removal is available on the Department’s website.

If you have not experienced loss or damage as a result of the data breach, you do not need to respond to this Notice. The Commissioner is only seeking information from those individuals who have been adversely affected by the Data Breach.

I am from a refugee and asylum seeker support organisation, how can I help Group Members?

If your organisation wishes to provide free support to Group Members in responding to this Notice or corresponding with the OAIC, please contact us at repcomplaint@oaic.gov.au, and we can make your details available on our website.

What will the OAIC do with my response?

The OAIC is collecting your response for use in the representative complaint. The OAIC and the Commissioner will review your response. A copy of your response will also be given to the Department of Home Affairs (formerly the Department of Immigration and Border Protection), who is the respondent. Please see the privacy notice on the Response Form for more information about how we will handle your personal information.

Can't use the online Response Form?

If you can’t use the online Response Form, download the Microsoft Word version below.

docxMicrosoft Word version89.13 KB

Complete it and send it to us by post, fax or email.

Post GPO Box 5218
Sydney NSW 2001
If you have concerns about postal security, you could use registered mail.
Fax +61 2 9284 9666
Email repcomplaint@oaic.gov.au
Note that email that is not encrypted can be copied or tracked.

Further information

If you have any further enquiries about this matter, you may contact the OAIC Enquiries Line on telephone 1300 363 992 (between 10am–4pm Australian Eastern Standard Time), or by email to repcomplaint@oaic.gov.au.

Assistance in languages other than English

If you require further assistance about this matter in a language other than English, please call the Translating and Interpreting Service on 131 450 then ask for 1300 363 992.

Note: These calls can be made for a local call cost from fixed residential landlines anywhere in Australia, but calls from mobile and pay phones may incur higher charges.

Translations of Notice