-
On this page
Australian Information Commissioner’s foreword
People often come into contact with the court system during some of the most difficult moments of their lives. They are entitled to expect that their personal, and sometimes sensitive, information disclosed in court hearings will be treated with particular care.
Public reporting concerning the handling of court audio recordings and transcripts by VIQ Solutions Pty Ltd (VIQ), a transcription service used by many courts and government agencies in Australia, raised the possibility that this expectation had not been met. Those reports alleged that large quantities of sensitive court documents were improperly disclosed to a foreign entity.
My office treated this matter seriously and made preliminary inquiries to ascertain the facts about the incident, and to decide whether to conduct further investigations.
It became apparent through my inquiries that the size and scope of the incident was narrower than initial reports suggested, with only a small number of Australian court hearing recordings having been temporarily made accessible to several employees of a subcontractor based overseas. Our preliminary inquiries identified the possibility that VIQ had breached APP 11 – requiring the security of personal information. However, for the reasons outlined in this report, my office has concluded those inquiries without commencing a commissioner-initiated investigation (CII) or taking other regulatory action in response to the incident. These inquiries have informed my view that further investigation is not warranted and a further application of resources cannot be justified noting that VIQ is now in liquidation and has ceased its Australian operations.
In concluding these preliminary inquiries, I have decided to publish this report to provide the community a clear account of the inquiries undertaken and the framework and obligations against which this matter was assessed according to legal requirements under the Privacy Act 1988 (Cth) (Privacy Act).
I trust this report will provide confidence to the community about the steps that this office and the relevant courts took in response to the issue and provide greater understanding about an incident of considerable public concern.
Summary and background
VIQ is an Australian company and APP entity, and a wholly owned subsidiary of VIQ Solutions Inc, Canada (the parent company). VIQ provided digital audio and visual capture, management, and transcription services within Australia. VIQ provided recording and transcription services under a Commonwealth government contract to Australian courts and tribunals, including the Federal Court of Australia (Federal Court) and the Federal Circuit and Family Court of Australia (FCFCoA) (collectively the Federal Courts).
Media reporting between February and June 2026 alleged that VIQ subcontracted e24 Technologies (e24), a company based in Chennai, India, allowing sensitive court files to be accessed offshore.[1] This access allegedly occurred without notification to the relevant Commonwealth agencies in breach of Commonwealth contracts (the incident).
On 16 March 2026, VIQ and its Australian group of entities, were placed into voluntary administration[2] with McGrath Nicol[3] (VIQ Administrators) appointed. The wind-down of VIQ operations commenced in June, with operations ceasing in July 2026. On 5 August 2026 a special resolution was passed to wind up the company.[4]
Between May and July 2026, the OAIC made preliminary inquiries under s 42(2) of the Privacy Act with VIQ and the parent company. The purpose of these inquiries was to determine whether the OAIC should commence a CII under s 40(2) of the Privacy Act. The OAIC also made inquiries with the Federal Courts.
Whilst the OAIC does not intend to take further regulatory action, we note the significance of the issues raised by this incident, including those related to the security of information contained in court hearing transcripts, access to information by offshore contractors, and the contractual measures taken by Commonwealth agencies to secure information rights.
Accordingly, the Australian Information Commissioner has decided to publish this report to provide the Australian public with a summary of the information provided to the OAIC in response to the preliminary inquiries and considered in our assessment of the incident. This report has been published pursuant s 33B of the Privacy Act which empowers the Commissioner to disclose information acquired during the course of exercising powers under the Privacy Act if there is a public interest in doing so.
Inquiries in relation to VIQ Solutions
During the preliminary inquiries process, the OAIC found that obtaining the information necessary to understand the factual circumstances of the incident and the nature and extent of unauthorised access was a challenging and protracted process. VIQ Administrators advised that they did not hold all requested information. The OAIC also sought information from the parent company.
In response to our preliminary inquiries, VIQ and the parent company provided information including access logs and copies of its security policies, and advised as follows:
- All Australian court recording data is stored on servers in Australia.
- In addition to the information contained in the court recordings, VIQ collected the names of each party involved in a hearing, and the details of the matter as registered with the relevant court (court reference number and party names).
- Transcription services are facilitated using a cloud-based workflow platform Netscribe, where transcription work is broken down into 15-minute audio file snippets.[5] Transcribers are provided non-continuous 15-minute file snippets from various court matters to work on. Audio snippets contain a recording of proceedings in court and may include the personal information of parties and witnesses.
- Once the snippet is transcribed, the transcriber moves it from the workflow and no longer has access. Security protocols for the workflow platform do not allow the transcribers to retain a copy of the audio recording or transcription after it is completed.
- The parent company inadvertently added employees from e24, with whom it has a contractual relationship for the provision of global transcription services, to the VIQ Australian NetScribe workpools platform (the platform).
- As a result of this error, between September 2025 and 11 February 2026 when access was revoked, 5 employees of e24, located in India, had access to Australian court transcription work. During this period, 3 individual e24 employees accessed the court recordings for the purpose of providing transcription services (the other 2 employees did not access any recordings). The last day on which access to the system occurred was 6 February 2026.
- One Commonwealth government agency was affected by this incident - the Federal Courts.
Information provided by the Federal Courts
As the information available indicated that the incident affected records held by the Federal Courts, the OAIC also requested information from the Federal Courts as part of our inquiries. The Federal Courts were forthcoming in their engagement with the OAIC and provided information throughout the inquiries.
The information provided by the Federal Courts indicated that the incident was treated very seriously, however, the Federal Courts encountered delays in obtaining information to establish the nature and extent of the incident. In this instance, the Federal Courts confirmed that it had reviewed the impacted files and was satisfied, on the information available, that the information in the files was not related to suppressed matters, or matters covered by a confidentiality scheme, save that all family law proceedings are covered by section 114Q of the Family Law Act 1975 (Cth), which makes it an indictable offence to communicate an account of family law proceedings to the public if it identifies parties, witnesses, a person related to, or is associated with, a party to the proceedings, or a person who is in any other way concerned.
The Federal Courts’ inquiries concluded that the circumstances of the incident principally concerned non-compliance by VIQ with contractual terms which contained an express prohibition on transferring to, or allowing access to, any personal information, from a location outside Australia. The Federal Courts advised that as part of its inquiries into the incident, it assessed its obligations under the Notifiable Data Breach (NDB) scheme under Part IIIC of the Privacy Act. It determined that the NDB scheme did not apply, having regard to the exception at s 7(1)(a)(ii) of the Privacy Act.
Section 7(1) of the Privacy Act provides that the Privacy Act does not apply to an act or practice of a Federal Court, other than an act or practice in respect of a matter of an administrative nature. Therefore, the requirements of the Privacy Act do not include acts or practices undertaken in connection with the Federal Courts’ judicial functions, such as matters associated with court proceedings.
The acts and practices of the Federal Courts relevant to the incident related to the conduct of court hearings. Accordingly, the acts and practices are in connection with the exercise of the Court’s judicial functions, rather than an administrative function, and therefore appear to fall within the exception in s 7(1)(a)(ii) of the Privacy Act. In any event, the Federal Courts took steps to assess the incident, consistent with its published Data Breach Response Plan and considered that the likelihood of harm to individuals as a result of this incident was low.
Notwithstanding that a Federal Court is not covered by the Privacy Act in relation to this incident, VIQ, as an APP entity, has obligations under the Privacy Act and is required to comply with the APPs, specifically, APPs 8 and 11, which are discussed further below.
Assessment of VIQ’s compliance with the Privacy Act
The information obtained through our inquiries indicates that the incident did not involve the disclosure of transcripts to third party foreign actors as initial media reporting suggested, but rather involved access to Australian court information being given, in error, to a small number of e24 transcribers located in India. The incident was also smaller in scale and more confined than media reporting suggested.
Having reviewed all available information, the OAIC has concluded that employees of e24 accessed hearing snippets from 93 individual court matters, across the Federal Courts.[6] Two of the matters related to ceremonial sittings not involving the personal information of parties to a case, however it is likely that many of the snippets from other hearings included personal information. The nature of the personal information in any given snippet is dependent upon whose voice is recorded and what is said. A snippet could include, for example, the judicial officer speaking, or the evidence of a witness and the questions directed to them. The OAIC is therefore of the view that the incident involved personal information within the meaning of the Privacy Act.
Cross border disclosure of personal information (APP 8)
The incident involved personnel of e24 located in India obtaining access to Australian court transcript information (which included personal information) through the platform. The OAIC therefore considered whether the incident involved a cross-border disclosure of personal information for the purposes of APP 8.
APP 8.1 provides that, before an APP entity discloses personal information about an individual to an overseas recipient, it must take such steps as are reasonable in the circumstances to ensure that the recipient does not breach the APPs (other than APP 1) in relation to that information. Where APP 8.1 applies to a disclosure of information, s 16C of the Privacy Act may also operate to make the APP entity accountable for an act or practice of the overseas recipient that would constitute a breach of the APPs.
An APP entity discloses personal information where it makes the information accessible to a person outside the entity and releases its subsequent handling from the entity’s effective control.[7] The information presently available indicates that VIQ did not itself engage e24 and did not intend or authorise e24 personnel to access the relevant information. Rather, e24 personnel obtained access through arrangements with VIQ’s overseas parent company, when platform permissions allowed them to access information.
The circumstances of the access support the view that the incident is more appropriately characterised as unauthorised access to information held within VIQ’s systems rather than a disclosure of information by VIQ to e24. In particular, the e24 personnel access was confined to performing transcription work through the platform; the information remained on VIQ’s servers in Australia and could not be downloaded from the platform; and access ceased when the transcription work was completed. These matters indicate that VIQ had not released the subsequent handling of the information to e24 from its effective control.
The OAIC also considered the position of VIQ’s parent company in Canada. To the extent that VIQ’s arrangements with its parent involved the disclosure of personal information by VIQ to the parent company, the OAIC considers that the disclosure may be permitted under s 13B(1)(b) of the Privacy Act, which provides that a disclosure of personal information, other than sensitive information, by an entity to a related body corporate, is not an interference with the privacy of an individual.
In addition, the exception in APP 8.2(a) may apply to the disclosure to the parent company. APP 8.2(a) provides that APP 8.1 does not apply where the APP entity reasonably believes that the recipient is subject to a law or binding scheme that protects the information in a way that, overall, is at least substantially similar to the APPs and that individuals have access to mechanisms to enforce that protection. The parent company carried on business in Canada and was subject to applicable Canadian privacy law. Having regard to the protections and enforcement mechanisms available under that regime, the OAIC considers it was reasonably open to VIQ to hold the belief required by APP 8.2(a). Accordingly, APP 8.1 would not apply to a disclosure by VIQ to its parent company.
Further, s 16C of the Privacy Act (which can make an APP entity accountable for the conduct of the overseas recipient) applies only where APP 8.1 applies to the original overseas disclosure. Accordingly, where APP 8.2(a) operates so that APP 8.1 does not apply to a disclosure to the Canadian parent company, s 16C does not operate to attribute subsequent acts or practices of the parent company to VIQ.[8]
On the information available, the OAIC therefore considers that the incident is unlikely to establish a contravention of APP 8 by VIQ. The access by e24 personnel is more appropriately considered as an issue of unauthorised access and the adequacy of the security controls protecting the information which is considered below under APP 11.
Security of personal information (APP 11)
APP 11.1 requires an APP entity to take such steps as are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Reasonable steps include technical and organisational measures. Technical measures include protecting personal information by implementing technological controls and physical measures relating to software and hardware. Organisational measures involve implementing policies, processes and procedures to protect the security of information.
The fact that a breach occurred does not, on its own, mean that an organisation failed to take steps as are reasonable in the circumstances. Assessing the reasonableness of any steps may involve consideration of security measures in place, access permissions, and contractual and organisational controls.
In response to the OAIC’s inquiries, the parent company provided the OAIC with an overview of the measures VIQ had in place at the time of the incident to prevent unauthorised access to personal information relating to Australian individuals. This included an information security governance framework and risk management framework, which contained security provisions and access authorisation for its platform, and procedural documents. Whilst the OAIC did not verify the extent to which these policies and procedures were implemented and followed in practice, the extant systems confirm that measures were in place to protect personal information from unauthorised access.
The OAIC’s assessment is that the root cause of the incident was an access-control error, rather than an ongoing practice. A one-off error does not necessarily amount to, but may point towards, a failure to take the reasonable steps required APP 11. The OAIC observes that while VIQ did not authorise the access, the fact that employees of e24, a company with no relationship with VIQ, were able to access the platform raises a question about the adequacy of the controls governing access. On the information presently available, there is a reasonable basis for concern that the incident may have involved a breach of APP 11 notwithstanding the system implemented to secure the information.
Conclusion of preliminary inquiries
Despite the possibility of establishing a contravention of the APPs, the OAIC has decided to take no further regulatory action regarding the incident at this time. For the reasons set out above, it is possible that a breach of APP 11 by VIQ could be substantiated, though it does not appear that there is a breach of APP 8. As the incident is materially smaller than media reporting suggested, and in light of the Federal Court’s steps to assess and respond to the incident, and the fact that VIQ is no longer operating, the OAIC is of the view that the harms resulting from the overseas access to Australian court data can be adequately addressed and further regulatory action against VIQ would not be an appropriate use of the OAIC’s resources.
The OAIC has not conducted a CII and this report does not make concluded findings. This report does not prevent the Commissioner from commencing an investigation of VIQ with respect to these or other practices or taking other action in the future, and this report should not be taken as an assurance of VIQ’s broader compliance with the APPs. Information obtained through preliminary inquiries may be relevant to any privacy complaints made to the OAIC. However, any future decisions in relation to individual complaints will be made on a case-by-case basis in accordance with the relevant provisions of the Privacy Act.
Commonwealth contracts
In addition to the privacy implications of the incident, media reporting made reference to contractual obligations between VIQ and the Federal Courts, and other Commonwealth agencies that contracted with VIQ. In light of the circumstances of this matter, the OAIC considered how the Commonwealth contracting framework may support information rights in connection with the incident.
The Commonwealth contracting and procurement framework consists of the legislation, core rules and standardised tools that govern how Australian Government entities use public resources to buy goods and services. This framework importantly contributes to promoting accountability and transparency, as well securing information rights protections as required by s 95B of the Privacy Act and s 6C of the Freedom of Information Act 1982 (Cth) (FOI Act). As shown in the present case, data breaches and unauthorised access can still occur in circumstances where contracting and procurement procedures are followed and contracts include the required information rights protections.
Commonwealth procurement rules
The Commonwealth Procurement Rules 2025 set out requirements on certain government agencies when undertaking duties relate to procurement.[9] All agencies bound by the procurement rules must comply with the rules listed in Division 1, which includes rules regarding value for money; encouraging competition; efficient, effective, economical and ethical procurement; accountability and transparency; and procurement risk. Rule 6.12 requires non-corporate Commonwealth entities to use the Commonwealth Contracting Suite for contracts valued under $200,000.
One of the mandatory components of the Commonwealth Contracting Suite is the Commonwealth Contract Terms. The Commonwealth Contract Terms provide as follows:
- Suppliers must comply with, and ensure its employees comply with, all applicable laws (clause 21.1).
- Suppliers, and any subcontractors, must allow the agency access to records and documents relating to the contract, for the purposes of any request for information made to the agency under the FOI Act (clause 21.A.2).
- Suppliers, and any subcontractors, must comply with the Privacy Act and not do anything which would breach the Privacy Act if it were done by the agency (clause 21.B.1). Whilst there is no explicit prohibition on offshoring data, this clause requires suppliers to consider obligations under APP 8 prior to the cross-border disclosure of personal information.
- Suppliers must take certain mitigation actions when there has been an eligible data breach regarding personal information held by the supplier as a result of the contract (clause 21.C.1-2).
- Suppliers must ensure all information provided by the agency is protected from unauthorised access, use, misuse, damage and destruction (clause 21.F.3)
Privacy and FOI contractual requirements
In addition to the requirements of the procurement rules, Commonwealth agencies[10] are subject to obligations contained in the Privacy Actand theFOI Act regarding contracted service providers, regardless of the value of the contract:
- Privacy Act s 95B requires agencies to take contractual measures to ensure that a contracted service provider does not breach the APPs by doing an act that would breach the APPs if it were done by the agency.
- FOI Act s 6C requires an agency to take contractual measures to ensure that the agency receives a document from a contracted service provider if the agency receives a request for access to the document.
Agencies contracting with VIQ
AusTender is the Australian Government's procurement information system and the primary public record of Commonwealth contractual arrangements. Publicly available AusTender records show that between 1 February 2019 and 8 April 2026, VIQ entered into 39 contracts across 13 government agencies.[11] All but 3 contracts have ended. There have been 9 contracts entered between VIQ and the Federal Court. The majority of the contracts (8) were valued under $350,000, and one contract, for the period 1 July 2020 to 30 June 2026, was valued at $15.9 million.[12]
Federal Court contract with VIQ
The Federal Court’s ongoing contract with VIQ for the provision of transcription services to the FCFCoA was released by the Federal Court in September 2025 following an application made under the FOI Act and is available on the Federal Court’s disclosure log.[13]
The contract includes the following clauses in relation to information security:
- A prohibition on VIQ disclosing any confidential information to a third party, without the Federal Court’s permission (clause 51.1), or transferring to, or allowing access to any personal information from, a location outside Australia, without the Federal Court’s permission (clause 52.1.7).
- Acknowledgement by VIQ that it is a contracted service provider within the meaning of the Privacy Act and must comply with that Act and not perform any act that would constitute a breach of the Privacy Act if it were done by the Federal Court (clause 52.1).
- A requirement of VIQ to ensure that the Federal Court’s data is protected at all times from unauthorised access, and that VIQ’s systems are configured so that only those personnel authorised to access confidential information can access it (clause 54) and to notify the Federal Court if it becomes aware of a notifiable data breach (clause 53).
- A requirement of VIQ to comply with all applicable laws and Commonwealth policies, including those set out in schedule 8 of the contract (clause 65.1).
- A requirement of VIQ to provide documents to the Federal Court when a request has been made for access under the FOI Act (Sch 8, clause 7).
Conclusion
Our review of mandatory contract terms, together with the Federal Court’s contract with VIQ indicates that the contractual arrangements adequately secure information rights and contain the requirements specified by s 95B of the Privacy Act and s 6C of the FOI Act. The contractual framework appears to provide appropriate mechanisms to support Commonwealth agencies in preserving their ability to obtain and manage information necessary to meet statutory obligations and did not adversely affect the exercise of information rights in connection with the incident. Importantly, the operation of the relevant contractual clauses also facilitated the OAIC’s inquiries.
Publication of report
Having regard to the matters listed in s 33B(2) of the Privacy Act, I am of the view that publishing this report would be in the public interest. I consider that there is a public interest in providing information to the community about an incident of significant community concern.
This report reflects the outcomes of preliminary inquiries undertaken to determine whether I should commence a CII. Accordingly, any individual complaints or future CII would be considered on the basis of information relevant to those processes. In my view, publication of this report reflecting the outcome of preliminary inquiries would not prejudice the rights of individuals or the processes available under the Privacy Act.
I have also considered whether the publication of this report would likely disclose any confidential information, as it includes information about VIQ’s operations. I do not consider that disclosure of this information is likely to prejudice VIQ or the parent company, particularly in light of VIQ ceasing operations in Australia, and it is my view that any prejudice is outweighed by the public interest in clarifying for the community how the incident occurred.
I am satisfied, on balance, that it is in the public interest to disclose this report publicly.
Footnotes
[1] VIQ Solutions Australia placed into voluntary administration, court transcriptions services in limbo - ABC News; National security concerns over use of transcription company VIQ Solutions by 13 government agencies - ABC News
[3] VIQ Australia Group | Creditors | McGrathNicol.
[5] On 3 November 2026, the FCFCoA advised the OAIC that an independent review it had commissioned indicated the audio snippets accessed were in 5 minute increments, rather than 15 as indicated by VIQ. This new information has no material impact on the conclusions of this report.
[6] The information obtained by the Federal Courts from VIQ and provided to the OAIC, indicated that matters were also accessed by e24 transcribers based in New Zealand. However, the focus of this report is the e24 transcribers based in India, noting significant public concern in this regard.
[7] APP Guidelines [8.8].
[8] The parent company confirmed that its contract with e24 required e24 to comply with Canadian privacy laws.
[9] The Procurement Rules apply to non-corporate Commonwealth entities and prescribed Commonwealth entities listed in section 30 of the Procurement Rules (r 2.1). For information about the different types of Commonwealth entities, see PGPA Act Flipchart and List | Department of Finance. The Federal Court is a non-corporate Commonwealth entity.
[10] Not all Commonwealth agencies are covered by the Privacy Act and the Freedom of Information Act.
[11] Contracts are either with VIQ Solutions Pty Ltd or VIQ Solutions Australia Pty Ltd. The OAIC received VIQ services for a finite period from 1 July 2023 to 30 June 2024, valued at $200,000 through a contract entered into by the Australian Security and Investment Commission. Those services are not relevant to these inquiries.
[12] The Federal Court is the contracting entity for the FCFCoA.
[13] The contract was originally entered into between the Federal Court and Auscript Australia Pty Ltd, which was acquired by VIQ in 2021. The original contract term was 4 years ending 30 June 2024 and was extended for a further 2 years.
