Decision should be supported by policies
As part of a regional support program, Mark’s business was audited by the Department of Employment, Small Business and Training (the department). Mark was dissatisfied with the auditor’s conduct during the audit, the lack of communication from the department’s auditors, and audit findings that required his business to undertake compliance review actions.
Mark discovered through access logs that the auditor had accessed data of clients who had not received government funding to participate in the program. Accessing this information was outside the scope of the audit. The audit report made no mention of accessing files of these non-funded clients. Mark was worried about the lack of proper process during the audit.
Mark’s business was contractually required to only produce evidence for the client names requested by the department. Instead, full access to the management system was granted without securing client records not required for the audit.
The department’s initial response to Mark’s complaint did not support his concerns about the audit process and stated that the auditor was unable to access any records due to a system fault. Mark was dissatisfied with this response and requested a further review.
The department’s second review agreed with the findings of the initial review and upheld that the department’s actions were consistent with its policies. While acknowledging Mark’s privacy concerns, the review identified that due to its inability to access the client records requested, it acted in ‘good faith’ to test the system platform in order to carry out its audit activities. The department advised it would remain vigilant in protecting private and personal information.
Mark thought the department’s decision was unfair and was not happy that it was not taking any action to rectify the privacy breach.
The result
This Office investigated whether the department’s management of the complaint was reasonable in the circumstances.
The non-compliance issues found were likely to result from Mark’s business not submitting the required evidence for the audit on time rather than shortcomings in the department’s communication. On this basis, this Office considered the department responded reasonably to Mark’s complaint.
However, this Office questioned the department’s responses to the alleged data breach and whether it reflected the expectations for procedural and privacy concerns as outline in its Information Privacy Policy. This Office also had concerns that the internal review responses did not adequately address the concerns of unauthorised access to client records and the subsequent rationale for these actions.
At this Office’s request, the department agreed to undertake an internal privacy assessment and agreed to communicate the results to Mark.
