Services Australia has been ordered to apologise and pay compensation to a domestic violence victim after it disclosed her new address to her former partner.
Subscribe now for unlimited access.
$0/
(min cost $0)
or signup to continue reading
The agency breached the Privacy Act when it failed to separate the woman's records from her former partner's then updated his online account with her new address, Australian Information Commissioner and Privacy Commissioner Angelene Falk has ruled.
The woman was alerted to the privacy breach when her ex-partner posted a picture of her new house from Google Maps to Facebook, with the comment "Change your MyGov", in 2017.
She had moved hundreds of kilometres to escape the decade-long abusive relationship, and avoided telling anyone where she was going to ensure her safety.
"My heart just sank. I felt sick," the woman said. "I did everything right when I had the strength to leave him and he found me through no fault of my own."
Within months, her ex had relocated interstate to live near her.
"Services Australia acknowledges its processes failed to protect the privacy of this customer. We apologise deeply and unreservedly to the complainant for the stress and pain caused," Services Australia General Manager Hank Jongen said in a statement.
The woman notified Centrelink in June 2016 that she had separated from her partner. But the agency considered the separation was not verified because she had not included full address details for two referees.
She had earlier provided Centrelink with a copy of an apprehended violence order issued against the man. The partner was imprisoned for violating the order after he punched her in the face while driving.
Centrelink did not register the separation until January 2017.
By that point she had updated her address. Unbeknownst to her, the accounts were still connected and the man's address was updated to her new one.
"I consider that more rigorous steps were required to ensure that individuals fearing domestic violence do not have their updated addresses disclosed to their former partner," Commissioner Falk wrote.
She found that Services Australia committed four breaches of the Privacy Act.
Services Australia has been ordered to hire an independent auditor to look at its practices around unauthorised disclosure of private information.
The agency must also issue a written apology to the woman and pay her legal costs as well as $10,000 for her pain and suffering, the commissioner ruled.
Mr Jongen said Services Australia "fully" accepts all the commissioner's declarations and would implement them as soon as possible.
The woman has been diagnosed with PTSD. Her symptoms eased when she moved away from her ex-partner, and then flared up when she learned he knew where she lived.
She is now uncomfortable in public places, won't leave her house overnight, and sleeps with a metal pole next to her bed.
The privacy complaints process has run for over three years.
"The process has been drawn out and difficult," she said. "At every turn with the department and their lawyers...I've been disbelieved and doubted."
But she wanted to persevere with the case so Services Australia would change it processes and to help other women.
Mr Jongen said Services Australia was "acutely aware" of the heightened risks of separation for customers when family and domestic violence is a factor.
The agency has proactively improved its processes to help those impacted by family violence, he said.
"We have changed our process to require that we de-link a customer's Centrelink record from their partner's as soon as they tell us they've separated, without the need for paperwork," he said.
Australian Associated Press
