Centrelink
Summary
In 2006, Centrelink sanctioned 585 employees for unauthorised access to customer records, representing one of Australia's largest documented insider threat incidents. Staff browsed confidential files of friends, family, neighbours, and former partners, with some employees changing client details without authorisation. The investigation resulted in 19 dismissals and 92 resignations.
What Happened
Centrelink employees exploited their access to the agency's customer database to view personal information without legitimate business purposes. Staff members searched for and accessed records of individuals they knew personally, including friends, family members, neighbours, and ex-lovers. In some cases, employees went beyond unauthorised viewing and modified client details without proper authorisation.
The Privacy Commissioner investigated following complaints and discovered 790 cases of unauthorised access to customer records. The investigation revealed systemic abuse of privileged access, with employees violating the Privacy Act and breaching the trust placed in them as government employees handling sensitive personal information.
Impact on Individuals
The 790 individuals whose records were accessed without authorisation had their privacy violated by government employees entrusted with protecting their information. Affected individuals' personal details—including addresses, financial information, and government identifiers—were viewed by people who knew them personally, creating potential for misuse, stalking, harassment, or identity theft.
The breach particularly affected vulnerable individuals relying on Centrelink services, as the unauthorised access could have exposed details about their financial situation, family circumstances, or personal challenges. Some individuals may have had their records altered without their knowledge, potentially affecting their access to government services.
Organisational Response
Centrelink took disciplinary action against all 585 employees identified in the investigation. The agency dismissed 19 staff members and accepted the resignations of 92 employees. The remaining sanctioned employees received other disciplinary measures appropriate to their conduct.
Five employees faced police investigation for their actions, indicating the most serious cases involved potential criminal conduct. The organisation referred these cases to law enforcement authorities for potential prosecution.
The Privacy Commissioner's investigation provided recommendations to strengthen access controls and monitoring systems to prevent similar insider threats in future, though specific technical measures implemented were not publicly disclosed at the time.