28 November 2021

Union troubled by ACT Government data breach that left details of 30,000 workers' compensation claims online

| Lottie Twyford
Join the conversation
Maddy Northam

UnionsACT president Maddy Northam says an ACT Government data breach of workers’ compensation claims is concerning. Photo: Dominic Giannini.

The news that potentially sensitive health data of up to 30,000 ACT public servants has been online for more than three years has been labelled “deeply troubling” by the Community and Public Sector Union (CPSU).

CPSU ACT regional secretary and UnionsACT president, Maddy Northam, said she is astonished and concerned that private data was publicly available for so long before the government was made aware of it.

A spreadsheet that contained the details of thousands of workers’ compensation claims dating back to the beginning of self-government in July 1989 was uploaded to the ACT Government’s tender website in 2018 before it was deleted earlier this week.

It is understood the information disclosed includes claimants’ birth year, gender, occupation, types and dates of injuries, and the directorate where a person worked.

The exact birth dates and names of claimants had been removed in an effort to deidentify the data, ACT Special Minister of State Chris Steel told the Assembly on Thursday, 25 November.

However, it is Ms Northam’s belief that “the data that has been available is of a highly personal nature, and it has been troubling for our members who have had a claim”.

She noted union members were blindsided by the breach, having not been notified before the report appeared in the media earlier this week.

READ ALSO How steepling rents and house prices are crunching the ACT’s low to middle income earners

Ms Northam said a significant number of union members had already made contact with her to express concerns about their sensitive data.

She is concerned the matter could be triggering for people who’d previously been involved in workers’ compensation claims as they are often stressful.

“A lot of people had put it behind them, and now this has come up,” said Ms Northam.

She has been seeking to remind people who are affected that they can access the ACT Government’s Employee Assistance Program (EAP) if support is needed.

The CPSU was briefed by the ACT Government on Thursday, 25 November, at a meeting Ms Northam said was productive.

During the course of the meeting, some of her and the union’s members’ concerns were alleviated.

For example, initial reporting of the breach had said an individual’s position title was included in the spreadsheet, but Ms Northam said upon further analysis, this was not the case.

“A position title would have been much more identifiable,” she said.

READ ALSO Gallagher puts APS labour-hire approach on notice

The CPSU was also able to secure a commitment from the ACT Government that the data will be vigorously tested against other publicly available information to check whether or not people can be identified.

During Thursday’s Question Time, which was dominated by the potential data breach, Mr Steel announced an internal review would be conducted into the matter

He said affected individuals have not yet been contacted. However, it is Ms Northam’s understanding that people whose data was included in the spreadsheet will now receive some correspondence from the government.

Mr Steel told the Assembly the government is not yet aware of a particular breach of private information, but an internal review will now be conducted.

He would not give a time frame for the review and the government also would not commit to releasing its findings in advance.

Chris Steel

ACT Special Minister for State Chris Steel said the ACT Government does not believe there was a data breach, but will conduct an internal review. Photo: Michelle Kroll.

Mr Steel said future government policy will be informed by the review.

“We look forward to that review being undertaken and any recommendations that may come out of that review about whether there has been a breach of privacy in this particular case, and whether there are any further measures we can put in place to protect the privacy of individuals in procurements going forward,” he said.

The ACT Opposition has called for an independent investigation into the matter.

At this point, unless a breach is determined, the government will not refer the matter to the Office of the Australian Information Commissioner.

Mr Steel said the “heavily redacted” spreadsheet was uploaded to the tender website to provide potential tenderers with information about the costs associated with managing workers’ compensation claims in the Territory.

He said it was part of an ACT Government push towards being a self-insurer as it moves away from Comcare as an assessor of workers’ compensation claims of ACT public servants.

Join the conversation

All Comments
  • All Comments
  • Website Comments

I was staggered to think there could be 30,000 public service compensation claims.

Its 30 years of data however – so number is probably high % wise but not outrageous.

Capital Retro8:05 am 29 Nov 21

I find it “deeply troubling” that there up to 30,000 ACT public servants.

I wonder where they all work because these numbers are not reflected in the levels of “service” one receives when dealing with the government that employs them.

Maybe you could try reading the article:

“A spreadsheet that contained the details of thousands of workers’ compensation claims dating back to the beginning of self-government in July 1989”

I.e. its 30+ years of data, not claims from 1 year….

Capital Retro3:20 pm 30 Nov 21

I did and it said “The news that potentially sensitive health data of up to 30,000 ACT public servants has been online for more than three years …………….”

In fact, if it is considered the way you are inferring there could be more than 30,000.

You are always looking for the fifth leg on the cat JS9.

You are the one trying to fallaciously suggest there are currently 30,000 publicly employed in the ACT Public service.’

The head count data is easily available – but we all know your aversion to google (https://www.cmtedd.act.gov.au/__data/assets/pdf_file/0006/1677696/State-of-the-Service-Report-web.pdf I.e. p 8).

Lol I have no idea on earth what inference you are drawing to suggest somehow there is more than 30,000 people.

The records contain 30,000 individual workers compensations, which cover the period since 1989. Do you think that only 30,000 individual people have served in the ACT public service since 1989?

Daily Digest

Want the best Canberra news delivered daily? Every day we package the most popular Riotact stories and send them straight to your inbox. Sign-up now for trusted local news that will never be behind a paywall.

By submitting your email address you are agreeing to Region Group's terms and conditions and privacy policy.