Documents containing personal information found dumped in Northern Territory scrubland highlights
October 17, 2024 |
In the digital age the common belief is that data breaches involve a cyber attack, disclosure of information on a web site or by an errant email. As the ABC reports in Documents containing personal information of NT residents found dumped in bushland in Darwin rural area data breaches can, and often does, occur through documents being left in public. There have been many instances of records being left in filing cabinets that are then offered for sale, medical records being stored and forgotten or documents being left in public.
In the most recent example the documents left in the bush contained personal information including medical and bank records and phone numbers. This may constitute a breach of the Privacy Act 1988 by the entity that collected then didn’t dispose of the documents properly. In this case it involved records created by the Northern Territory Government.
Document management, either in hard or soft copy form, is critically important and quite straightforward if there is decent training and a workable system. Businesses often do not regularly review what documents they have and ask themselves why they still have personal information that they don’t need. Medical practices are notorious for holding records of long since deceased patients or individuals who have moved to other doctors or left the city or state.
The story provides:
In short:
A large number of documents containing personal information, including medical information, bank records and phone numbers, have been found in a pile of rubbish dumped in Darwin’s rural area.
A Darwin woman whose personal records were found in the pile is searching for answers on how they came to be there.
What’s next?
The Office of the Australian Information Commissioner is planning to investigate the data dump.
Teenager Kayley Cox was driving her buggy on the outskirts of Darwin on Boxing Day last year when she discovered a massive pile of rubbish beside a dirt track.
While it wasn’t unusual for Kayley to find rubbish dumped near her family’s Howard Springs block, this unusually large pile, found in vacant bushland, contained a collection of personal records.
It included documents from various Northern Territory government agencies, as well as employment records belonging to a woman named Toni Grant.
Following Kayley’s discovery, her mother Wendy Cox said she reached out to Ms Grant on Facebook.
“I sent her a private message saying ‘I think you need to see this’,” she said.
“She got in contact with me, and we took her to the site where we found all this rubbish.”
At the site, Ms Grant collected a stack of personal documents she had supplied to pet retailer Petbarn while working for one of the company’s Darwin stores between 2011 and 2017.
They contained her phone number, email address, home address, tax file number, bank details and medical information.
Ms Grant also found similar documents belonging to five of her former colleagues.
She was horrified by the discovery.
“It was disbelief, betrayal, because when you give this personal information, you expect it to be kept private and confidential,” Ms Grant said.
Ms Grant gathered what she could and notified her affected former colleagues, Petbarn, the NT Police Force and the City of Darwin council.
After police and the council were notified, the dump site was cleaned up.
With the help of a former co-worker, Ms Grant was subsequently able to trace the documents back to an office clean-out at Petbarn’s Coconut Grove store in 2021.
“So there’s a two-year discrepancy between when we’re 99 per cent sure [the documents] were thrown out, to when it’s been dumped,” she said.
“Where has it been for two years, who’s had access to it and what’ve they been doing with it?”
In a statement, a Petbarn spokesperson said the company had conducted a “thorough internal review” into the disposal of their employee records.
However, the company did not respond to questions about the findings of that review.
“[We] found no evidence to suggest that the employees’ information ended up in [the] location due to any action or inaction on Petbarn’s part,” the spokesperson said.
Risk of identity theft
The documents belonging to former Petbarn workers were not the only records dumped at the site.
Various personal records from NT Correctional Services, the Darwin Local Court, the Department of Housing, emergency services and a collection of income management and Medicare cards were also amongst the rubbish.
Ms Grant said she had been in contact with around eight separate government agencies since discovering the dump site, but was no closer to finding out how her records had come to be there.
“To this day I don’t know who picked it up, so [I] still don’t know who’s got all that information or what happened to it,” she said.
Ms Grant said fear of identity theft had led to her changing all her contact details, passwords and tax information.
“[The Australian Tax Office] put a block on my account, which means when I go to do a tax return or anything like that I’ve got to go through different security steps now, so it’s harder for anyone to get into,” she said.
David Lacey, the managing director of identity theft victim support service ID Care, said Ms Grant’s case was unusual, but no less dangerous than an online data breach.
“It’s a timely reminder that it doesn’t have to be online to be an exposure or a risk to people, so if there’s information that people are coming across in the bush, it’s still the same information that might be exploitable,” he said.
“The steps that Toni has taken, although some might say that’s a lot of steps that [she’s] taken, if that gives her a better sense of comfort around her own security, then that’s not a bad thing.”
Information valuable to criminals
According to the Australian Information Commissioner, insecure disposal of documents represented one per cent of data breaches caused by human error in the past year.
Personal information mistakenly sent by email was the most common at 38 per cent, with the unintended release or publication of information the second-most common at 37 per cent.
Mr Lacey said the information found in the bush in Howard Springs was exactly the kind of information most sought after by criminals.
“Even something as simple as a name, an address, a phone number, is exploitable,” he said.
Child protection documents dumped at Darwin tip
Confidential documents including child protection information is dumped at a Darwin tip after the Northern Territory Families department throws out old filing cabinets.
Ms Grant said the Australian Information Commissioner had recently contacted her to say her case was awaiting assignment to an investigator.
She said she wanted her experience to be instructive to others.
“When you come across personal confidential information of someone else’s, treat it with respect, treat it the way you’d want your stuff to be treated,” she said.
“And that’s not thrown in the rubbish for random members of the public to find.”