Services Australia pays ‘digital doppelganger’ $10k for data mix-up
A “digital doppelganger” whose government records were repeatedly mixed up had his privacy breached by Services Australia, Australia’s privacy commissioner has found.
Services Australia has been ordered to pay $10,000 to an Australian man, dubbed “ATQ”, apologise and review how its policies led the agency to commit “serious and repeated interferences with privacy” over a six-year period.
The breaches relate to ATQ’s records being repeatedly mixed up — or “intertwined” — with other individuals with the same name and birth date. In 2011, the federal government estimated there were hundreds of Australian “digital doppelgangers”.
Australian privacy commissioner Carly Kind found that Services Australia broke a number of Australia’s privacy principles, including by intertwining ATQ’s sensitive information with others, disclosing his personal information without authorisation, and failing to ensure information was up-to-date.
After filing a complaint in 2019 about two instances where his Medicare records had been updated with someone else’s address — which was resolved with an assurance it wouldn’t happen again — ATQ filed another complaint in 2022 about two further incidents.
ATQ had been wrongly told his family was about to reach the Medicare safety net threshold because another person’s Medicare records had been incorrectly attributed to his account. Then, ATQ found that his COVID-19 and influenza vaccine records had been assigned to another individual’s Medicare record.
ATQ submitted he had been able to access “sensitive information of another customer of the respondent, including their name, date of birth, addresses, mobile phone number, credit history and place of employment”, and suggested that the other individual would be able to access his.
ATQ sought close to $300,000, comprising $200,000 for grief and distress, $50,629 for “non-economic loss, associated with his time dealing with this matter”, and $16,879 for the costs associated with changing his name.
While ATQ did not provide any evidence of psychological injury or administrative costs for a name change, Kind awarded $10,000 for the distress.
“The inadequacy of the steps taken by the respondent to protect the complainant’s personal information from further unauthorised access and disclosure has caused the complainant to experience continuing feelings of stress,” Kind wrote. She also noted that ATQ was in a vulnerable position because he has no alternative to dealing with Services Australia.
Kind wrote on LinkedIn that the novelty of “digital doppelgangers” shouldn’t obscure the potential for harm: “Although only a small subset of Australians may be affected, the potential harm is significant, and was at the forefront of my mind in making this determination,” she said.
Have something to say about this article? Write to us at letters@crikey.com.au. Please include your full name to be considered for publication in Crikey’s Your Say. We reserve the right to edit for length and clarity.
