Need to know
- The Victorian Energy and Water Ombudsman has seen a sharp rise in the number of privacy complaints about energy retailers
- Many of these complaints relate to perpetrators of family violence gaining access to "private information without consent"
- Advocates say all essential services and telecommunications companies need to do more to protect client data from being misused
This article mentions family violence. If you or anyone you know needs support, contact 1800Respect on 1800 737 732 or visit www.1800respect.com.au
Perpetrators of domestic and family violence are gaining access to information about their former partners from essential services providers due to lax data security measures.
According to the Victorian Energy and Water Ombudsman, privacy complaints rose by 27% in the last financial year, with 98 complaints reported.
Seven out of 10 of those complaints related to electricity retailers and they were mainly about "private information obtained without consent".
Most breaches relate to family violence perpetrators
Ombudsman Catherine Wolthuizen says most of the breach complaints relate to domestic and family violence perpetrators, noting that it's part of a wider trend.
"It is something we're keeping a very close eye on and have been working quite closely with the regulator in Victoria to really raise awareness within the industry of those concerning trends," she says.
"We are starting to talk about what the appropriate actions we would expect providers to take to ensure that their customers' information remains safe and indeed in relation to family violence that that customers remain safe," Wolthuizen says.
The rise in complaints comes despite the Australian Energy Market Commission publishing new rules in 2022 aimed at protecting the identity and location of people leaving violent relationships, and stopping retailers giving out confidential information without consent.
Problems arise when 'delinking' joint accounts
Catherine Fitzpatrick, founder of Flequity, a consultancy that helps financial services make their products safer, says many essential services systems are set up to immediately notify all account emails when an account is delinked or an address changed, which at times can pose a safety risk for those fleeing violence.
At other times, perpetrators call up essential service providers, and use the information they have about the survivor to get their new address.
"In some cases people have had to be relocated once it's realised a perpetrator now knows what was supposed to be a safe address, people are being put in incredible danger of serious harm or death," she says.
Perpetrators call up essential service providers, and use the information they have about the survivor to get their new address
Privacy concerns not the only issue
Alexandra Kersey, a lawyer with the Melbourne community legal service WEstjustice, says there are other common issues that arise when a victim/survivor leaves the relationship and tries to 'delink' a joint account.
"We have seen victim/survivors who have left the home trying to pay their new property's utility bills and the old property's bills because they are fearful [of closing] accounts and don't want disconnection as this could escalate violence," she says.
"It can be really complex and I would say across the board, no matter what electricity or gas company you talk to, they don't seem to have a process for dealing with this and usually require the perpetrator's consent which can not only be difficult, but unsafe to get.
"Many victim survivors simply can't resolve their matters and end up unfairly accruing debts in their name because of this," she adds.
Kersey says these issues are seen across the board in essential services and telecommunications.
Family violence perpetrators are gaining access to private details like the home address of their former partner.
Better training needed
Kate Fitz-Gibbon, chair of Respect Victoria says companies dealing with sensitive data have a duty to ensure they have the right policies and procedures in place to protect people.
"Family violence is prevalent right across our community. All essential service providers have a responsibility to embed the right training, policies and procedures into their services to ensure victim/survivors' data is protected, particularly from perpetrators," she says.
"In recent years many of the banks have brought in tighter controls and more proactive responses to ensure client safety and to hold perpetrators of abuse to account.
"It is important that utility companies also play a role by having the right supports and controls in place," she adds.
CHOICE says providers must do more to protect customers
CHOICE consumer data senior campaigns and policy advisor Rafi Alam says customers expect essential services to keep their data secure and they should face harsh penalties when they don't.
"For vulnerable customers experiencing family violence, enormous trust is placed in businesses to respect their privacy and safety, and it's disappointing to see this trust has sometimes been broken."
"In a highly digital economy, training staff and management on privacy obligations should be as vital as health and safety protocols," he says.
Customers experiencing family violence, enormous trust is placed in businesses to respect their privacy and safety
CHOICE consumer data senior campaigns and policy advisor Rafi Alam
Meanwhile, Fitzpatrick says the extent of the problem isn't even known and calls for more information to be gathered.
"What I would like to see is the privacy commissioner do a review of all breaches that relate to family and domestic violence. They should publish what is going on in each sector, what they know about the main risks, and what business should do in response," she says.
Stock images: Getty, unless otherwise stated.
