How to deal with a privacy breach

‘Consultation’ Merlino-style
May 26, 2017
Email to DET
June 6, 2017
Show all

How to deal with a privacy breach

By Sue Wight

Are you a public servant with an embarrassing privacy breach to clean up?

Consider yourself a knight in shining public service armour and read on!

Our guide covers the essential steps involved in saving face and carrying on regardless!

Step 1: Take down the webpage, hold an emergency meeting and move into damage control. Try to pacify the people involved and cross your fingers they don’t take it any further. Claim the breach is small and hope they don’t realise the full extent of it. This is worth a try but if you have a pesky action group and nosey journalist on the job, you best move on swiftly to Step 2. Courage noble knight!

Step 2: Acknowledge the breach occurred, apologise and announce an independent inquiry. This looks decisive. It also gives the Minister something to say to journalists. It involves some bad coverage, but contrition today means the media will move on tomorrow. Don’t worry too much about the inquiry results. The report won’t be great but we can release it where no one will notice, on a day no one is looking, after waiting long enough to ensure it is old news. The essential thing is that the Minister has something to say IMMEDIATELY!

Step 3: Claim it is resolved.  Even if you are still struggling to clean up the Google cache, who is going to know (other than those aforesaid pesky ones)? Onward noble knight!

Step 4: Organise some trained apologists to phone people whose privacy was breached. Have them apologise long and hard. This is time-consuming, but is guaranteed to limit the number of official complaints – so do it well.

Step 5: Wait for the news spotlight to move on. As a valiant knight of the public service, delay is your weapon of choice on every occasion. Use it well.

Step 6: Get someone efficient to handle republication and work out a consistent system. The Minister does not want to have to apologise again!

Step 7: Read the submissions. Whoa… there’s damning stuff in here! Maybe we should have actually read these before publication? Thank goodness, the privacy breach meant they were taken down – the press would have had a field day with this stuff!

Step 8: Insist on explicit consent to republish submissions and set a short RSVP. This simple step will almost halve the number of published submissions and, with any luck, the authors of the most damaging ones won’t consent in time. Even with an interfering action group, you should be able to cut down the number of published submissions from say 535 to 389. Press on, good knight!

Step 9: Decree that submissions will be republished anonymously. This will severely limit the chance of further unwanted media attention by making it hard for journalists to find interviewees. As extra insurance, identify and list all submissions by number only. This way, a journalist would have to open dozens of submissions to find one with contact details. With any luck, they’ll move on to an easier story. Make sure to spin this as extra caution following the privacy breach.

Step 10: Redact the damaging stuff. Supply submission-makers a copy of the redacted version but don’t draw attention to the redaction, with any luck they won’t notice. Take care that your wording obscures what you are up to while technically gaining their consent to publish the redacted version.

Step 11: Restrict their options. Give them the option to reply ‘Yes’ or ‘No’ and make it the most prominent part of the email. Follow with several verbose paragraphs. This will encourage people short on time to feel ‘no’ is the safer option and, most of those who respond ‘Yes’ will miss the option to add their name and won’t notice that we’ve deleted parts of their submission.

Step 12: Cover the fact that you are trying to limit exposure by implying you are the knight in shining armour who will rescue submission-makers from their own naivety. Naturally you’ll need to ignore the inconvenient fact that your department’s work was sloppy in the first place and failed to honour requests for confidentiality and anonymity. Your armour will protect you from any attack!

There you have it good knight, work through these steps and retreat within the impregnable castle walls of bureaucracy.



Following the massive privacy breach in publishing submissions on the Draft Education Regulations, DET over-corrected and tried to excise sections written with the express purpose of demonstrating the inappropriateness of the regulations for home education.

Many submissions told private stories written for anonymous publication. This was what made the privacy breach so concerning – the harrowing personal stories illustrated the problems with the regulations; anonymity was important for those who requested it.

To correct the privacy breach, all DET needed to do was clean the metadata and ensure they conformed with the privacy requirements originally specified by each submission maker.

They could have recommended anonymity or adjustments for individuals if they thought it wise.

There was no need to make anonymity the default, nor to erase the very stories told to demonstrate what led to home education!

To correct a redaction, people had to recognise that part of their submission had disappeared and request the full submission be reinstated. The redacted parts reflect badly on DET and we believe redactions were made on this basis rather than through privacy concerns.

In addition to that, the default anonymity and the publishing purely by number makes it very difficult to look up anyone’s submission without opening every single one of them. Visitors can’t say “Oh, let’s see what Disability Advocacy Victoria has to say on the subject” (because they, like most of the disability groups missed the cut-off date for republication). Further, they can’t look up anyone’s submission without opening all submissions one by one until they find it.

This ridiculous privacy-police approach has not been adopted in other jurisdictions – for example submissions on the Tasmanian Education Act were published with names unless requested otherwise and visitors could scroll through the submissions, clicking on those of particular interest.

DET didn’t want public attention drawn to these submissions so why not take a look?


By Sue Wight

Leave a Reply

Your email address will not be published. Required fields are marked *