Media release: Minimising Personal Information Held: Reducing the risk of privacy breaches

Queensland’s Information Commissioner’s report was tabled in Parliament today (10 December 2024), Minimising Personal Information Held: Strategies to mitigate the risk of privacy breaches.

The report examines whether Urban Utilities adequately manages its privacy risk and obligations by minimising the amount of residential customer personal information it collects and holds.

Every day, government agencies collect and hold our personal information to provide services to Queenslanders.

Government agencies should only collect the minimum amount personal information they need to deliver these services. The more personal information they collect and hold, the greater the risk of a privacy breach. Thisincludes the risk of unauthorised access, use, disclosure, and/or loss of personal information, whether intentional or accidental.

Privacy breaches have serious consequences for affected individuals, the community and agencies. Queensland’s Information Commissioner, Joanne Kummrow, said,

‘Queenslanders expect that government will safeguard their personal information. Agencies can mitigate the risk of a privacy breach by only collecting the minimal amount of personal information required and not keeping it for any longer than necessary’.

For government agencies, a privacy breach involving personal information can impact public trust in government and undermine the ability of agencies to carry out and deliver important public services.

Following an audit, the Information Commissioner found that Urban Utilities manages its privacy risks by only collecting the personal information it requires to deliver services to its residential customers. The audit also found that Urban Utilities disposes of most of its residential customers’ personal information when it is no longer required. “Urban Utilities has a disposal framework and robust processes for its billing system. The framework is generally good, but it could be more robust and better integrate with all Urban Utilities’ systems” said Ms Kummrow.

The report makes recommendations to Urban Utilities to strengthen its disposal of its residential customers’ personal information. The report also recommends Queensland government agencies strengthen their privacy practices and secure the personal information they hold through good information management and security practices by:

• identifying and reviewing all information holdings and systems that contain personal information
• assessing the privacy risks of those holdings and systems
• collecting the minimal amount of personal information required, and
• implementing appropriate information disposal procedures.

Read the report (PDF, 2922.29 KB)

Media contact: Steve Haigh
Phone: 3234 7373