Queensland Public Sector Sees Surge in Data Breaches and Privacy Complaints

Queensland's public sector is experiencing a significant increase in data breaches and privacy complaints, according to the state's privacy watchdog. The Office of the Information Commissioner's annual report revealed a total of 82 data breach notifications were received last financial year, up from 53 in the previous year.

Rising data breaches

Most data breaches were caused by accident or human error, with a spokesperson for the office stating that these incidents often involved unauthorised disclosure, such as a misdirected email or text message sent to the wrong recipient. "A small number of breaches were malicious and involved intentional, unauthorised access," the spokesperson said.

The office also noted that the mandatory data breach notification scheme, which began in July 2025, has led to an increase in notifications. Under the scheme, ministers, departments, and public authorities are required to notify the Information Commissioner and impacted individuals of an eligible data breach.

Cybersecurity concerns

Cybersecurity consultant Luke Irwin expressed concerns that data breaches are still "massively" under-reported. "There are cases where they should be reporting, but they're making a choice not to," he said. Irwin also suggested that the scheme is not mandatory enough and would like to see breaches reported first, before a privacy impact assessment.

Irwin also questioned the qualifications of individuals assessing the harm that could occur if someone's data is breached. "If somebody is a victim survivor of domestic violence and their address gets leaked, that's a major problem," he said.

Record number of privacy complaints

Information Commissioner Joanne Kummrow stated that her office received a "record" number of privacy complaints, with 353 complaints received in 2025-26, more than double the previous year. Of these complaints, 16 were referred to the Queensland Civil and Administrative Tribunal.

The spokesperson for the office noted that an individual may make a privacy complaint if they believe that an agency has not handled their personal information in accordance with the law. "This includes an agency not meeting its obligations in relation to a data breach notification," they said.

Irwin attributed the increase in complaints to people becoming more aware of their privacy and organisations collecting too much unnecessary information. "People are generally, I'm finding, getting fed up with their information being leaked or breached, so they're starting to push back more and more," he said.