Laws And Penalties For Privacy Breaches By Employees In Australia

Our right to privacy is universally treasured by millions of Australians, and people especially want confidence that their financial information will be for their eyes only. So, while we all know that the government, banks, and other financial institutions can readily access these details, we trust that they won’t abuse their special powers for their gain. If they do, we trust that they will find themselves in extreme trouble.

This exact issue is now making headlines after two young men, one of whom was placed inside the Commonwealth Bank through Ernst & Young’s (EY) graduate consulting program, were charged over the alleged unauthorised access of confidential customer records, including those belonging to Prime Minister Anthony Albanese.

This blog looks at what has been reported and unpacks the criminal offences and penalties that sit behind these kinds of allegations, chiefly section 308H of the Crimes Act 1900 (NSW).

The Story So Far

According to reports from the Australian Financial Review and other outlets, a man in his early twenties who had been seconded to the Commonwealth Bank as part of EY’s graduate program has allegedly used the bank’s internal systems to view personal banking details of various people. One of these people included Mr Albanese, and reportedly at least one senior EY partner, despite the employee having no genuine work reason to access these records. That is, it was allegedly a purely personal itch that they wanted to scratch, without any authorisation by the company.

The alleged privacy breach was picked up by the bank’s own internal monitoring systems. These systems track who accesses sensitive customer information and flag abnormal activity. That alert triggered an investigation, and the matter was ultimately followed up by relevant authorities. The Australian Federal Police (AFP) confirmed the two men had been charged because of their investigation.

21-year-old Pau Issa has been charged with unauthorised access to, or modification of, restricted data, along with a second charge of using a carriage service to make available, publish or distribute personal data in a way regarded as menacing or harassing. 25-year-old Phillip Issa has been charged with a single count of unauthorised access to restricted data.

Both men were reportedly granted bail and were due to appear at Newtown Local Court, and the younger man has since had his employment at EY terminated.

Importantly, it should be stressed that these allegations have not yet been proven in a court of law. Each man is entitled to the presumption of innocence, so nothing definitive can be said yet.

Unauthorised Access to Restricted Data Offence and Laws: Section 308H Crimes Act 1900 (NSW)

The central charge here is unauthorised access to restricted data and is found in section 308H of the Crimes Act 1900 (NSW).

A common misconception is that these privacy-related offences are exclusively for professional “hackers”, and involve sophisticated malware, password decryption devices, and implements of this sort.

In fact, this offence covers a far more general scope, and is extremely different from the sensationalised, movie-inspired understanding that most have. Essentially, the offence concerns simply looking at data you are not authorised to see, while you know you should not.

This broad scope is why the section commonly applies to everyday employees – bank staff, consultants, police, healthcare workers and public servants – and not simply external intruders and hackers.

For a charge under section 308H to be made out, the prosecution must prove three elements beyond reasonable doubt:

1. You caused unauthorised access to, or modification of, restricted data held in a computer;
2. You knew that the access or modification was unauthorised; and
3. You intended to cause that access or modification.

“Restricted data” is defined as data to which access is restricted by an access control system associated with a function of the computer. This definition is a fairly common-sense one, and basically just means information protected by something like a login or password. A bank’s customer database sits uncontroversially within that definition, as do police systems, HR platforms and patient records.

“Access” is defined broadly under section 308A. It includes the display or output of data (in other words, simply viewing it on a screen), copying or moving data to another location or storage device, and the execution of a program, if a program is what is being “accessed”.

Importantly, recent NSW case law, such as Braimah-Mahamah v R [2016] NSWDC 138, has confirmed that what a person used restricted data for, or whether they even use it at all, is not an element of the offence. That is, simply accessing the data itself is the act that the offence punishes.

So, the ultimate question is whether you were entitled to cause the access at all.

Penalties for Unauthorised Access to Restricted Data Offences

Section 308H is a summary offence, meaning it is dealt with in the Local Court. It carries a maximum penalty of 2 years imprisonment. Proceedings must be commenced within 3 years of the alleged offence.

While two years is the ceiling penalty, the Local Court has the full range of sentencing options available, including fines, Community Correction Orders, Conditional Release Orders, and — significantly — a section 10 dismissal or a conviction with no further penalty at the court’s discretion. These non-conviction outcomes can be especially valuable where a criminal record would be devastating to future employment, particularly in finance, technology, or professions where background checks are routine.

The Second Charge: Using a Carriage Service to Make Available, Publish or Distribute Personal Data: Doxxing Under the Criminal Code (Cth)

The additional charge faced by the 21-year-old reflects one of Australia’s newest criminal offences that specifically targets this sort of conduct. Section 474.17C of the Criminal Code Act 1995 (Cth) criminalises using a carriage service (such as the internet or a phone) to make available, publish or distribute the personal data of one or more individuals in a way that reasonable persons would regard, in all the circumstances, as menacing or harassing.

Commonly known as the “doxxing” offence, it carries a maximum penalty of 6 years imprisonment. “Personal data” is defined broadly to capture information that enables a person to be identified, contacted or located, and includes names, images, phone numbers, and home or work addresses.

Importantly, this offence does concern the way and manner that a person engages in this conduct in, but is tested objectively, so doesn’t depend on what the accused actually intended or thought. Rather, the test is what a “reasonable person” would think of their conduct.

A related but more serious offence is under section 474.17D and applies where the conduct targets a person because of a protected attribute such as race, religion or sexuality. This more severe offence attempts to protect victims of discrimination and punish those who discriminate with up to 7 years imprisonment. Given the circumstances, it is unlikely that these charges will apply to the EY graduate.