Operation Impala - A report on misuse of confidential information in the Queensland public sector

Summary

The report's own summary: Executive summary and recommendations, pages 12 to 19

In the body's own words

1. Finding

   Operation Impala identified inconsistent approaches to dealing with allegations regarding misuse of confidential information.

   Report, page 13

2. Finding

   Such misuse was found to have ongoing and long-lasting effects including stress, feelings of vulnerability, financial loss, and frustration with the difficulty of obtaining redress or adequate compensation.

   Report, page 13

Findings, opinions and statements

Allegations are not findings. A commission's finding or opinion of corrupt conduct or misconduct is not a finding that a person is guilty of a criminal offence, and the commissions say so in their reports.

No findings are reproduced in this record. This does not establish that the report contains none.

Recommendations 18

1. Recommendation 1

   Access control mechanisms That agencies: 1. ensure all computer databases where confidential information is stored have unique user identifications log-ons 2. conduct quarterly user access reviews and monitoring of user access changes to help prevent and minimise unauthorised use of these databases 3. ensure additional access control mechanisms are implemented on confidential information of vulnerable people.

   Report, page 14

2. Recommendation 2

   Audit responsibility when sharing data That public sector agencies ensure MOUs or other agreements which set out the processes and roles in relation to data sharing between agencies contain clauses that specify: 1. which agency is responsible for conducting targeted audits of shared data 2. regularly defined intervals at which audits are to be conducted, preferably quarterly.

   Report, page 14

3. Recommendation 3

   ICT Information Access policy 3.1 That all public sector agencies develop a comprehensive and concise ICT Information Access policy. The policy should refer to the Criminal Code, the relevant public sector agency governing Act and the Information Privacy Act. It is critical that language used is standardised to ensure consistency and better understanding. In particular the policy should include for each of these three Acts: 1. the meaning of confidential information 2. the meaning of unauthorised use 3. the meaning of unauthorised disclosure 4. the range of potential sanctions including criminal charges and disciplinary proceedings, such as termination, demotion, and/or the imposition of a post-separation declaration, and 5. de-identified case studies of substantiated allegations relating to the misuse of confidential information and the consequences of those matters for the employee. 3.2 That public sector agencies with decentralised agencies (for example, Queensland Health and the Department of Education) provide sufficient support to ensure that the decentralised agencies have comprehensive and concise ICT Information Access policies in place. Sufficient support includes, but is not limited to: 1. providing templates and 2. Reviewing the policies implemented by decentralised agencies annually.

   Report, page 15

4. Recommendation 4

   Confidential information access and privacy training 4.1 That agencies ensure that training: 1. is developed and provided to all public sector employees prior to gaining access to any database that contains confidential information 2. is developed and provided annually to all public sector employees who have access to confidential information 3. reflects the respective ICT access and use policy, including references to the Criminal Code, the relevant public sector agency governing Act and the Information Privacy Act. The language used in the training material should be consistent and include explanation of items numbered 1 to 5 outlined in Recommendation 3.1 4. comprises a combination of online, face-to-face and video modules 5. records of the content and participation by employees are kept 6. is assessed annually to determine levels of retention and understanding of the content of the respective Information Privacy policy and supporting training material. 4.2 That public sector agencies with decentralised workforces (for example, Queensland Health and the Department of Education) provide sufficient support to ensure that the decentralised agencies conduct all-inclusive training. Sufficient support includes, but is not limited to: 1. providing guidelines, and 2. conducting an annual review of the decentralised agencies’ training.

   Report, page 15

5. Recommendation 5

   Privacy awareness messaging That public sector agencies undertake regular information privacy awareness campaigns including but not limited to: 1. annual email messaging to all employees by the Commissioner, Director-General or Chief Executive Officer to communicate the agency’s position clearly as regards information privacy, including acceptable and unacceptable conduct 2. bi-annual email messaging of same to employees by senior executive officers 3. screensavers and posters that stipulate the consequences of misusing a restricted computer database [see items 1 to 5 of Recommendation 3.1], to be updated on a quarterly basis 4. log-on warnings displayed before accessing a restricted computer database to remind public sector employees that access is logged and monitored and that consequences of misuse of confidential information may result in criminal charges under s. 408E of the Criminal Code and/or disciplinary sanctions, and 5. de-identified case studies—for example, for inclusion in monthly newsletters or for discussion during toolbox talks.

   Report, page 16

6. Recommendation 6

   Dealing with misuse of confidential information That public sector agencies: 1. Consider criminal prosecution upon detection of misuse of confidential information by public sector employees, which generally will require the matter be referred to the QPS as a criminal complaint in the first instance prior to a determination being made with respect to the instigation of disciplinary proceedings. 2. Apply and adapt, if necessary, the CCC’s assessment flowchart to ensure consistency in decision- making processes with respect to incidences of misuse of confidential information, including the decision to refer to the QPS and the decision to institute disciplinary proceedings. Public sector agencies are to retain contemporaneous records to justify decisions made. 3. Pursue post-separation disciplinary proceedings where appropriate.

   Report, page 16

7. Recommendation 7

   Referral for criminal proceedings That the QPS: 1. Manage all complaints of misuse of confidential information by public sector employees through the central QPS unit in the first instance. 2. Provide clear and cogent advice to agencies in relation to the reasons for not commencing criminal prosecutions when matters are referred from the agency. 3. Provide a template and guidelines for public sector agencies to refer a suspected criminal with respect to misuse of confidential information to assist with the compilation of relevant information for the QPS to use during the determination to commence an investigation.

   Report, page 16

8. Recommendation 8

   Improved prevention and detection systems That public sector agencies are to: 1. Develop and define additional protections to safeguard confidential information that relates to vulnerable including high profile persons. Public sector agencies should develop their own categories of vulnerable persons. Protections should be proportional to ensure that operational efficiency is not compromised and should include: - flags when records of vulnerable or high profile persons have been accessed; and - targeted quarterly audits of the flags. 2. Conduct quarterly targeted audits of access logs to identify possible misuses of confidential information. Agencies are to develop their own categories for the targeted audits, based on a risk assessment. 3. Develop systems that monitor outbound emails, after hours and remote accesses; as well as the deployment of data analytics to report unusual accesses. That the Queensland Government Chief Information Officer (QGCIO) advise agencies with respect to proposed improved proactive auditing systems.

   Report, page 17

9. Recommendation 9

   QHealth That the Department of Health provide assistance to all Hospital and Health Services to remove the backlogs of potential breaches of the eMR and ieMR databases detected by the P2Sentinel software.

   Report, page 17

10. Recommendation 10

    A new criminal offence That the Criminal Code be amended to add a new offence of misuse of confidential information by public officers, to contain the following attributes: 1. Be divided into two parts, one relating specifically to misuse of confidential information on a computer and the other to provide for an offence misuse of any confidential information regardless of its source. 2. Access to the information is an offence where it was not in furtherance of the performance of a function of the agency. 3. The simpliciter offence which involves only access to the confidential information is to be a crime, punishable by 5 years imprisonment. 4. There are to be three aggravating circumstances to the simpliciter offence where the term of imprisonment increases to 10 years, namely: a. where the public officer or another person obtains a benefit, or b. when disclosure is made to a third party, or c. where access could facilitate the commission of a crime. 5. It is to be a defence if the access to the information was authorised, justified or excused by law. 6. The offence is to be added to the list of the indictable offences under s. 552A (1)(a) which must be heard and decided summarily on prosecution election. 7. The offence is to contain the following definition section: benefit includes: (i) obtaining knowledge of information from a database, or (ii) finding that there is no record in the database, or (iii) obtaining knowledge of information that is available from another public source computer includes any electronic device for storing or processing information confidential information includes all data, files and documents, irrespective of whether the information is publicly available from another source. The focus should be on the source of the information obtained as opposed to whether it could have been obtained lawfully via some other means.

    Report, page 17

11. Recommendation 11

    Central enquiry service That OIC strengthens its enquiry service for victims who have had their confidential information misused, to include if accepted services outlined in recommendations 12, 14 and 15. Such services should include telephone and face-to-face advice delivery, with information available online, and scope to make referrals to other relevant agencies.

    Report, page 18

12. Recommendation 12

    Mandatory Notification Scheme That a mandatory data breach notification scheme be implemented in Queensland and that the OIC be responsible for developing the scheme, and receiving and managing the notifications.

    Report, page 18

13. Recommendation 13

    Updates to complainants regarding confidential information misuse complaints That public sector agencies provide three-monthly updates to complainants regarding the management of their complaint, with sufficient details, where appropriate, regarding the progress and final outcome.

    Report, page 18

14. Recommendation 14

    Own-motion powers for the OIC That the OIC have: 1. own-motion powers under the IP Act to strengthen existing powers and better identify systemic issues arising from an act or practice of an agency. 2. the power to make a declaration following an own-motion investigation, to be modelled on the comparable Commonwealth provisions.

    Report, page 18

15. Recommendation 15

    Extending the role of the OIC in proceedings That the OIC be able to appear as a friend of the court (amicus curiae), and have the power to intervene in QCAT proceedings, where appropriate and with leave of the court.

    Report, page 18

16. Recommendation 16

    A single set of privacy principles That the IPPs and NPPs in the IP Act be amalgamated and strengthened, having regard to the APPs contained in the Privacy Act (Cth); and in particular the: 1. definition of “reasonable steps” in the fourth of each set of principles relating to security of data be further defined in accordance with the terms of Article 32 of the EU GDPR; and 2. definition of “personal information” be amended in the IP Act to accord with the current version contained in the Privacy Act (Cth).

    Report, page 19

17. Recommendation 17

    Statutory tort for misuse of private information That the Queensland Government consider the introduction of a statutory tort for serious invasion of privacy by the misuse of private information, such as by collecting or disclosing private information about the plaintiff, as described in the ALRC 2014 Report.

    Report, page 19

18. Recommendation 18

    Privacy Champion That a “privacy champion” be embedded in agencies at a senior officer level, with the view to incorporating PbD into executive decision-making processes.

    Report, page 19

Published responses

No published response was found.

Official documents 2

• Operation Impala - A report on misuse of confidential information in the Queensland public sector

  Report · 154 pages

  Document details

  Role

  Report

• Operation Impala - One-page summary

  Summary · 1 page

  Document details

  Role

  Summary

Hearing transcripts: evidence, not findings 32

What a witness or counsel says at a hearing is evidence or submission, not a finding. Transcripts are the publisher's copies, including its redactions, listed newest first by month.

Case

Operation Impala

Hearings page

Hearings page on ccc.qld.gov.au

Coverage

This publisher

• Reports from 1991 to about 2011 are listed on the CCC site but many pages link no report document; those records carry the page summary only, with findings and recommendations not extracted.
• Scanned reports without a text layer are not OCR'd; their findings and recommendations are not extracted.
• Findings and opinions are not extracted except where a report states it makes no finding about any person (section 48B of the Crime and Corruption Act 2001). Pre-2025 reports state outcomes in narrative form, which is not converted into findings.
• Recommendations are extracted only from a complete numbered run; reports that number recommendations differently, or set them inside narrative chapters only, are marked not_extracted.
• Government responses are recorded where the CCC report or public hearing page links one; the responses themselves (often Queensland Parliament tabled papers or ministerial statements) are linked, not fetched.
• The 1989 Fitzgerald Inquiry report, which the CCC hosts, is a commission of inquiry report and is not included here.