Australia’s Media Entertainment and Arts Alliance has called on the privacy commissioner to investigate the circumstances of the “unforgivable” hacking of a journalist’s phone data.
On Saturday the Australian published leaked emails that detailed how a day after Fairfax journalist Natalie O’Brien revealed a serious data breach by Vodafone in 2011, there were discussions at Vodafone about unauthorised access to her call charge records and text messages.
The company admitted on Sunday that O’Brien’s phone was accessed by an employee. The company claimed this was done for “privacy reasons” and to determine if criminal behaviour had occurred. It denied engaging in any “improper behaviour”.
The company said in a statement it had commissioned a top accounting firm to investigate the incident, which found there was “no evidence” Vodafonemanagement had instructed an employee to access O’Brien’s phone records.
On Monday MEAA chief executive officer Paul Murphy said the breach was shocking and called on the Office of the Australian Information Commissioner (OAIC) to investigate the circumstances. He also called on Vodafone to release the details of the internal investigation into the breach.
“I was shocked that such a flagrant breach would occur, and then apparently be covered up,” he said. “It’s absolutely outrageous behaviour on Vodafone’s behalf.
“Every journalist everywhere in the world understands that if they receive information in confidence they have an obligation to keep that in confidence. For a telecommunications company to engage in this sort of breach is unforgivable.
“The privacy commissioner should investigate this. We’re also writing to Vodafone stating our obvious disgust and concern about what’s been uncovered … and urging them to make public material about the breach.”
The Office of the Australian Information Commissioner has not yet commented publicly on the breach. Guardian Australia has asked the OAIC to respond to Murphy’s calls for them to investigate.
Under Australian privacy law there are limitations on the use and disclosure of personal information, with limited exemptions for disclosures for secondary purposes or to comply with another law.
People who are the victim of a privacy or data breach can complain to the Australian privacy commissioner, who has the power to order compensation and other penalties if they establish that a breach has occurred.
The use and disclosure of telecommunications data without authorisation can also be an offence under the Telecommunications (interception and access) Act 1979. A range of offences exist.
A spokeswoman for Vodafone said “we won’t be commenting further at this stage and we will not be releasing the report, which is privileged”.
She pointed again to the statement from Vodafone and the investment the company has made in IT security since the incident four years ago.
Guardian Australia has contacted the Australian federal police to ask whether an investigation is underway into the circumstances of the breach.