TeleChoice forced to compensate customers over 2014 data breach

Telstra wholesale provider TeleChoice has been ordered by the Privacy Commissioner to pay $7000 in compensation to two customers who were affected by its 2014 data breach.

Privacy Commissioner Timothy Pilgrim today published his findings on two separate complaints made by customers in May and June last year after it was revealed by A Current Affair that TeleChoice was storing sensitive customer data in publicly accessible shipping containers in Victoria.

The documents contained personal details of former TeleChoice customers, including passport details, driver's licenses, customer contracts and other identifying data.

The company reported the issue to the OAIC after the ACA story went to air, and said it destroyed the documents on the same day.

It entered into an enforceable undertaking to review its data storage security and offered to foot the bill of 12 months of credit reporting for affected customers.

But one customer took to the Privacy Commissioner for compensation after discovering her name had been publicised as part of the ACA footage.

While TeleChoice acknowledged it had breached the Privacy Act by failing to properly secure the customer's personal details, Pilgrim wrote, the two parties were not able to resolve the matter between themselves.

Pilgrim found that TeleChoice had failed to properly safeguard the customer's information, and ordered the company to pay her $3500 in compensation for the "anxiety and stress" she suffered.

TeleChoice was also ordered to apologise to the customer in writing within 30 days.

A second customer also complained to the Privacy Commissioner after an ACA journalist contacted her to advise that he had obtained copies of her driver's licence, Medicare card and her telco contract with TeleChoice from the shipping container.

While her data was not broadcast as part of the footage, Pilgrim found TeleChoice had failed to both protect the information from unauthorised access and to destroy the data when it no longer needed it.

The information in the shipping containers had been awaiting destruction for two years.

He similarly awarded the second customer $3500 in compensation and ordered TeleChoice to make a written apology within 30 days.