Bombshell report by Victorian Information Commissioner reveals department’s data fail

The Department of Health’s failure to protect Victorians’ data resulted in “life-altering crimes being committed against a young woman”, a report has found.

A bombshell report has slammed the Department of Health for putting Victorians at risk after failing to protect people’s private data during the Covid pandemic.

In one shocking case, a contract call centre worker with a criminal history was given ­access to personal data, which he later used to impersonate a Covid-19 authorised officer, gaining entry to a woman’s home and threatening to tell authorities she was breaking Covid rules if she didn’t have sex with him.

In August 2022, Abdulfatah Awow, 26, was sentenced to two years behind bars for the “premeditated ruse” which ­occurred on June 2021.

County Court Judge Angela Ellis said it was a predatory act and told the court she had never seen another case like it.

Abdulfatah Awow, 26, was sentenced to two years jail.

The victim’s impact statement revealed she had since been diagnosed with PTSD, was too scared to walk down the street.

The experience traumatised her so much that she moved to Sydney. The case was one of two concerning breaches highlighted in the report by Victorian ­Information Commissioner Sven Bluemmel, released on Monday.

The damning document found that the Health Department failed to ensure third-party contractors had carried out basic police background checks.

It also revealed that the ­department also did not take proper precautions, failing to submit any police check applications for a period of eight months.

The report found the Department of Health put Victorians at risk after failing to protect their data. Picture: Getty

“I understand the unique pressures that the department was under in managing the sudden increase in demand for its services, and acknowledge that aspects of the situation it encountered were unprecedented,” said Mr Bluemmel in a statement accompanying his findings.

“But it remains the case that government agencies are rightly held to a high standard, and the failure to protect personal information resulted in serious and life-altering crimes being committed against a young woman.”

It is not yet clear what the legal implications of the commissioner’s findings would be and whether the woman is ­entitled to compensation.

In a second breach, police apprehended a man in relation to a series of armed robberies and found screenshots on his phone of people’s details, which were from a Covid database. A Department of Health spokeswoman apologised on Monday night.

“We acknowledge and deeply regret that private information was able to be misused by an external surge worker and the profound impact that has had on the victim.”