Finance Department’s bungle could cost taxpayers ‘millions’

Katy Gallagher’s Finance Department is scrambling to reassure up to 400 service providers they can manage sensitive data amid warnings the leak of confidential contract details could cost taxpayers ‘millions’.

Finance Minister Katy Gallagher’s department scrambles following e-mail bungle that released confidential and sensitive personal and contract details of up to 400 service providers. Picture: Martin Ollman/NCA NewsWire

Katy Gallagher’s Finance ­Department is scrambling to ­reassure up to 400 service providers the government can manage sensitive data, after bureaucrats accidentally leaked confidential contract and personal details to 236 suppliers competing for government work.

After The Australian on Wednesday revealed the bungle, ­opposition finance spokeswoman Jane Hume warned “companies and individuals impacted by this gross incompetence may exercise their rights against the commonwealth, potentially costing taxpayers millions”.

Service providers and consulting firms caught up in the unauthorised release of fees and personal contact details are furious about information being leaked to competitors and have questioned the government’s ­capacity to run its own in-house consulting capability. Smaller firms are concerned larger companies could use the information to price them out of work.

Finance Department officials were forced into damage control on Tuesday and Wednesday after realising an “embedded” spreadsheet was included in fee schedule updates sent to 236 suppliers last week.

Officials contacted suppliers to tell them to delete the attached spreadsheet as it contained sensitive information, asking for written confirmation of the deletion and demanding “statutory declarations to ensure third-party confidential information is not disclosed”.

The spreadsheet lists supplier names, service provider names and price scales across different levels for major firms including KPMG, Boston Consulting Group, Accenture, Deloitte, Proximity, Nous Group and Minter Ellison. The document, found in a hidden tab, included contact details such as email ­addresses and phone numbers of staff and chief executives.

As Senator Gallagher on Thursday left her department to manage the fallout, Senator Hume said the minister must “come clean on how hundreds of businesses have had their privacy and commercial arrangements breached under her watch”.

Senator Gallagher, who is in Rio de Janeiro acting for Penny Wong at the G20 foreign ministers’ meeting, will be grilled on the spreadsheet fiasco when parliament returns next week.

It was the second time since November that a government ­department had breached commercial in-confidence rules. After Department of Health officials accidentally leaked the billing rates of about 400 firms to 22 service providers, senior government figures promised the mistake would not be repeated.

Following the initial breach, Senator Gallagher announced “spot checks” over 12 months to ensure the 22 service providers who inadvertently received fee schedules of their competitors did not misuse the information.

Department of Finance secretary Jenny Wilkinson on Wednesday authorised an “independent review of the matter (and the inadvertent release in November 2023)”. Former commonwealth and ACT ombudsman Michael Manthorpe will conduct the review, which will “consider the circumstances that led to unauthorised disclosure of the information, as well as the department’s systems and processes”.

Senator Hume said it was “staggering that the Department of Finance … released information on up to 400 companies, some with personal details of individuals, only months after a similar breach had to be cleaned up”.

“When the original breach ­occurred in November, the minister tried to brush concerns away with claims that appropriate steps had been taken. Clearly, she was wrong. This isn’t just a one-off, this is now a track record of incompetence,” she said. “In the latest breach, it was only days later that the Department of Finance became aware of the fact that they breached privacy and commercial confidentiality arrangements. This will damage the public confidence in government procurement processes.”

After apologising for the “oversight” and describing the disclosure of third-party confidential information as “regrettable”, the Finance Department on Thursday said it was providing regular updates to all management advisory services panel ­providers.

In a statement, the department said it had sent “confidentiality deed polls and statutory declarations to all suppliers who received the spreadsheet, seeking their ­urgent execution”.

The department said third-party confidential information embedded in the spreadsheet “comprised contact details and fee information for providers on the MAS Panel that was current as at November 2023”.

“The fee information that could be identified through manipulation of the spreadsheet is not representative of the current pricing of all providers on the MAS Panel (given that most suppliers have adjusted their fees over the past few months).”

“As previously advised, this information would not have been accessed or viewed by a person who simply opened the spreadsheet.”