PoliticalClaims.au

**What the claim gets right:** - Asylum seekers were indeed not notified that their personal information had been stolen [2] - The hard drives were not password-protected [2][3] - They were stored in an unlockable office environment [3] - The information included highly sensitive material (mental health records, abuse allegations, protection claims) [2] **Important context the claim omits:** - The theft occurred at a remote offshore facility (Nauru) operated by contractors, not in a controlled departmental office - Physical security challenges in the Nauru detention centre were significant and known - including theft of other equipment from locked cabinets [2] - The government had taken steps to improve data security after the February 2014 breach, though these didn't address the physical security issues on Nauru - The hard drives belonged to Save the Children (a contractor), which conducted its own internal investigation [2] **Why notification may not have occurred:** While the claim implies deliberate concealment, the reasons for non-notification were not fully explained by the government.

Possible explanations include: - Ongoing investigations (Save the Children internal review, Philip Moss independent review of Nauru conditions) [2] - Uncertainty about what data was actually compromised - Concerns about alarming detainees in an already volatile environment However, the failure to notify is a serious breach of privacy best practice, and the Privacy Commissioner later (2021) ordered the department to pay compensation to victims of the separate February 2014 breach, finding that "a loss of privacy or disclosure of personal information may impact individuals" [6].