Exclusive: online database provides personal details of almost 10,000 people in serious and embarrassing security breach

The personal details of a third of all asylum seekers held in Australia – almost 10,000 adults and children – have been inadvertently released by the Department of Immigration and Border Protection in one of the most serious privacy breaches in Australia’s history.



A vast database containing the full names, nationalities, location, arrival date and boat arrival information was revealed on the department’s website, raising serious concerns that thousands of asylum seekers have had confidential details made public.

Every single person held in a mainland detention facility and on Christmas Island has been identified in the database, as well as several thousand who are living in the community under the community detention program. A large number of children have been identified in the release, which also lists whether asylum seekers are part of family groups.

The breach raises serious questions about whether those identified could be placed at risk of retribution if they are returned to their countries of origin.

The disclosure of the database is a major embarrassment for the federal government, which has adopted a policy of extreme secrecy on asylum-seeker issues.

The asylum seekers named, range in age from newborns to people over 80. They come from countries including Sri Lanka, Afghanistan, Iran and Syria and arrived in Australia as late as September. Some have been in detention for more than 1000 days.

Guardian Australia has chosen not to identify the location of the data and made the department aware of the breach before publication.



The Department of Immigration has released a statement saying the information was never intended to be in the public domain.

“The department acknowledges that the file was vulnerable to unauthorised access. The department is investigating how this occurred to ensure that it does not happen again,” it said.

The department is also likely to have breached Australia’s privacy laws, which places limits on the disclosure of personal information held by government entities. The information privacy principles state that government agencies must ensure that records are protected “by such security safeguards as it is reasonable in the circumstances to take, against loss, against unauthorised access, use, modification or disclosure”.

At a news conference last November, the immigration minister, Scott Morrison, outlined the government’s responsibility to protect the identities of asylum seekers in its care.

“What the Australian government has an obligation to do, though, is ensure that we take all steps necessary so as not to violate their identity,” he said.

“Now, it is important that people who are making claims about asylum can do so in a discreet way and a private way. And we need to take all reasonable steps under our duty of care to ensure that we don’t expose people to that situation.”

Both the current and previous governments have said the secrecy surrounding Australian detention facilities is necessary to protect asylum seekers’ privacy.

When talking about the restrictions on media access to detention facilities in a November 2012 forum at the Australian Centre of Independent Journalism, the former head of communications at the Immigration Department, Sandi Logan, warned that identifying asylum seekers could lead to more claims succeeding because their identity had been compromised. These are known as “sur place” claims.

“What the end result could be is someone who is not a refugee, does not engage our obligations, winning on the grounds of sur place,” he said.

Logan said the limitations on identifying asylum seekers and preventing access to detention centres was “as much a protection for the department as it is also for the client.”