Confidential customer details exposed on Qantas site
LATEST NEWS
- Video will drive UFB uptake, but NZ lacks content choices: ComCom || 1
- TelstraClear's half-year revenue drops by 4 percent, but telco posts $1m profit
- Peter Finch leaves CIO post at Gen-i || 1
- 2degrees announces 875,656 customers
- NZ Fauna app fills 'crazy' lack of animal info || 4
- Megaupload interest a mixed blessing for Pirate Party || 2
SUBSCRIBE
Computerworld is New Zealand's only specialised information systems fortnightly. Subscribe now for $100 (23 issues) and save more than 37% off the cover price!
SIGN UP
Qantas' website breaches the privacy at least two customers
By Amanda Conroy | Sydney | Monday, 1 December, 2008
Qantas' online booking site breached the privacy at least two of its customers this month, with their personal details revealed to another party when they attempted to access flight check-in information online.
Qantas customer Vicki Doust revealed the privacy breach to Australian PC World. She unearthed the error while attempting to access the company's secure booking site.
She accessed the details using her personal booking number and details — provided by Qantas — to manage her online check-in for an upcoming flight. Doust's initial attempt to access her flight and booking information failed. She attempted to log-in again, only to be presented with the personal details of two other Qantas customers.
The details included the full names of the two customers and their Qantas Frequent Flyer details, as well their home and mobile phone numbers, e-mail addresses and details of their travel itinerary, including return flight details and times.
Doust, who immediately contacted Qantas, says she had to escalate the call in order to get the matter addressed immediately.
"I spoke to the customer service supervisor, and he told me that yes, it was a serious issue and he did agree that it was a privacy concern", says Doust.
The Australian Privacy Commissioner says that under the Privacy Act 1988 there is no requirement for an organisation to reveal the details to the Office of the Privacy Commissioner or affected customers if a breach occurs.
"While I cannot comment on this particular incident, in general, the Privacy Act requires organisations to take reasonable steps to ensure the security of personal information that they hold", says commissioner Karen Curtis.
"If an organisation fails in their obligations under the Privacy Act, they run the risk of breaching an individual's privacy and of having a privacy complaint lodged against them."
The Australian Law Reform Commission (ALRC) put forward a recommendation to the Privacy Commission that data breach notification become mandatory if there is a real risk of serious harm occurring as a result of a breach. The Federal Government will be considering the data breach recommendation in the second stage of its response to a report on privacy law in Australia.
The privacy commissioner advises customers who think their information has been handled inappropriately to contact the party responsible to remedy the matter.
"If a person believes that their information has been handled inappropriately, they should complain to the organisation as a first step. If the person is unable to obtain a response from the organisation, or is dissatisfied with the response, they can then lodge a complaint with my office", says Curtis.
Doust says she asked the Qantas customer service supervisor if she could be advised of the outcome or resolution to the breach but she was told to "put it in writing" as he did not know if he could provide the follow-up information or how long a resolution would take.
Lloyd Quartermaine, a Qantas media spokesperson, says the company's technical team was looking into the matter but could not say what caused the incident.
MOST POPULAR
Social Media @Computerworld NZ
Computerworld NZ has now reached LinkedIn! Join to expand your networks and meet others interested in information systems.
