In short:
Queensland's Office of the Information Commissioner received 82 data breach notifications from the public sector last financial year.
asserted
Office → receive → sector
The independent regulator also received 353 privacy complaints, more than double the previous year.
asserted
regulator → receive → complaints
Cybersecurity consultant Luke Irwin says data breaches are massively under-reported.
asserted
breaches → say → ?
The number of data breaches across Queensland's public sector is increasing, including some deemed malicious and intentional, the state's privacy watchdog says.
asserted
watchdog → increase → some
Queensland's Office of the Information Commissioner's annual report revealed it received a total of 82 data breach notifications last financial year, compared with 53 in the previous year.
asserted
it → reveal → year
The office is an independent privacy regulator tasked with overseeing how government agencies handle personal information.
asserted
agencies → task → information
In its latest annual report, Information Commissioner Joanne Kummrow wrote that its services had "reached unprecedented levels" in the last financial year.
asserted
services → write → year
It was the first year of a mandatory data breach notification scheme that began in July 2025.
asserted
that → begin → July
A spokesperson from the office said most data breaches were caused by accident or human error, and most involved unauthorised disclosure.
asserted
breaches → say → disclosure
That could have included a misdirected email, text message or system notification sent to the wrong recipient, or one that included unintended personal information, they said.
uncertain
they → include → information
"A small number of breaches were malicious and involved intentional, unauthorised access,"the spokesperson said.
asserted
spokesperson → involve → breaches
They said an example was the major cybersecurity incident involving the online learning platform Canvas, which affected an education technology provider in May.
uncertain
which → say → May
Under a voluntary scheme, the commissioner received 53 notifications in 2024-25 and 41 in the previous year.
asserted
commissioner → receive → year
The mandatory scheme requires ministers, departments, and public authorities to notify the Information Commissioner and impacted individuals of an eligible data breach.
asserted
scheme → require → breach
An eligible breach occurs when personal information held by an agency is compromised and is likely to result in serious harm to at least one individual.
asserted
information → occur → individual
This obligation was extended to local governments in July this year.
asserted
obligation → extend → July
"An agency must give a statement to the Information Commissioner about an eligible data breach, but ultimate responsibility for meeting obligations under the [Information Privacy] Act remains with the agency," the spokesperson said.
asserted
spokesperson → give → agency
Cybersecurity consultant Luke Irwin said data breaches were still "massively" under-reported.
asserted
breaches → say → ?
"There are cases where they should be reporting, but they're making a choice not to," he said.
asserted
he → be → choice
Mr Irwin, who has worked in the industry for more than two decades, said the scheme was not mandatory enough and would like to see breaches reported first, before a privacy impact assessment.
asserted
breaches → work → assessment
"Many organisations still treat it like a second thought,"he said.
asserted
organisations → treat → thought,"he
Mr Irwin was also concerned about the qualifications of individuals assessing the harm that could occur if someone's data is breached.
uncertain
data → assess → harm
"If somebody is a victim survivor of domestic violence and their address gets leaked, that's a major problem," he said.
asserted
he → leak → violence
Ms Kummrow said her office had received a "record" number of privacy complaints.
asserted
office → say → complaints
In 2025–26, the commissioner received 353 privacy complaints, more than double the previous year.
asserted
commissioner → receive → complaints
Of the complaints handled within the last financial year, 16 were referred to the Queensland Civil and Administrative Tribunal.
asserted
16 → handle → Tribunal
The spokesperson said an individual may make a privacy complaint if they believe that an agency has not handled their personal information in accordance with the law.
uncertain
agency → say → law
"This includes an agency not meeting its obligations in relation to a data breach notification," they said.
asserted
they → include → notification
Mr Irwin said the increase in complaints could be due to people becoming more aware of their privacy.
uncertain
people → say → privacy
He said many organisations were collecting too much unnecessary information, such as birthdays.
asserted
organisations → say → birthdays
"People are generally, I'm finding, getting fed up with their information being leaked or breached, so they're starting to push back more and more."
asserted
they → find → ?
The Aporia