CORRECTION
An earlier version of this article, which was entitled 'Your private information is being sent overseas by Centrelink', included some statements about Detective Desk which were corrected and are retracted by BuzzFeed. BuzzFeed regrets these errors.
Tony Johnson says he received a threatening phone call last month from a private debt collector looking to recover an overdue Centrelink debt. Turns out, they had the wrong Tony Johnson.
Johnson told BuzzFeed News the call was from someone identifying themselves as working for a company called Australian Receivables. The caller told Johnson he had a Centrelink debt that needed to be repaid immediately.
As it happened there were two Tony Johnsons living within the same postcode, and the caller had contacted the wrong one.
Private debt collection agency Australian Receivables has a $2.5 million contract with Centrelink as part of the government's controversial robo-debt recovery program.
As BuzzFeed News revealed last week, the third party debt collectors work on commission based on the amount they recover from Centrelink clients, not a flat rate. The more money the companies collect, the bigger their commission.
Tony Johnson claims he was called continuously by people purporting to represent Australian Receivables. He also says neighbours and family members were approached in a bid to track him down.
"It gets annoying after a while," he told BuzzFeed News.
Johnson says he contacted Australian Receivables to find out how they got his phone number, and was told it was via a company called Detective Desk.
Detective Desk is registered in the United States but operates from the Philippines. The company claims to own information about millions of Australians.
Detective Desk allows debt collection agencies to trawl data files to track and chase outstanding debts from Centrelink clients.
The Detective Desk website says it collects, holds, uses and discloses information about Australians including full names; dates of birth; driving licence numbers; gender; current and previous addresses; court judgements; employment histories; phone numbers; and any other information it says is publicly available.
The company sources and collects data from a number of third parties including search engines, social media networks, electoral rolls, insurers, law courts and direct marketing companies.
There's no guarantee the information supplied is correct, and that's how Johnson believes he became the victim of mistaken identity.
Labor and the Greens believe that commission based payments can encourage debt collectors to cut corners on privacy laws.
Department of Human Services communications manager Hank Jongen confirmed to BuzzFeed News that private debt collectors contracted by Centrelink use paid data services.
"In cases where the person with a debt has moved address or cannot be contacted, external collection agents may access paid data services," Jongen said.
Jongen said private debt collectors only recover a "very small proportion" of overall debts, and are only used to collect money from people no longer receiving a payment. He said current clients are not referred to debt collectors.
The department provides debt collectors with information to identify the person, but Jongen says the outsourcing contract stipulates that the information "is not to be disclosed, published, or communicated to any unauthorised person in any form either during or after services with the Commonwealth".
During the time they have access to the data, debt collectors must comply with the Privacy Act, the Competition and Consumer Act and the Copyright Act, as well as local, state and federal guidelines.
When a contract expires the debt collection agency is obliged to destroy the data.
However a former Australian Tax Office worker in the debt compliance unit told BuzzFeed News there were serious privacy concerns around the use of overseas data services.
Speaking on the condition of anonymity, the source said "The biggest concern is privacy and potential for identity theft. People employed overseas are not vetted."
Government staff must undergo vetting, rigorous security checks and follow privacy procedures when dealing with highly confidential information, which is not the case for debt collectors and third parties.
The Australian Competition and Consumer Commission and the Australian Securities and Investments Commission have written joint guidelines ensuring debt collection activity is consistent with consumer protection laws, but these guidelines are meaningless overseas.
BuzzFeed News repeatedly sought comment from Australian Receivables and Detective Desk. Staff at Australian Receivables hung up twice, and transferred the call to an answering machine in the IT department three times.