Parliament Orders Release of Secret American Express Security Report

The Privacy Commissioner has been ordered by parliament to hand over a secret report detailing its investigation into American Express's security failures after using gag orders and legal threats to keep it confidential.

Greens senator David Shoebridge moved a motion in the Senate on Wednesday to compel the Office of the Australian Information Commissioner (OAIC), which the Privacy Commissioner sits within, to release the final determination of its years-long investigation into American Express.

The ABC has previously reported the OAIC declined to release the full report because of "the creation of risks to Amex's cybersecurity", which was criticised by Senator Shoebridge as setting a precedent of secrecy.

The motion passed 33-21, with support from Liberals, Greens and independents outnumbering opposition from Labor. The OAIC has been given a deadline of July 28 to hand over the full report, as well as internal correspondence between American Express and the regulators "concerning confidentiality".

The OAIC's investigation into American Express began in 2023 after a customer complained that his ex-partner had used his position at American Express to spy on his personal banking transactions.

The Age published the confidential interim decision last year, which found American Express was not tracking employee access to 78 per cent of its systems, thereby breaching international standards and exposing millions of customers to "insider threat" risks.

Cybersecurity expert Alastair MacGibbon said companies needed to implement rigorous tracking and auditing of employee access to customer data to avoid privacy breaches, leaks and fraud.

"From a cybersecurity point of view, there's an increasing recognition that insider threats are as important as outsider threats," he said.

"It highlights that organisations have to be trusted custodians of our data for their services to function and for us to maintain confidence in brands."

Last month Privacy Commissioner Carly Kind found American Express breached privacy laws and ordered the company to provide the complainant with a written apology, financial compensation and upgrade its systems.

But Ms Kind decided to publish only a summary of the investigation findings into American Express and threatened the complainant with legal action if they shared the full report publicly.

The 14-page summary was published in mid-June and states American Express holds "vast amounts" of personal information about its customers, including identification and bank details, travel bookings, credit information and, in some cases, health-related information.

"Australia is a jurisdiction that represents a significant portion of AMEX's billed business," the summary stated.

"Unauthorised access to such information by an employee has the potential to facilitate a range of potential harms, including financial fraud, identity theft, physical harm or identification."

The OAIC found that American Express failed to take reasonable steps to protect the personal information it held, particularly given the organisation was on notice of insider threat risks following a similar breach in 2019.

"As a result of this critical gap in coverage, AMEX's systems remained vulnerable to misuse or unauthorised access by employees, including in relation to the accounts of their family, friends, or prominent individuals."

In response, an American Express spokesperson acknowledged the findings and said, "we take this matter seriously".

"We are committed to protecting customer information and handling personal information responsibly, with privacy and data protection as important priorities.

"As we have done throughout the investigation, we will continue to work with the OAIC and take steps to address its recommendations."

The spokesperson confirmed on June 15 that the company would "provide a written apology to the complainant" — which was sent on July 2 after the ABC sent American Express further questions.

Mr MacGibbon declined to comment on whether the OAIC should release the full report, but said the findings were "not dissimilar" to the EY employees who accessed Prime Minister Anthony Albanese's personal bank accounts while on secondment at the Commonwealth Bank and are now facing court.

"There need to be controls in place for access, particularly to protected individuals, politically exposed people and the like," Mr MacGibbon said.

Senator Shoebridge told the ABC on Thursday that "it should not have to take an order from the Senate to force the release" of "an important privacy report".

"Amex is a global corporation and it has been on notice of these systemic failings in its IT and access controls for over three years," he said.

"Part of the reason we pushed this motion was to take the burden off the complainant who has been gagged by the OAIC."

The OAIC declined to comment. American Express was contacted for comment.