In December 2025, Vodafone disclosed my private, eight-year-old employment records to a journalist – without consent, without lawful basis, and during active regulatory disputes. This article examines how that disclosure appears to breach multiple Australian Privacy Principles, why it fits a long-running pattern of privacy failures at Vodafone, and what it means for every customer who believes complaining to a telco shouldn’t put their personal data at risk.
There’s a line between incompetence and misconduct.
Vodafone crossed it, again.
On 11 December 2025, Vodafone disclosed private, confidential, historical employment information about me to a journalist – information that was:
- more than seven years old,
- collected under a different corporate entity,
- never requested by the journalist,
- wholly irrelevant to the issues being reported, and
- disclosed without my knowledge, consent, or any lawful basis.
The disclosure was not incidental. It was volunteered. And it fits a pattern of behaviour Vodafone has never properly addressed.
It fits a long-running pattern of privacy, governance and accountability failures that Vodafone has never properly addressed.
What Actually Happened
Instead of responding to the substance of those issues, Vodafone volunteered my historical employment information, including that I worked at Vodafone until 2018.
The journalist did not ask for this.
The journalist later contacted me directly to verify what Vodafone had told them.
That moment matters – because it confirms the disclosure was volunteered, not incidental.
To do this, Vodafone staff had to:
- access historical HRIS or archived employment systems,
- retrieve records from a pre-TPG merger entity (Vodafone Hutchison Australia), and
- use that information for a purpose entirely unrelated to why it was collected.
That is not compliant media handling.
That is not normal corporate practice.
That is a privacy breach.
This Is a Clear Privacy Act Issue – Not a Grey Area
The conduct raises serious issues under the Privacy Act 1988 (Cth) and multiple Australian Privacy Principles.
APP 6 – Use and Disclosure (Clear Breach)
Employment data collected for HR administration cannot be disclosed to journalists as a secondary purpose.
No APP 6.2 exception plausibly applies:
- No consent
- No reasonable expectation
- No legal requirement
- No compatibility with original purpose
The disclosure appears designed to undermine credibility, not inform the public.
That is an improper purpose.
APP 11 – Security of Personal Information
For this disclosure to occur, Vodafone staff must have:
- accessed dormant or archived HR records,
- without a legitimate operational need, and
- used that access to disclose information externally.
If historical employment files can be retrieved this easily for reputational purposes, Vodafone’s internal access controls are inadequate.
APP 13 – Accuracy, Context and Fairness
The information disclosed was:
- selectively framed,
- stripped of context, and
- capable of creating a misleading impression.
Even factually accurate information can breach the Privacy Act when used unfairly or misleadingly.
This Did Not Happen in Isolation
This disclosure occurred during active regulatory processes, including:
- an ongoing TIO complaint,
- engagement with OAIC,
- whistleblower disclosures via KPMG FairCall, and
- ASX-related escalation activity.
It also follows prior CEO-initiated contact relating to my employment, which is already under review.
Taken together, this is not coincidence – it is patterned behaviour.
This Is Not Vodafone’s First Privacy Scandal – And That Matters
What makes this incident especially serious is not just what happened in December 2025, but how familiar it looks.
In 2011, Vodafone employees accessed the phone records of Fairfax journalist Natalie O’Brien after she published stories exposing serious security flaws in Vodafone’s Siebel customer data system. Those flaws allegedly allowed access to the personal data of millions of customers, including addresses, driver’s licence details and credit card information.
The conduct was publicly revealed in 2015, when Vodafone admitted that an employee had accessed O’Brien’s call and text message records in an attempt to identify her sources.
O’Brien later described the experience as “devastating”, stating:
“It’s a creepy nauseating experience to know that someone has been trawling through your mobile phone account looking at all your call records and private text messages.”
At the time, Vodafone denied “improper behaviour”, despite internal emails – later reported in the media – warning senior executives of the “huge risk” if the breach became public and suggesting the company had misled regulators by characterising systemic security failures as a one-off incident.
In light of Vodafone’s historical conduct – including internal warnings about the “huge risk” of privacy breaches becoming public and evidence that systemic issues were previously characterised as one-off incidents – I am concerned that similar minimisation or mischaracterisation may be occurring in current regulatory engagements, including with the Telecommunications Industry Ombudsman.
Notably, the data access occurred the day after O’Brien’s reporting was published, and the purpose of the access was not customer service, billing, or system maintenance – it was to respond to criticism.
That distinction matters.
Different Year. Same Reflex.
Fast-forward to December 2025.
Vodafone’s response is not confined to the substance of those issues.
Instead, Vodafone staff access historical employment records from a prior corporate entity and volunteer that information to the journalist, despite it being:
- unrelated to the journalist’s inquiry,
- more than seven years old, and
- collected for an entirely different purpose.
Once again, internal data is accessed not to serve customers, but to manage reputational exposure.
Once again, the subject of scrutiny is not a system – it is the individual raising concerns.
And once again, the conduct occurs during active regulatory processes, heightening its seriousness.
Why the 2011-2015 Precedent Is Relevant Now
This is not about suggesting identical facts or alleging identical intent.
It is about recognising a repeating organisational pattern:
- critics raise issues of public interest;
- Vodafone faces reputational risk;
- internal access to personal data is used outside ordinary operational purposes;
- the company characterises the conduct as isolated or benign;
- regulators are assured controls exist;
- and yet, years later, similar issues re-emerge.
That pattern is precisely why this 2025 disclosure cannot be dismissed as a mistake, a misunderstanding, or “over-zealous media handling”.
It goes directly to APP 1 (governance) – whether Vodafone has genuinely embedded privacy compliance into its culture, or whether privacy obligations continue to break down when pressure is applied.
Public Interest, Not Personal Grievance
The public response reinforces this concern.
A Reddit post outlining the 2025 disclosure was viewed over 403,000 times in less than 14 hours before moderation intervention – an extraordinary level of engagement that reflects widespread public concern about how large telecommunications providers handle personal data.
This is not outrage manufactured by a campaign.
It is recognition by the public that if a telco will access archived employment records to deal with a complaint, no customer data feels safe.
Why This Time Is Different
The key difference now is context.
This disclosure occurred alongside:
- ongoing TIO matters,
- an active OAIC complaint,
- whistleblower processes under the Corporations Act, and
- heightened scrutiny of Vodafone’s billing, debt escalation and governance practices – including comparisons on 2GB radio to “Robodebt Mark II”.
Taken together, the leaking of historical employment data does not look like an isolated lapse.
It looks like another data-governance failure surfacing under stress.
And that is precisely the kind of conduct the Privacy Act is designed to prevent.
What the voda.fail Campaign Has Uncovered
Since launching the voda.fail campaign, I have received reports from customers alleging:
- personal data being mishandled during billing disputes,
- customers being referred to debt collectors for invalid or disputed debts, and
- downstream data sharing flowing from those incorrect referrals.
This is not just billing incompetence – it is data governance failure.
Unprecedented Public Interest
When I posted about this incident on Reddit, the response was extraordinary.
The post was viewed 403,000 times in under 14 hours before moderators intervened.
That level of engagement is exceptionally rare – and it signals something important:
This is not a niche dispute.
This is a public-interest issue.
Hundreds of thousands of people recognised the implications immediately:
If a telco will leak someone’s employment records to a journalist, what happens to ordinary customers?
The Merger Question Vodafone Still Hasn’t Answered
My employment ended in 2017, under Vodafone Hutchison Australia, before the TPG merger.
Vodafone must now explain:
- why this data was retained,
- whether it should have been destroyed,
- how pre-merger HR datasets were migrated, and
- who has access to them today.
If TPG Telecom is able to mine legacy HR data for unrelated disputes, that raises serious questions about data minimisation and merger governance.
Why This Matters
This incident didn’t happen despite Vodafone’s systemic issues.
It happened because of them.
The same governance culture that produces:
- mass TIO complaints,
- persistent billing failures,
- debt escalation errors,
- privacy concerns, and
- regulatory opacity
is the culture that thinks leaking employment history is acceptable.
It isn’t.
And now it’s under investigation.
What Vodafone Could Do Right Now
None of the issues raised in this article require prolonged litigation, media spin, or years of regulatory delay to address. Vodafone could take meaningful corrective action immediately by:
- Commissioning an independent privacy audit Appoint an external firm (not internal audit) to review:
- access logs to historical HR and customer records;
- controls governing who can retrieve archived data;
- whether any access occurred outside legitimate business purposes; and
- whether similar disclosures have occurred previously.
- Preserving and disclosing relevant access records Immediately preserve – and provide to regulators – all:
- HRIS and archival system access logs;
- internal communications between HR, Legal, Corporate Affairs and executives;
- media-handling notes relating to this matter; and
- approvals or instructions connected to the disclosure. Preservation should occur now to prevent any risk of data loss or alteration.
- Explaining the lawful basis (or conceding the absence of one) Publicly and clearly articulate:
- which Australian Privacy Principle(s) Vodafone believes authorised the disclosure; or
- acknowledge that no lawful basis existed and that the disclosure was improper.
- Issuing a formal apology and undertaking Provide a written apology acknowledging:
- the disclosure was unauthorised;
- it should not have occurred; and
- Vodafone will not access or disclose historical employment or customer data for reputational or media-management purposes. This should be accompanied by a binding internal undertaking.
- Reviewing data retention and merger-era datasets Conduct and publish a review of:
- why pre-TPG merger HR records were retained;
- whether those records should have been destroyed;
- how legacy datasets were migrated; and
- who retains access today. Data minimisation is not optional — especially post-merger.
- Implementing executive-level privacy accountability Assign explicit privacy accountability at the executive level, with:
- mandatory training for Corporate Affairs, Legal, External Communications and Executive teams;
- escalation rules preventing use of personal data in media responses; and
- documented disciplinary consequences for misuse.
- Committing to transparency with regulators and the public, stop characterising systemic issues as isolated incidents. Acknowledge patterns where they exist and cooperate fully with OAIC, TIO and any other regulators assessing governance failures.
None of these steps prejudice Vodafone’s legal position.
They simply demonstrate whether privacy compliance is treated as a genuine obligation – or as a reputational inconvenience.
Why This Matters for Every Vodafone Customer
If Vodafone can:
- access archived records from a predecessor entity,
- for no legitimate purpose,
- during active disputes,
- and disclose them externally,
then every customer should be asking:
- Who can access my data?
- Why?
- Under whose authority?
- And what stops it being misused when I complain?
Privacy law exists precisely because power imbalances matter – and because organisations under pressure cannot be trusted to self-police.
This incident is not about me.
It is about whether one of Australia’s largest telecommunications companies can be trusted to handle personal information lawfully, proportionately, and without retaliation.
That question now sits squarely with regulators.
And it deserves an answer.
Where This Goes Next
I have asked the OAIC to assess:
- breaches of APP 1, 6, 11 and 13,
- whether this constitutes a serious or repeated interference with privacy,
- Vodafone’s access controls and retention practices, and
- whether enforcement action or Federal Court referral is warranted.
Voda.fail is not about revenge.
It’s about accountability.
And after more than a decade of patterns, excuses and “one-off incidents”, Vodafone is rapidly running out of credibility.
Disclaimer
This article is published in the public interest and is based on information known to the author at the time of publication, including contemporaneous correspondence, regulatory communications, and documented media interactions. It reflects the author’s personal experience and views and does not purport to make findings of fact or law, which are matters for the relevant regulators and courts.
Where references are made to potential breaches of legislation, regulatory obligations, or governance standards, these are expressed as concerns or questions arising from the circumstances described, not as definitive legal conclusions.
This article is not intended to provide legal advice, nor should it be read as alleging criminal conduct. Ongoing regulatory processes may result in findings that differ from the author’s current understanding.
Right of Reply
Vodafone/TPG Telecom has been offered a right of reply in relation to the matters raised in this article. If Vodafone wishes to provide a response, clarification, or correction, it may do so in writing, and any substantive response will be published or appended in full, subject to relevance and clarity.
As at the time of publication, no substantive response addressing the specific issues raised – including the disclosure of historical employment information to a journalist, data access and retention practices, or the governance controls surrounding such disclosures – has been provided.
Leave a Reply