A Commonwealth contract that banned offshore access to court data did not stop overseas transcribers reaching it. Australia's privacy regulator says the fault lay in an access-control error, not in the contract.
The finding is in the Office of the Australian Information Commissioner's (OAIC) report, VIQ Solutions Pty Ltd and Commonwealth agency contracting, published on 4 November.
VIQ provided recording and transcription services to Australian courts and tribunals. They included the Federal Court of Australia and the Federal Circuit and Family Court of Australia.
The OAIC found that VIQ's Canadian parent company inadvertently added employees of e24 Technologies, a Chennai-based subcontractor, to VIQ's Australian transcription platform.
Five e24 employees in India had access between September 2025 and 11 February 2026, when it was revoked. Three of them accessed court recordings, from 93 matters across the two federal courts.
"As shown in the present case, data breaches and unauthorised access can still occur in circumstances where contracting and procurement procedures are followed," the report says.
The OAIC will take no further action. VIQ entered voluntary administration in March, ceased operations in July and is now in liquidation.
Information Commissioner Elizabeth Tydd said the incident was narrower than first reported. Media reports between February and June had alleged large quantities of sensitive court documents were disclosed to a foreign entity.
"The arrangements put in place by Courts in dealing with this sensitive information is an important privacy preserving measure," Tydd said.
Access, Not Disclosure
The report treats the incident as unauthorised access rather than a cross-border disclosure. That distinction shaped the legal analysis.
Under Australian Privacy Principle (APP) 8, an entity disclosing personal information overseas must take reasonable steps to ensure the recipient complies with the APPs. It can also be held accountable for the recipient's conduct.
The OAIC found VIQ did not engage e24 or authorise its staff. The information stayed on VIQ's servers in Australia, could not be downloaded, and access ended when each task was done.
Transcription work was split into 15-minute audio snippets on the cloud platform NetScribe. Transcribers could not keep copies once a snippet was complete.
On that basis, VIQ had not released the information from its effective control, and the OAIC considered a breach of APP 8 unlikely.
Any disclosure to the Canadian parent was likely covered by exceptions. They include the related body corporate exception and APP 8.2(a), which applies where comparable foreign privacy law protects the information.
The security principle, APP 11, was a different matter. The OAIC said the root cause was an access-control error, and that a one-off error may point towards a failure to take reasonable steps.
"On the information presently available, there is a reasonable basis for concern that the incident may have involved a breach of APP 11," the report says.
The OAIC said it did not verify how far VIQ's security policies were followed in practice. The report makes no concluded findings and does not prevent a future investigation.
The Courts' Position
The federal courts found the Privacy Act did not apply to their own role. Section 7(1)(a)(ii) excludes a federal court's acts other than those of an administrative nature, and hearings sit on the judicial side.
The courts reviewed the affected files and found none related to suppressed or confidential matters. Family law proceedings remain subject to section 114Q of the Family Law Act 1975, which restricts publishing identifying accounts.
Both the courts and the OAIC reported delays in getting information. The OAIC described establishing the facts as "a challenging and protracted process", with the administrators unable to supply everything requested.
The report also reviewed the contracting framework. Section 95B of the Privacy Act requires agencies to bind contracted service providers to the APPs. Section 6C of the FOI Act requires agencies to secure access to provider documents for FOI requests.
The Federal Court's contract with VIQ prohibited transferring or allowing access to personal information from outside Australia without permission. It also required VIQ to configure its systems so only authorised personnel could reach confidential information.
AusTender records show VIQ held 39 contracts across 13 agencies between February 2019 and April 2026. The largest, with the Federal Court from July 2020 to June 2026, was valued at $15.9 million.
The OAIC concluded the contracts adequately secured information rights. It noted the standard Commonwealth Contract Terms contain no explicit prohibition on offshoring data, but require suppliers to consider APP 8 before any cross-border disclosure.