J.S., a Chinese national, arrived in Australia in April 2013 on a visitor visa which expired in July 2013. In September 2013, she was arrested on suspicion of shoplifting and detained at Villawood immigration detention centre in Sydney.

In October 2013, she applied for a protection visa as she feared being killed by associates of a Chinese official and being prosecuted if she were to return to China. This visa was refused and in January 2014, the Refugee Review Tribunal confirmed the decision not to grant her a protection visa.

On 10 February 2014, Australia’s Immigration Department accidentally published on its website the names and personal details (eg. nationality, date and details of their arrival, current location) of everyone in Australian immigration detention and community detention – approximately 9,250 people – including Ms J.S. The information was publicly available for 9 days before the ‘unacceptable’ security breach was rectified (para. 2.3). The then-Immigration Minister also described it as a “serious breach of privacy”: it breached section 336E of Australia's Migration Act which outlaws the disclosure of information gathered during visa processing (para. 3.2).

Ms J.S. petitioned the UN Human Rights Committee, alleging that Australia would violate her rights under article 6 (right to life) and article 7 (torture and cruel, inhuman or degrading treatment) if it deported her to China. She further claimed that Australia had breached her right to privacy under article 17 by publishing her personal data on the Immigration Department website.

The Committee did not find any breach of articles 6 and 7.

With respect to article 17, the Committee stated that Australia was obliged to take effective measures to ensure that information concerning a person’s private life -- particularly people in vulnerable situations, including refugees and people seeking asylum -- does not reach the hands of persons not authorised by law to receive, process and use it. Notwithstanding a breach of the Privacy Act being found, the removal of the data from the website, as well as structural and preventative measures taken by Australian authorities, as Ms J.S. had still not been compensated for the breach, the Committee found a violation of article 17 (the right to privacy), read alone and in conjunction with article 2(3) (the right to an effective remedy).

In addition, the Committee held that article 2(3) requires State Parties to ensure everyone has access to effective and enforceable remedies. As such, Australia must provide Ms J.S. with a remedy and report back to the Committee within 180 days.

Australia responded to the Committee in 2023, disputing the Committee's findings of any violation (para. 22), while at the same time stating that it had remedied the privacy breach (para. 24). It cited how it had improved its technologies and training in order to prevent another breach of people’s private information. The Immigration Department had written to those affected by the privacy breach about how it had handled the situation.

After an adverse finding by the Australian Information Commissioner and Privacy Commissioner, the government agreed to compensate 1,297 of the approximately 9,250 people affected by the privacy breach who had made submissions claiming loss or damage arising from the breach. Ms J.S. had made a complaint to the Privacy Commissioner (para. 2.3), but Australia would not comment any further, as neither it, nor Ms J.S.'s lawyer could contact her, which, it said, was necessary to obtain her consent to update the Committee.

Australia said that Ms J.S.'s Australian lawyer did not know her whereabouts (para. 9). Neither the Committee's final views nor Australia's response state whether Ms J.S. was ultimately deported or what became of her.

Australia nonetheless asserted that Ms J.S. had been provided with an effective remedy through the Department’s review of her refugee claim, taking into account, it claimed, any risks arising from the unintentional disclosure (para. 19). Australia maintained that its "non-refoulement obligations were not engaged in relation to [Ms J.S.] by the unintentional disclosure information of information" (para. 20).

It also claimed to have taken non-repetition measures by virtue of an investigation into the unintentional disclosure and implementation of the recommendations arising therefrom.

Read Australia’s response to the views of the Human Rights Committee