Deciding who can open each record

Community housing tenants disclose more to their landlord than most people disclose to a bank: household income, disability, family violence, eligibility history and sometimes the location they are fleeing. I map every field in our housing record to the purpose for which it was collected and the roles that need it. Tenancy officers see support needs; maintenance coordinators see access instructions; finance sees the rent account. Sensitive alerts are written as instructions, such as two workers or call the housing officer first, without the reason behind them. I test the map against Australia's privacy principles and the state's tenancy requirements, and our lawyers advise where the line is uncertain. Most of the design work is conversation with frontline staff about what they actually use, which is usually less than they request.

Around 212 maintenance firms, from sole plumbers to regional building companies, carry out our work orders, and each brings subcontractors and staff turnover we cannot see directly. I treat their access as part of our own system boundary. Every account has a named principal who confirms it each quarter, unused logins expire after sixty days and multi-factor authentication is required. A work order carries only what the tradesperson needs to finish it, and photographs are limited to the component being repaired. I meet our contractor panel twice a year, because portal changes alter their costs and they will route around a rule they think is pointless. The aim is a chain in which the smallest firm can comply without an IT department, and where removing a firm from the panel removes its access on the same day.

A long-term maintenance forecast is a set of component lives multiplied by a set of condition observations. When the observations are old, the forecast is arithmetic performed on a guess. I run the data side of our asset management: the survey form, the component library, the mobile capture used in homes and the link between condition, work orders and capital plans. Each condition record carries the date and method of observation, so the board can see how much of a forecast rests on recent inspection. I work with the asset team on which components need a surveyor and which a tradesperson already in the home can update. Inspections in occupied homes require the entry notice set by state tenancy law and restraint about what is photographed, which our form now enforces.

A housing provider holds data as sensitive as a bank's with a charity's budget for protecting it. I spend that budget on controls that reduce harm when something goes wrong: multi-factor authentication everywhere, isolated and tested backups of the housing record, short retention for attachments in email and a rehearsed process for assessing a breach. We run two exercises a year, one with the executive and one with the Audit, Risk and Technology Committee, using scenarios drawn from our own incidents. I keep a prepared list of tenants for whom a letter could create risk, so that notification under the Notifiable Data Breaches scheme does not cause harm of its own. I report residual risk plainly to the committee, including the controls we have chosen not to fund this year and the reasons.

Housing providers grow by merging and by taking over the management of government-owned homes, and each change brings another set of records of uneven quality. I have consolidated two tenancy systems and absorbed several transfers of leased homes. My approach is to migrate the tenancy, rent and asset history that a successor must hold, archive the remainder under a retention schedule and delete what has no lawful purpose. I agree the data-handover terms before a transfer is signed, because afterwards the outgoing party has little reason to tidy anything. I also ask the board to fund reconciliation of arrears and repair histories, which tenants notice immediately when they are wrong. A rent balance that changes on migration day becomes a complaint, and sometimes a tribunal application, within the first week.