Alinta Energy has been slammed for its “reckless” cyber security and data protection systems.

Reports say the Chinese-owned firm may even be in breach of Australian privacy laws by failing to protect its customers’ personal information.

Alinta collects names, addresses, birth dates, mobile numbers, Medicare and passport numbers, credit card details and even some health information as part of its retail operations.

But internal documents, confidential reports and emails leaked by a whistleblower suggest the company’s privacy systems are wildly inadequate.

Australia’s privacy laws require companies to have proper systems in place to protect customer and supplier information.

In a June 2019 privacy compliance audit by Alinta Energy’s internal auditor EY, the company was assigned a “red” or “significant” risk rating on key aspects of its privacy compliance.

The report found Alinta did not have proper oversight and structure to manage privacy and at times “doesn’t meet the requirements of privacy laws”.

“This is likely to lead to personal information being inadvertently accessed or to the personal information data being used for a purpose other than the notified purpose (particularly in relation to the data analytics performed by the retail business intelligence team),” the report said, according to a joint investigation by The Age, Sydney Morning Herald and ABC.

Privacy experts say Alinta appears to have a cavalier attitude to privacy.

Chow Tai Fook was given the green light by the Foreign Investment Review Board (FIRB) to buy Alinta for $4 billion in April 2017.

The FIRB imposed conditions including that must be stored within Australia, can only be accessed within Australia and not be taken outside of Australia.

Alinta’s own legal department has recognised that Electricity Monster, a third party used by Alinta and others to sign up retail customers, stores customer information in Singapore.

Since it was bought out by the Chinese firm, Alinta has been aggressively signing up new customers.

Complaints have been rising alongside.

In 2015-2016, before the ownership change, Alinta recorded 377 customer complaints. That number soared to 2,486 in 2018-2019, according to statistics from the Australian Energy Regulator.

Alinta says its current complaint rate is “statistically similar to its competitors or the industry average”.

The company has refused to comment on criticisms of its privacy protocols.