The CBUS superannuation trust deed is clear about the privacy of members' information.

The CBUS Fund Governance Policies and Procedures Manual is clear on a range of prudential obligations on CBUS managers.   Privacy is fundamental.

Privacy Law
The privacy laws require the Fund to
comply with the Australian Privacy
Principles (APPs). The APPs are thirteen
legislative benchmarks that prescribe
minimum privacy standards for the
handling of personal information. The
legislation regulates the collection, use
and disclosure of ‘personal information’.
This is information or an opinion about
an individual where the identity of
that individual is either apparent or
reasonably ascertainable from the
information or opinion in question.
Responsible Persons will, in the
course of their duties, have access to
personal and sensitive information
about Directors, staff, members and
employers of the Fund. All Responsible
Persons must ensure that such
information is treated confidentially and
in accordance with the APPs and the
Fund’s Privacy Statement.

On 15 July 2014 Senior Counsel Assisting the Royal Commission into Trade Union Governance and Corruption submitted the following facts in his opening remarks on the Commission's CFMEU hearings.  Not findings open to be made - facts.

In his sworn statement and oral evidence the former CFMEU official Brian Fitzpatrick gave very precise, self-incriminating evidence about how the CBUS information had been leaked.

Here is an extract from Brian Fitzpatrick's statement sworn on 14 July, 2014.

On 7 July, 2014 - that is 8 days before Counsel Assisting's opening statement and before Brian Fitzpatrick's self-incriminating evidence, CBUS had released the following media statement. 

The attempt at a diversionary media tactic is as obvious as it is pathetic.

The 7 July press release predated Stoljar's statement of fact about the leak of CBUS confidential information by one week.   But CBUS did not publicly respond after Stoljar's statement to the Commission and Fitzpatrick's evidence.   There was nothing further from CBUS in July.   Nor was there in September when further evidence was led at the Royal Commission.  It's important to note that Counsel Assisting the Royal Commission didn't say there might have been a leak of information from CBUS, he was precise and factual, he told the Royal Commission there had been a leak of confidential information.

CBUS remained silent even after Ms Zanatta's evidence to the Royal Commission and her admission (under the weight of overwhelming incriminating evidence) that she had knowingly leaked the confidential information, created a false story to cover her movements and then on two separate occassions given false sworn evidence to the Royal Commission about what she'd done.

It took a further week, until 9 October 2014 for CBUS to apologise for its actions in support of corrupt elements of the CFMEU.  The fact of Ms Zanatta's perjury seems to be a central feature of the CBUS change of attitude and much of its media statement relates to her stupidity.   That simply highlights the ineptitude, complicity or wilful blindness of the Responsible Persons at CBUS.   The evidence and facts in relation to Ms Zanatta were there to be found but CBUS failed to find them.   The investigative techniques used by the Royal Commission were all available to the CBUS investigative team given that CBUS paid for the courier, airline tickets and taxi trip which produced the evidence that sunk Zanatta - but even without that CBUS's preparedness to state there had been no leak in the face of overwhelming primary evidence of the leak was unforgivable.

For all its weasel words about the importance of its privacy and other Prudential obligations, CBUS was operated in such a way as to allow the leak to happen, to allow it to be covered up, to fail to adequately investigate it properly - and when the evidence finally became overwhelming, to take far too long to respond.

Here is CBUS's insufficient and tardy media statement.