The Auditor-General has raised concerns about the confidentiality of details given to private debt collection agencies who chase people owing money to Centrelink.
A report from the Australian National Audit Office shows Centrelink is paying commissions worth $8 million a year to the agencies for their work.
The Department of Human Services, which oversees Centrelink, appears to be getting value for its money, with the agencies increasing the success rate of their recovery.
However the audit said the department was considering "alternative future models" for debt recovery.
The department delivers $150 billion in payments each year and recovers about $1.1 billion each year in debts due to overpayments.
Private debt collection agencies brought in $114 million – about 10 per cent – of the overpayments clawed back in 2011-12.
Debts occur through overpayment of Newstart or other allowances when people do not notify the department about changes in their circumstances.
However, debts cannot be recovered by putting people into severe financial hardship.
The cost of recovering Centrelink debts in 2011-12 was estimated at almost $30 million.
"While the number of Centrelink payment debts raised annually has declined in recent years (from 2.2 million to 1.8 million), the value of the debts recovered annually has remained at the same level ($1.1 billion)," the audit said.
It said the department's administration of the agencies' contracts to recover debt was generally effective.
However it found the department had not conducted formal audits of the agencies' compliance with requirements in contracts to protect customer information.
The single recommendation from the audit refers to confidentiality.
"The ANAO recommends that the Department of Human Services periodically verify compliance with the IT, physical and personnel security requirements contained in the current contracts with external collection agencies, to gain assurance that DHS [Department of Human Services] customer information is being managed securely," it said.
The department agreed with the finding and said it was committed to the introduction of security audits, consistent with the contractor's responsibilities, for the protection of information.
"This added compliance measure will increase confidence that debtor information, passed to the external collection agencies for the purpose of debt recovery, is secure and debtor's privacy and confidentiality is being risk managed appropriately," the department told the audit office.
The department has two external debt collection agencies – Dun & Bradstreet and Recoveries Corporation.
"While it is not possible to provide a final contract value, in 2012-13, DHS [Department of Human Services] raised initial purchase orders for a total of $8 million (GST exclusive) to cover the expected ECA [external collection agencies] commissions," the audit said.
"While the amount recovered by DHS in the previous two years has remained the same at $1.1 billion, the ECAs' contribution to the total amount has almost doubled since 2009-10, when it was $60.8 million or 5.5 per cent."
The recovery activity by the agencies generated a quarter of all complaints about debt recovery.