The Victorian Information Commissioner's Office found the Department of Health did not protect individuals' personal health data during the COVID-19 pandemic in accordance with Victoria's Privacy and Data Protection Act. The regulator found a third-party call center contracted by the health department misused data on various occasions. The commissioner's office made four recommendations for future data management the health department welcomed and pledged to implement.