The privacy risks of public fax machines in Australia

A fax machine on a public library counter can look as mundane as a photocopier, yet it may be asked to carry contracts, medical referrals, identity documents or a signed letter never meant for a stranger. Public libraries in Sydney, Melbourne, Brisbane, Canberra and many regional centres still provide copying, scanning and, at selected branches, fax services. Availability, fees and security arrangements differ by council and location, but the shared-machine setting is common wherever the service remains.

Fax is not simply a relic. Australian conveyancers, medical practices, insurers, real-estate offices and community organisations still exchange documents through established fax workflows, sometimes because the receiving party will not accept an emailed attachment. A familiar service can seem safer than creating a new portal, particularly for an older client or someone without reliable home internet.

That does not make fax inherently private. A transmission travels through a telephone or IP network, passes through the receiving organisation’s equipment and can be printed, copied, stored or diverted along the way. A library fax adds another layer: the sender has little direct control over who can see the pages before or after transmission, or over how the machine stores and deletes them.

Australian privacy law is a patchwork rather than one universal rule. The Commonwealth Privacy Act 1988 and the Australian Privacy Principles apply to many covered organisations, while public libraries are generally governed by the privacy and records laws of their state or territory. Some organisations rely on the small-business exception, but that exception is limited, and state health, information-privacy or records rules may still matter. The practical concern is simpler: reasonable precautions can prevent avoidable disclosure.

Why libraries still provide fax services

Fax remains useful when a document must arrive as a fixed image, when the sender wants a transmission confirmation, or when a recipient’s process requires a number rather than an email address. Those features explain why libraries offer the service to people who do not own a fax machine. A private business centre or telecommunications provider can perform the same task, but it may cost more and be less convenient.

In Australia, the typical fax customer is not necessarily a large company. A sole trader may send an invoice to a supplier, a family may send paperwork to a solicitor, or a patient may send a referral requested by a specialist. Regional users may value a public branch because travel to another town is costly and some organisations have uneven digital systems. To “send it through” can mean using a legally recognised, familiar channel in ordinary Australian office speech.

Libraries also occupy a useful civic position. They provide a neutral place to complete a transaction without buying equipment, and staff may already offer printing and scanning. Yet familiarity does not turn a counter machine into a private terminal. The branch may be open to students, job seekers, visitors and people waiting for appointments, all using the same aisle and output trays. An ordinary task can therefore carry a risk that is easy to overlook.

Exposure around a shared machine

The first exposure is visual. Pages waiting in the output tray can be read by anyone nearby, and a cover sheet may reveal names, addresses, telephone numbers or the nature of the document. A fax used for a tenancy application could expose financial or identity information; a page from a legal file could expose a party’s name before a court deadline. People often focus on the electronic journey and forget the paper sitting two metres away.

The second exposure is technical. Depending on the model, a multifunction device may retain a recent-job image in memory, a thumbnail on its control panel, a print-server queue or a deleted file that has not been overwritten. “Deleted” does not always mean unrecoverable. A public device may also be linked to a managed print network controlled by the council rather than the person standing at it. A successful send does not establish that every local trace has been erased.

Physical waste creates another gap. A failed page, duplicate or spoiled draft may be left beside the machine, pushed into a communal bin or collected during cleaning. Shredding bins reduce that risk but cannot protect a document while it lies face-up on the counter. The placement of the machine, its distance from other printers and whether staff promptly retrieve incoming faxes all affect the privacy of the service. The danger is often a series of small lapses rather than a dramatic breach.

Misdialing and unattended pages

A fax confirms that two machines handshake; it does not verify that the person named on the cover sheet received the page. An old number may have been disconnected or reassigned, while a single-digit error can send a document to an unrelated organisation. Many Australian offices use central reception numbers rather than direct lines, especially in law practices, clinics, council departments and regional agencies, so a correctly dialled number may still lead to a shared tray.

The receiving side deserves equal attention. A clinic may print referrals with other patients’ documents, a legal office may file correspondence by name, and a mailroom may leave every item on a bench until someone sorts it. Marking a page “Private” or “Confidential” may prompt careful handling, but it does not create a lock, authenticate a recipient or prevent a busy worker from placing it in the wrong folder. A sender who never rings to say a sensitive fax has arrived adds another failure point.

Scam callers can also exploit the expectation of a legitimate fax. They may impersonate a government office, insurer or service provider and ask for personal details, payment or a “verification” document. A genuine organisation can be identified through an independently sourced phone number rather than one supplied in an email or text. Australian Competition and Consumer Commission Scamwatch guidance is relevant because urgency is a technique: a request that prevents supposedly unlawful disclosure is precisely when the sender should slow down.

Access, retention and legal boundaries

Library staff need access to a fax machine to assist users and maintain the service, but routine assistance should not require them to read a document’s substance. A counter procedure can direct a sender to the tray, retrieve incoming pages and remove failed printouts. It cannot prove that nobody glanced at an image. Users needing confidentiality should ask in advance what the branch does with incoming and outgoing jobs, not after the pages have been exposed.

Service providers may retain more than a transmission receipt. Logs can include the dialled number, time, duration, page count, status and an image of the sent page. Depending on the arrangement, a library machine may report to a commercial fax network or print-management platform, giving its administrator access to job metadata and potentially document images. Retention periods can outlive the reason for sending, particularly where records support billing, troubleshooting or dispute resolution.

Digital records can also acquire legal significance later. The point is illustrated by wearable evidence in court: an ordinary record of activity may become consequential when it is preserved, submitted and interpreted. A fax image can similarly enter a court file, medical record or administrative archive. Before sending, the sender should ask whether the recipient will retain it and what the applicable record-keeping rules mean.

Cloud fax and the wider supply chain

Many Australian businesses now use e-fax or cloud fax rather than a physical line. The document is scanned and delivered to an email inbox, hosted inbox or messaging account; another design uses a platform that receives the fax and lets the customer download it. This can improve convenience and create a searchable record, but it adds accounts, administrators, support staff and subprocessors. Email may pass through several infrastructure providers, while a hosted inbox can expose documents through weak authentication or excessive permissions.

Search results can mix document providers with affiliate publishing. A blackjack and baccarat comparison may appear beside a fax vendor simply because both monetise online attention; neither polished prose nor search ranking verifies legal identity. The useful checks are the operator’s identity, Australian privacy policy, terms, data location, breach-notification process and contract with any library or council. A familiar logo does not establish that a fax will remain in Australia or be deleted promptly.

Cross-border processing deserves attention without requiring alarmism. A provider may serve Australian customers while using overseas hosting, support teams or email infrastructure. Under the Australian Privacy Principles, certain covered organisations must account for disclosures outside Australia, but that depends on the organisation’s coverage and provider chain. A private individual using a public service has fewer contractual protections than a large company with legal review. Reading the actual data flow is more informative than assuming that “cloud” means either secure or offshore.

A safer sending routine

Start by deciding whether the document truly needs to travel by fax. A recipient-controlled portal, encrypted file-sharing service with an expiry date, or secure delivery to a nominated professional may fit the task better. For an informal copy containing no sensitive data, the risk is lower; for a medical record, court document, identity application or financial statement, the sender should use a channel they control or a private business centre rather than a shared library terminal.

If library fax is necessary, independently verify the destination. Use a number published on the recipient’s official website, a verified invoice, a current card or a directory, then ring the receiving office to confirm both the number and the person who will collect it. Avoid a number found only in an old email, advertisement or untested document. Ask whether the recipient has a dedicated incoming tray and whether someone will retrieve the pages immediately. “Confidential” on the cover sheet is supplementary, not a substitute.

Prepare only the necessary pages and keep the cover sheet free of unnecessary detail. Some recipients need a sender’s identity and return number, but the cover should not expose the sensitive subject matter. Number the pages, keep a clean duplicate and remove spoiled or duplicate pages. Stay close to the machine until transmission finishes, collect every printed page and check the tray before leaving. A successful transmission report proves connection, not confidentiality, so it is no reason to abandon the original.

The safest practical takeaway is to use a public library fax only for low-sensitivity material or when no better channel is available, verify the recipient before sending, and use a service you control for sensitive documents.