Migration complaint responses and AI data leakage: what a letter answering a client complaint gives away in ChatGPT or Claude.

A client disputes an invoice, and the practice has to answer in writing, accurately and without defensiveness. Staff reach for ChatGPT or Claude to make the letter calm and fair. The letter lists the hours billed, the estimate given, what went wrong and what the practice will credit, together with the client’s visa deadline and a request for her documents back. This page marks every item in a typical fee complaint response that the Code of Conduct and the Privacy Act bear on, and shows how the same letter is drafted on Ermos inside the practice.

The response to a client complaint about fees

Sent in reply to a written complaint from a client. Section 46 of the Code of Conduct says an agent charging by the hour must give an estimate and may not charge beyond it without exceptional circumstances, an updated written estimate and the client’s written agreement. A client with concerns about an agent’s conduct can lodge a complaint with the OMARA.

An invented letter. The client, the invoice number and the dates are invented, and the MARN is a placeholder. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

1. 1
   The client and her address

   Name and home address in the header. Personal information, and the key to everything else in the letter. Privacy Act guide.

2. 2
   The invoice and the credit

   An invoice number, the amount billed, the credit and the corrected total. Financial information about what the client paid and what the practice conceded.

3. 3
   The agreed rate and the estimate

   The hourly rate, the estimate and the date of the agreement. Section 46 requires an hourly rate to come with a reasonable estimate of the time, and the agreement cannot allow charging beyond it without the steps in section 46(4).

4. 4
   The practice’s admission

   That the practice did not obtain written agreement to the updated estimate and should have. Candid, damaging and sensitive for the practice. It is the kind of statement a regulator or a lawyer would want to read in the practice’s own words.

5. 5
   The file and document request

   That she asked for her file, her passport and her degree back and when they will be returned. Section 54 requires documents the client is entitled to be returned within 14 days of a written request. Privacy Act guide.

6. 6
   The state of her application

   That her expression of interest is lodged and a state invitation is pending. Immigration information about where her application stands. Privacy Act guide.

7. 7
   The right to complain to the OMARA

   A statement that she can complain to the regulator. Generic wording with no personal information.

8. 8
   The signatory

   A named agent and MARN. Ties the letter to a person bound by the Code of Conduct.

9. 9
   The visa deadline and her hope to settle

   The date her visa ends and what she told the practice about her priorities. Personal information about her circumstances. Privacy Act guide.

What happens in Frontier Models (ChatGPT, Claude)

• The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
• On consumer tiers, prompts can be retained and used to train future models.
• The provider’s staff and systems can reach the content under the provider’s own policies.
• Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Part of AI data leakage in migration practices.

Common questions