Correct. This is actually against the Privacy Act (PII distributed or stored outside of the borders by an entity holding Australian citizen data), so no doubt the AFP will be looking into this one.