The Office of the Australian Information Commission has found that Multicard failed to take reasonable steps to ensure that 9,000 applicant details would not be publicly exposed online.