d then destroyed the phone. It sent a message to all staff stressing that they must protect their customers' privacy by checking all phones and clearing all stored information. It also gave the daughter a new phone. The mother was satisfied with the steps that the retailer had taken to address her concerns.
Insights from agencies
“Prepare for and anticipate the likelihood of a breach. Encrypt information on portable storage devices to anticipate their accidental loss or deliberate theft.”
“Develop simple and easy to understand policies and guidelines about privacy.”
“Have a no surprises policy. Tell everyone who needs to know what has happened. The Prime Minister, relevant government ministers, heads of departments and other partner agencies may be annoyed if they find out about an issue through the news media and not directly from your agency.”
- Establish email procedures that involve double‐checking the address to ensure it is correct prior to sending. For example, external addresses might display in a different colour.
- For mass emails, double‐check that all emails are contained in the bcc section.
- Ensure staff members are aware what they can and cannot email.
- When including attachments, make sure it is the right one.
- Spreadsheets can contain a lot of information. Protect them using passwords. Remind people to make sure the right document has been attached. It is also important to check what other information is hidden behind spreadsheet document tabs and in pivot tables.
- Have a policy on emailing spreadsheets. Is it really necessary to send the information in a spreadsheet format? If so, get employees to check if the entire document needs to be sent or if there is a way of extracting only the relevant information intended for the recipient.
- Develop a secure fax procedure. Double check fax numbers prior to sending and use a fax cover sheet with a privacy warning and your contact information for a misdirected fax.
- Use pre‐entered numbers for routine faxes and ensure you are selecting the correct key prior to sending.
- Confirm the recipient fax machine is secure and confirm receipt of the fax.
A recruitment agency sent an email out to a number of its clients with each of the clients’ email addresses visible. One of the clients complained to the agency about how his email address could be seen and received an apology. But he did not consider that the apology was satisfactory and complained to the Privacy Commissioner.
Principle 11 of the Privacy Act states that an agency that holds personal information must not disclose that information unless one of the specified exceptions applies. In this case, the recruitment agency acknowledged that they had mistakenly revealed the man’s email address to a number of other people. The actions of the recruitment agency therefore constituted a breach of principle 11 of the Privacy Act.
The recruitment agency explained that the error had occurred as the ‘cc’ field had been used instead of the ‘bcc’ field and that it had been a one-off incident. They expressed their sincere apologies and stated that the mistake was unacceptable, given the nature of their business where confidentiality is important. They assured the Privacy Commissioner and the man that they had implemented processes to ensure that the mistake did not occur again.
The man accepted this further apology from the recruitment agency and the complaint file was closed.
A woman contacted a government agency seeking a registration form but in an email replying to her, an employee inadvertently sent her a spreadsheet attachment instead.
The spreadsheet contained the details of 1500 other applications for that particular registration dating back several years. The spreadsheet is sent to all of the agency’s call centre staff so if they receive a request for a progress update on their application, employees can inform them by referring to the document.
The document listed names and birth dates of people, but no address information or even general information about their location.
The woman who received the wrong inform