ation called the agency to tell them what had happened. She assured a staff member that she had deleted the spreadsheet and all she wanted was a copy of the form she had requested.
An internal inquiry revealed that the first employee did not follow internal protocol when sending the request form and simply went to the ‘recent document’ tab in the database and right-clicked on the wrong form. The employee also did not check what they were sending before they sent the email.
The agency said the spreadsheet had been identified as a risk months earlier and it was only two weeks away from implementing a new system when the mistake happened.
The agency followed breach notification guidelines and decided not to notify the people whose information was on the spreadsheet. The reasoning was the individuals could not be clearly identified by the information and the recipient had deleted the document. Therefore there was no risk to them and contacting them could cause unnecessary concern.
The new electronic system that did not involve sending spreadsheets to call centre staff has since been put in place.
Insights from agencies
“Make sure you have a privacy officer in your agency who staff can contact to notify any suspicion or threat of a data breach.”
“Make changes to any processes and address any knowledge or skill gaps among staff that may result in a similar breach happening again.”
“Alert the privacy regulator and other relevant agencies. For example, if a doctor’s prescription fax is sent to the wrong fax number, the DHB, the pharmacy and the patient should be told. Programme the number in the fax machine to eliminate the chances of misdialling a number.”
- The website or business should be contacted and a request made to take the information down immediately.
- If a business or website does not comply with a takedown request, a complaint can be made to the Office of the Privacy Commissioner.
- Make sure you have a copy of the information before it is deleted from the website so you know who the affected people are.
- Identify how the material managed to end up being published on the website.
A mother enrolled her daughter in a school holiday programme run by a regional sports trust. When filling out the enrolment form, the mother ticked 'No' to the question whether she gave permission for her daughter's name, photo and/or video to be published in programme newsletters or used for publicity.
A local newspaper published a photograph of the daughter and three other children. The photograph named the children and identified them as participants in the holiday programme. It stated where the programme was held. The mother complained that her daughter's privacy had been breached.
The complaint raised issues under principle 11 of the Privacy Act. This principle provides in part that an agency that holds personal information about an individual shall not disclose that information unless the agency believes, on reasonable grounds, that one of the exceptions to principle 11 applies.
The Trust did not seek to rely on any of the exceptions to principle 11 and in the view of the Privacy Commissioner, none of those exceptions applied. Accordingly, the Trust was found to have breached principle 11 by publishing the daughter's photograph.
In order to find an interference with privacy, the Privacy Commissioner must be satisfied that there has been a breach of a privacy principle and the breach has caused the individual some harm, loss or detriment as set out in section 66 of the Act.
The mother advised that she and her daughter had in the past been harassed by the mother's former partner. She had contacted Police who had advised the mother that no information should be disclosed to the former partner that would enable him to have access to the family. The daughter also explained that since her photograph had been published, she no longer felt safe.
The Privacy Commissioner was satisfied the daughter had suffered harm of the type and extent required by section 66. It was clear that the publication of the daughter's name, photograph and location