ey prior to sending.
- Confirm the recipient fax machine is secure and confirm receipt of the fax.
A recruitment agency sent an email out to a number of its clients with each of the clients’ email addresses visible. One of the clients complained to the agency about how his email address could be seen and received an apology. But he did not consider that the apology was satisfactory and complained to the Privacy Commissioner.
Principle 11 of the Privacy Act states that an agency that holds personal information must not disclose that information unless one of the specified exceptions applies. In this case, the recruitment agency acknowledged that they had mistakenly revealed the man’s email address to a number of other people. The actions of the recruitment agency therefore constituted a breach of principle 11 of the Privacy Act.
The recruitment agency explained that the error had occurred as the ‘cc’ field had been used instead of the ‘bcc’ field and that it had been a one-off incident. They expressed their sincere apologies and stated that the mistake was unacceptable, given the nature of their business where confidentiality is important. They assured the Privacy Commissioner and the man that they had implemented processes to ensure that the mistake did not occur again.
The man accepted this further apology from the recruitment agency and the complaint file was closed.
A woman contacted a government agency seeking a registration form but in an email replying to her, an employee inadvertently sent her a spreadsheet attachment instead.
The spreadsheet contained the details of 1500 other applications for that particular registration dating back several years. The spreadsheet is sent to all of the agency’s call centre staff so if they receive a request for a progress update on their application, employees can inform them by referring to the document.
The document listed names and birth dates of people, but no address information or even general information about their location.
The woman who received the wrong information called the agency to tell them what had happened. She assured a staff member that she had deleted the spreadsheet and all she wanted was a copy of the form she had requested.
An internal inquiry revealed that the first employee did not follow internal protocol when sending the request form and simply went to the ‘recent document’ tab in the database and right-clicked on the wrong form. The employee also did not check what they were sending before they sent the email.
The agency said the spreadsheet had been identified as a risk months earlier and it was only two weeks away from implementing a new system when the mistake happened.
The agency followed breach notification guidelines and decided not to notify the people whose information was on the spreadsheet. The reasoning was the individuals could not be clearly identified by the information and the recipient had deleted the document. Therefore there was no risk to them and contacting them could cause unnecessary concern.
The new electronic system that did not involve sending spreadsheets to call centre staff has since been put in place.
Insights from agencies
“Make sure you have a privacy officer in your agency who staff can contact to notify any suspicion or threat of a data breach.”
“Make changes to any processes and address any knowledge or skill gaps among staff that may result in a similar breach happening again.”
“Alert the privacy regulator and other relevant agencies. For example, if a doctor’s prescription fax is sent to the wrong fax number, the DHB, the pharmacy and the patient should be told. Programme the number in the fax machine to eliminate the chances of misdialling a number.”
- The website or business should be contacted and a request made to take the information down immediately.
- If a business or website does not comply with a takedown request, a complaint can be made to the Office of the Privacy Commissioner.
- Make sure you have a copy of the information before it is deleted from the website so you know who the affected people are.
- 