apologise to him for the incident.
Insights from agencies
“Make privacy and information security top priorities for your organisation. People need to have confidence that their personal information is protected.”
“Ensure that workers are getting training on how to respect people’s information, how to manage their data and how to prevent breaches.”
“Carry out spot audits on what information is being accessed, for what reasons and by whom.”
A freelance journalist revealed that files on Ministry of Social Development (MSD) computer servers could be accessed through Work and Income (WINZ) job seeker kiosks. The information he was able to access included the personal details of at-risk children.
The journalist published his discovery on a widely read blog explaining how he was able to access and download thousands of files stored on the agency’s server. He also contacted the Privacy Commissioner to hand over the documents.
MSD responded by closing all the kiosks around the country and ordering an urgent internal investigation into the data breach. It also had discussions with Privacy Commissioner and other stakeholders and issued the terms of reference for an independent review.
Deloitte were commissioned to undertake the external investigation and provided two reports.
The Phase I report focused on the circumstances and causes of the kiosk security breach and the Phase II report looked at whether the breach was symptomatic of governance, cultural and technical problems across the Ministry.
The Phase I report found three key issues:
• information security was not explicitly spelled out in MSD’s governance arrangements
The recommendations included:
• establishing one central point for managing information security
In response, MSD said it would recruit a chief information security officer to implement the Deloitte recommendations. The appointment would take responsibility for managing information security across the organisation.
Insights from agencies
“Develop a whole-organisation approach to privacy, one that values personal information and treats it with care. For example, privacy is not just the responsibility of an agency’s legal department because it also involves information technology, human resources and other areas.”
“Accountability structures need to be clear so top and senior management recognise that they are ultimately responsible for information breaches.”
“Where an information system is broken, shutting it down is a drastic resort but may work in some cases to stop a wider breach.”
- Destroy or securely delete sensitive information prior to re-use or disposal of equipment or media.
- Shred unwanted sensitive paper or photographic records and documents.
- Do not re-use paper records where the information could be exposed.
An amateur photographer broke into an abandoned building that had once been part of Sunnyside Hospital, a mental health institution in Christchurch. She found confidential records about former hospital patients. They included a 1989 duty diary which detailed deaths, suicides, assaults, escapes and patient treatment. The woman also found a number of patient information sheets containing bank account numbers, social security numbers and next of kin.
The photographer held on to the documents for some time and the Christchurch Press reported it in 2002, saying that confidential psychiatric records had been found in one of the abandoned hospital buildings. The newspaper did not reveal the identity of the finder or the exact building where the records came from.
An internal Canterbury DHB inquiry into the breach was initiated and the Privacy Commissioner and the Health and Disability Commissioner were informed.
The DHB demanded that the newspaper return the files. The general manager of mental health services apologised for the breach and reassured patients and their families that no patient files were among the documents returned by the newspaper. He also advised that the former hospital buildings should have been cleared of documents when it was closed in 2000.
Because the identity of the finder ha