fication to the Australian privacy authority.
A man found himself in a financial dispute with his sister. The sister worked for IRD and during the financial dispute, it became apparent to the man that she was accessing his IRD files. The man told IRD of his concerns and IRD agreed to investigate them.
The man's concerns were confirmed and he again brought this to IRD's attention. The man made a complaint to the Office of the Privacy Commissioner about the fact that IRD had let his sister access his files even though he had warned them that this might be happening.
Principle 5 of the Privacy Act provides that agencies must protect personal information by safeguards that are reasonable in the circumstances.
However principle 5 is not primarily concerned with individual instances of unauthorised access. Rather it focuses upon the overall systems in place to prevent such occurrences.
IRD said it had a stringent code of conduct designed to ensure that staff are aware that they may not access personal information for non-work reasons. Any breach was considered by IRD to be serious misconduct.
IRD advised that it took action but found that at the time the man initially raised his concerns, there was no evidence of unauthorised access. IRD made the decision that it was not necessary to restrict access to the man's files at that time. It said with a staff of over 5,000, it must rely on the integrity of its employees.
After the man raised his concerns again at a later date, IRD conducted a further investigation, found that the sister had accessed his files and therefore breached the code of conduct, and took disciplinary action against her.
The Privacy Commissioner formed the opinion that the general security safeguards IRD had in place were reasonable. This was a case in which a staff member decided to breach her workplace obligations and IRD's code of conduct.
But the Privacy Commissioner felt that IRD could have handled the man's concerns in a better way and IRD agreed to fully restrict access to the man's files and to apologise to him for the incident.
Insights from agencies
“Make privacy and information security top priorities for your organisation. People need to have confidence that their personal information is protected.”
“Ensure that workers are getting training on how to respect people’s information, how to manage their data and how to prevent breaches.”
“Carry out spot audits on what information is being accessed, for what reasons and by whom.”
A freelance journalist revealed that files on Ministry of Social Development (MSD) computer servers could be accessed through Work and Income (WINZ) job seeker kiosks. The information he was able to access included the personal details of at-risk children.
The journalist published his discovery on a widely read blog explaining how he was able to access and download thousands of files stored on the agency’s server. He also contacted the Privacy Commissioner to hand over the documents.
MSD responded by closing all the kiosks around the country and ordering an urgent internal investigation into the data breach. It also had discussions with Privacy Commissioner and other stakeholders and issued the terms of reference for an independent review.
Deloitte were commissioned to undertake the external investigation and provided two reports.
The Phase I report focused on the circumstances and causes of the kiosk security breach and the Phase II report looked at whether the breach was symptomatic of governance, cultural and technical problems across the Ministry.
The Phase I report found three key issues:
• information security was not explicitly spelled out in MSD’s governance arrangements
The recommendations included:
• establishing one central point for managing information security
In response, MSD said it would recruit a chief information security officer to implement the Deloitte recommendations. The appointment would take responsibility for managing information security across the organisation.
Insights from agencies
“Develop a whole-organisation approach to privacy, one that values 