An article from the New Zealand Herald by Adam Bennett
All government agencies' handling of private data may be reviewed after an independent inquiry into the ACC privacy breach found it could have happened in any department. The report by former Australian Privacy Commissioner Malcolm Crompton and accountancy firm KPMG examined what led to a spreadsheet containing details about 6748 clients being emailed to claimant and former National Party insider Bronwyn Pullar last year, and ACC's response when it learned of the breach in December. It concluded that the breach, which was disclosed to the public, senior management and ACC Minister Judith Collins only when Ms Pullar went to the media with the information in March, was down to "a genuine human error". However, "such an error was more likely to occur because of systemic weaknesses within ACC's culture, systems and processes". The report also found ACC's subsequent response process could have been better "if appropriate policies, practices, escalation protocols and the right culture were in place". It made a series of recommendations to improve privacy handling at the corporation. Acting ACC chairwoman Paula Rebstock said the corporation would be implementing the review's recommendations in full. Speaking to reporters, Mr Crompton said Ms Pullar had done the public "a service by making sure that we pay attention to the proper governance of personal information". "Most organisations should be taking great note of the fact that it could have been them." State Services Commissioner Ian Rennie said the report was "a dramatic reminder of the need for all government agencies to treat private information with the utmost care and respect". "To this end, I am considering that state sector chief executives review their systems for handling private information. Any stocktake would initially be targeted on areas of greatest potential risk." But Labour's ACC spokesman, Andrew Little, said he did not believe Mr Crompton's claim it was bad luck that the breach occurred at ACC rather than another department. "There is nowhere else in the Government where there has been the apparent sloppiness in the approach to managing that information as at ACC." Mr Little said the National Government on coming to power had painted a picture of an organisation in financial crisis that therefore needed to focus on cutting costs. "That is at least one explanation for the more cavalier attitude towards claimants, their issues and their privacy. I don't think the Government can disown responsibility for it having got to this point." Privacy Commissioner Marie Shroff, who commissioned yesterday's report, said it appeared ACC staff had been under pressure and "a failure in systems processes and perhaps leadership has led to them developing a somewhat cavalier attitude towards people's information and that needs to change". Mr Little called for Ms Collins to be replaced as ACC Minister to allow the culture change required. Ms Collins dismissed that call, and Mr Little, as "silly". A report by Auditor-General Lyn Provost into whether Ms Pullar gained any advantage in the way her claim was treated because of her connections with former board member John McCliskie, which was also released yesterday, found no evidence that was the case. But the report did raise concerns Mr McCliskie and then-chairman John Judge failed to recognise wider allegations of illegality and fraud at the corporation brought to their attention by Ms Pullar late last year.
A press release from KPMG by the Independent Review Team
A review of the Privacy and Security of Information at the Accident Compensation Corporation was released by the Office of the Privacy Commissioner and ACC’s Board today following a comprehensive review by an Independent Review Team comprising KPMG and Information Integrity Solutions Pty Limited. The review examined the circumstances relating to a major data breach involving the inadvertent release of personal details of 6,748 ACC clients, and the appropriateness and effectiveness of ACC’s privacy and security policies and practices. “Information is arguably the most critical asset in any organisation today. The challenge of protecting personal information has never been greater.” says Malcolm Crompton, former Australian Privacy Commissioner and Managing Director of Information Integrity Solutions Pty Limited. “While ACC has suffered a significant data breach, other organisations, both public and private, could face the same.” The Independent Review Team concluded that the breach that occurred was a genuine human error, but that such an error was more likely to occur because of systemic weaknesses within ACC’s culture, systems and processes. ACC’s subsequent response process could also have been better if appropriate policies, practices, escalation protocols and the right culture were in place to allow for transparency of breach handling at the appropriate levels, in an appropriate manner. The Recommendations of the Review Team are comprehensive:
ACC needs to put in place clear policies that create a positive privacy mindset as part of rebuilding customer trust and establishing a ‘firm but also seen as fair’ image in the minds of the public.
Strengthen Board governance of personal information management.
Strengthen privacy leadership and strategy.
Enhance its privacy programme.
Strengthen the organisational culture.
Strengthen privacy accountability.
Review and update business processes and systems.
Provide additional resources to clear backlogs on privacy related processes.
KPMG Partner Souella Cumming commented that “An organisation’s data needs to be protected by thorough and effective risk mitigation strategies to the same or higher levels as other vital assets. Without these strategies in place, the organisation is at risk of significant reputational damage.” Malcolm Crompton and Souella Cumming noted “We emphasise the significance of a culture and environment where personal information is valued. This must be supported by an approach to compliance with the privacy principles that is embedded within governance, leadership, business processes and systems.” This forms the basis of the recommendations in the report of the Independent Review Team.
An independent investigation into ACC, prompted by revelations of a mass privacy breach, is expected to condemn the corporation's culture and processes. A report due out today is expected to bolster widespread criticism of ACC's repeated breaches of thousands of its clients' privacy since the mass breach was exposed by The Dominion Post. It is also expected to criticise ACC's leadership, privacy systems and the corporation's technology for dealing with highly sensitive information. Fallout from the March privacy breach has included the resignations of Cabinet minister Nick Smith and ACC chief executive Ralph Stewart, and the departure from the corporation's board of chairman John Judge and directors John McCliskie and Rob Campbell. The report is being made public on the same day that another by the Auditor-General's Office, on how ACC manages risk at board level, is tabled in Parliament. Both investigations arose after an ACC client - later identified as Bronwyn Pullar - revealed she had been sent private details of 6500 fellow clients. The information contained names and details of hundreds of people from ACC's sensitive claims unit, including rape and incest victims. In the ensuing fallout, The Dominion Post revealed that ACC grossly misrepresented what happened at a crucial December meeting between Ms Pullar, her supporter Michelle Boag, and two senior ACC managers. In a report to ACC Minister Judith Collins, the corporation said Ms Pullar threatened at the meeting to go to the media and to withhold details of the mass breach unless she was given a two-year guaranteed benefit. The corporation laid a blackmail complaint with police. But a tape recording of the meeting, made by Ms Pullar and provided to ACC, made a mockery of the blackmail allegations. It showed no such threats or demands were made, and that Ms Pullar was already on weekly ACC compensation. After police were provided with a copy of the recording, they dismissed the complaint, saying no offence had been disclosed. Today's reports are not expected to end the scandal, as Ms Collins has taken defamation action against Labour MPs Trevor Mallard and Andrew Little for suggesting her office was involved in leaking an email identifying Ms Pullar as the whistleblower. The privacy report has been compiled by former Australian federal privacy commissioner Malcolm Crompton and accountancy firm KPMG. Ms Collins has seen the draft and has said she agrees with it. Ms Pullar and Ms Boag would not comment because they said they did not yet know what was in the final report.
An article from the New Zealand Herald by Adam Bennett
ACC's Bronwyn Pullar email blunder was at the lower end of breaches for the individual claimants affected, the Privacy Commission says. But one angry ACC client says the response minimises the distress caused by the breach. The woman's "sensitive claim" status - identifying her as a victim of rape or sexual abuse - was part of the information mistakenly emailed to Ms Pullar by an ACC manager last year. The ACC claimant complained to the Privacy Commissioner after the privacy breach involving 6700 claimants was reported in March. Yesterday, she received a response from assistant Privacy Commissioner Mike Flahive in which he noted the commission was investigating the breach and wider privacy issues at the corporation with the help of accounting firm KPMG and the former Australian Privacy Commissioner Malcolm Crompton. But later in the letter, Mr Flahive appears to pre-empt the investigation's finding which are not due until June or July. And while Ms Pullar reportedly described ACC's mistake in emailing her a spreadsheet containing the information about other claimants as New Zealand's "biggest-ever privacy breach", Mr Flahive didn't appear to agree. "The disclosure of the small amount of information about you, to essentially one other person, is at the lower end of the potential breaches that occur in any agency," he told the claimant. "The privacy breaches that are being investigated in this instance, while very concerning in an overall information handling context, involve the disclosure of mostly inoffensive information, albeit on a large scale." Mr Flahive also noted the commission was investigating possible breaches of the Privacy Act by Ms Pullar as well as ACC and he asked the claimant to identify which of those two parties she was complaining against. The claimant told the Herald she made the complaint because she was angry about what was the latest in a series of breaches of her privacy by ACC. She was upset by the commission's response to her complaint. "I just feel that they've really minimised it." She was not seeking compensation, but other claimants who contacted the Herald after the breach said they believed they should receive some. But Mr Flahive indicated in his letter to the claimant that compensation was unlikely. "Our experience is that in circumstances such as this data breach, it will be difficult for most subjects of the breach to show that they deserve substantial compensation." Labour's ACC spokesman, Andrew Little, said he was surprised by Mr Flahive's comments. While most of the claimants affected were probably due no more than an apology, he believed those who had sensitive claims should be entitled to more. "That is a massive breach of trust. They've been promised by ACC that sensitive claims information would be confined to a small group of specialist people and I think the privacy commissioner's simply wrong on that, and in understating the impact on those claimants of that breach."
Hon GERRY BROWNLEE (Acting Prime Minister): Yes.
Kevin Hague: Given his answers that no further independent inquiry was needed into matters to do with ACC and that the Prime Minister had conducted his own investigation, what was the nature of his private investigation, and what evidence did this investigation consider?
Hon GERRY BROWNLEE: The answer given on the previous day in the House was that the Prime Minister had considered this matter, along with Dr Nick Smith, in relation to the Cabinet Manual and the responsibilities of Ministers when it comes to conflicts of interest.
Kevin Hague: Did the Prime Minister’s private investigation ascertain whether his previous Minister, Nick Smith, had intervened in any other ACC claims besides Ms Pullar’s?
Hon GERRY BROWNLEE: On behalf of the Prime Minister, I cannot answer that question. What I can say is that the matter related to the former Minister’s handling of the case as it related to requirements in the Cabinet Manual. That was the Prime Minister’s primary investigation, and, ultimately, the Minister paid a very high price for the decision that they both agreed on.
Hon Trevor Mallard: I raise a point of order, Mr Speaker. I think you might have clicked at the point that I did—as the Minister said “On behalf of the Prime Minister,”. I think he might have meant that because he was answering on behalf of the Prime Minister, he could not answer the first part of the question. It is relatively important, because otherwise the Prime Minister is on record as saying that he did not look into, or he did not know about, the other private matters.
Mr SPEAKER: I appreciate the intervention from the member. If the Hon Gerry Brownlee wished to clarify that, he is welcome to do so, but he does not have to.
Hon GERRY BROWNLEE: For the sake of clarity, the second part of that question can be answered on the part of the Prime Minister, but I am not in a position to answer on the Prime Minister’s behalf on the first part of it.
Kevin Hague: Did the Prime Minister’s private investigation consider the 45-point list of serious legislation, guideline, and code breaches by ACC raised by Bronwyn Pullar?
Hon GERRY BROWNLEE: I am not able to answer that question on behalf of the Prime Minister.
Kevin Hague: Did the Prime Minister’s private investigation look into who had leaked Bronwyn Pullar’s name to the media, and whether this leak originated in a Government Minister’s office or from ACC itself?
Hon GERRY BROWNLEE: I raise a point of order, Mr Speaker. The member keeps referring to the Prime Minister’s private investigation. From the answers that were given relating to the primary question that is here today—answers given to all questions asked by that member in the House on 22 March—I think that is an interesting sort of leap for him to take. But in answer to the question, I am not able to answer that on behalf of the Prime Minister.
Mr SPEAKER: We have a slight difficulty there in that the Minister sought a point of order that was not really a point of order, because the member asked a question, and the Minister has now answered the question in so far as he says he is not able to answer the question. But the member is entitled to ask his questions. He made it clear in his first supplementary question that the Prime Minister had made reference to an investigation in his previous answers, and the member is entitled to ask questions. Whether the Minister can answer them is another matter, of course, while acting on behalf of the Prime Minister. But that was not an appropriate point of order.
Grant Robertson: Has the Prime Minister asked the Minister for ACC, as part of his investigation, who she believes leaked the information about Bronwyn Pullar to the media?
Hon GERRY BROWNLEE: No.
Kevin Hague: Did the Prime Minister’s private investigation determine when the ACC Chair, John Judge, first learnt about the massive breach of confidentiality that had occurred, the potential involvement of the then Minister, and the very serious claims Miss Pullar was making about failure of good process?
Hon GERRY BROWNLEE: There are a number of questions inside the member’s question that I think conflate a number of different points along the way in this particular story. What I can confirm is that investigations were made into the propriety of the reference written by Dr Smith. It did not meet the standards that were set and expected, and therefore the Minister has resigned.
Kevin Hague: Given his response to these questions today and the fact that neither the Privacy Commissioner’s inquiry nor the police inquiry can possibly consider any of them, will he not support calls for an independent investigation into these wider matters, or does he have another reason for trying to prevent these matters from being independently investigated?
Hon GERRY BROWNLEE: There is no attempt at all to hide anything in these cases, and I resent the member’s implication that that is what is happening.
2. GRANT ROBERTSON to the Minister for ACC: Does she have confidence in the Board of ACC?
Hon JUDITH COLLINS (Minister for ACC): Yes.
Grant Robertson: When she told the media this morning that only herself, one staff member, chairman John Judge, and the chief executive of the ACC had the information about Bronwyn Pullar, which of these people does she believe leaked that information to the media?
Hon JUDITH COLLINS: That is not correct. What I said was that Miss Boag sent the information to me and one staff member in my office. I did not send it to anyone else. My staff member sent it to the chief executive of ACC and the chairman of the board, as I requested her to. It was not sent anywhere else from my office.
Grant Robertson: Given that answer, does she believe that board chair John Judge leaked the information about Bronwyn Pullar?
Hon JUDITH COLLINS: I have asked Mr Judge, and he has denied the allegation.
Grant Robertson: Given her statement to the media that she has ruled out herself and her office as the source of the leak, will she rule out board chair John Judge or chief executive Ralph Stewart as the sources?
Hon JUDITH COLLINS: This information that was released to the media is information belonging to Miss Pullar and Miss Boag. If either of those people wishes to make a complaint to the Privacy Commissioner, then I would support them in doing that. It is not for me to speculate as to who released it. I am simply saying that I am 100 percent certain that it was neither me nor anyone in my office—100 percent certain; absolutely.
Grant Robertson: Does she accept that by ruling out herself and anyone in her office and saying that the email went only to John Judge and Ralph Stewart, she is implicating both of them in the leak?
Hon JUDITH COLLINS: No.
9. ANDREW LITTLE to the Minister for ACC: Which of the investigations now underway in ACC – the Malcolm Crompton-led investigation into privacy issues or the Police investigation into alleged blackmail – will deal with the disclosure of former ACC Minister Nick Smith’s letter regarding Bronwyn Pullar to the media?
Hon JUDITH COLLINS (Minister for ACC): I am not convinced that either investigation is likely to deal with the disclosure of this letter, as Dr Smith released the letter himself to the media following confirmation from Ms Pullar that she was happy for him to do so. However, if the Privacy Commissioner or the police wish to look into this, then that is a matter for them.
Andrew Little: How did a communication from former National Party president Michelle Boag about her involvement in Bronwyn Pullar’s case, and intended only for the Minister, get disclosed to the media, including social media?
Hon JUDITH COLLINS: That is a matter that I would like to know the answer to. However, any people who send me information about ACC can expect that I will send it straight to ACC. That is what a Minister does.
Andrew Little: Does she believe that it is appropriate for Ministers or their staff to disclose to the media, including social media, personal information held by departments, agencies, or Crown entities about people who criticise the Government?
Hon JUDITH COLLINS: Certainly not.
Andrew Little: What assurance can she give ACC claimants who are finding decisions on their claims frustrating and difficult that their concerns are being taken seriously by ACC, and that they too will not find their details leaked to the media, including social media?
Hon JUDITH COLLINS: I am very concerned about the privacy issues. That is why I asked for a report from ACC—I made sure that that was available for the public to see on the website a few days after the leaked emails—in terms of the information that Ms Pullar had, and she had put out to the Dominion Post. I was very concerned about that. That is why I am very much obliged to the Privacy Commissioner for the work that she is doing to, in fact, lead this inquiry into the privacy issues around ACC. I actually think it is extremely important that this issue be dealt with properly.
An article from the Sunday Star Times by Kirsty Johnson
Embattled insurer ACC has been caught out scrambling to shut down yet another privacy breach in the very week it has been forced to accept an audit into its handling of client files. The inquiry was commissioned by ACC and the Office of the Privacy Comissioner in the ongoing fallout after the Dominion Post revealed ACC sent whistleblower Bronwyn Pullar 6500 clients' private details, including the names of sexual abuse and violent crime victims. The saga also claimed the scalp of former ACC Minister Nick Smith who stood down from his cabinet portfolios after it was found he sent correspondence to ACC about Pullar - a friend of Smith and former National Party activist - without declaring a conflict of interest. The latest breach came about when ACC claimant Garth Paul asked to see his file - he had to make repeated requests to get the file as ACC sent only some documents. In the end, ACC sent him a file belonging to a different person. Paul advised ACC it had sent him another person's file, but did not reveal whose it was. He did however contact the man whose file was sent out. The Sunday Star-Times has spoken to that man. We are not naming him to protect his privacy. "I was so angry when I found out. But it's typical behaviour of ACC," he said. "I said to him [Garth Paul], hang on to it [the file], use it to show what they're like." He and Paul say ACC's systems are so bad the case managers cannot work out whose file they breached and have yet to contact the client to let him know his file was wrongly sent out and apologise. If it were not for Paul contacting him, he would be unaware of the error. He is grateful his file went to Paul who handled the matter sensitively. The botch-up and inability of ACC to determine whose file was sent and how backs up other claims of sloppy practices. Dunedin ACC client Bruce Van Essen has had an ongoing battle over breaches of his privacy. He says the ACC computer storage of clients' confidential medical records is so primitive the records can be viewed by virtually every employee from a mailroom assistant up. Van Essen found his ACC files had been accessed 2800 times since 2006 - a figure he said could not be justified by everyday claims management. Pullar said her file had been accessed 2000 times over three-and-a-half years by a total of 137 people. On Thursday ACC chief executive Ralph Stewart and the Office of the Privacy Commissioner Marie Shroff announced audit firm KPMG and Malcolm Crompton, a former Australian federal privacy commissioner, would probe the Pullar privacy breach. The Sunday Star-Times found the privacy commissioner received 61 privacy complaints about ACC in the last year. Of those, 15 were found to have substance and were subsequently settled. One has been referred to the director of Human Rights Proceedings, who will decide if it will go to a tribunal hearing. The figures show ACC privacy concerns are endemic. There were 57 complaints to the commissioner in 2009/10 and 43 in 2008-09. "I think this kind of thing happens a lot more than we know," said counsellor and ACC advocate Ian Brown, whose clients include Garth Paul. Brown said that even as officials scrambled last week to resolve the fall-out from the Pullar breach, managers from a Christchurch ACC office were making endless calls to Paul, to try to retrieve the file sent to him in error. Just before Paul went public with the privacy breach, ACC manager John Doidge sent him a letter on Monday, March 19, telling him to return the file within 24 hours. ACC refused to comment on the latest breach, with the board chairman and chief executive citing the pending inquiry as preventing them from discussing breaches or privacy issues. The inquiry is expected to take three months, which means the ACC position on comment blunts discussion of privacy breaches that surface in the meantime. ACC's initial response when Pullar's claims were made public was to issue a report to new ACC Minister Judith Collins - without speaking further to Pullar - and to allege she tried to blackmail ACC over return of the files. It then said it had referred the matter to police. Pullar denied any blackmail attempt and said ACC was trying to defame her. Brown said receiving another person's file was not the only evidence Paul had of privacy breaches. ACC had also allegedly contacted his mother about his case without permission, which backs Pullar's claims of the treatment meted out to her. Brown said Paul had been treated appallingly by ACC. He claimed staff weren't interested in rehabilitation, people, or their privacy. "In her criticisms of ACC, I don't think [Pullar] was being over-the-top, I think she was being gentle. As one of my clients has told me, if he was a dog, the SPCA would have been prosecuted over his care."
There has been an embarrassing revelation by the State Services Commission following ONE News' inquiries into the ACC privacy breach. ACC claimant and National Party figure Bronwyn Pullar was inadvertently sent an email from an ACC employee which contained the private details of 6700 ACC claimants, including victims of sexual abuse and other violent crime. The commission has now confirmed Pullar sent it a copy of the spreadsheet containing confidential client details six months ago, meaning ACC should have been alerted to the breach before it met Pullar in December. The commission made the discovery while re-checking emails after calls from ONE News. It says it has now deleted the information.
Expert to probe leak Meanwhile, it has been announced global auditing group KPMG and former Australian Privacy Commissioner Malcolm Crompton have been called in to investigate the leak. The large data breach has "raised a number of concerning questions", NZ's Privacy Commissioner Marie Shroff said.
View the terms of reference for the investigation here
Schroff said the inquiry will look into both the leak and possible "systemic or organisational weaknesses" in how personal information is handled by ACC. The findings will be reported to the ACC Board and to the Privacy Commissioner. Individual privacy complaints about the data breach will be handled by the Privacy Commissioner complaints investigation process. The final report is expected to be completed and made public by the end of June. Meanwhile, the Auditor-General is also considering whether to hold an independent inquiry into ACC after requests from the Opposition, with a decision expected by Easter. Green MP Kevin Hague has called for a separate inquiry into the actions of former ACC minister Nick Smith, who resigned from the Cabinet after admitting it emerged he wrote letter in support of Pullar's ACC claim. Smith has said he would welcome such an inquiry, but Prime Minister John Key has ruled it out. The Auditor-General's office said in a statement it expected to make a decision on whether to hold an inquiry by Easter, but warned any investigation would involve a significant investment of time and public money. "We need to make sure we understand the issues, the work being done by other agencies, and what value we could add before we make a decision," the statement said. Hague and Labour MP Andrew Little lodged the requests for an Auditor-General inquiry and have called for a quick decision, saying there is a need for urgency. Little said he hopes to meet with the Auditor-General next week to talk about the scope of the potential inquiry.
Privacy Commissioner, Marie Shroff said today that the Office of the Privacy Commissioner, in conjunction with the ACC Board, has commissioned an independent inquiry and approved the terms of reference into the recent privacy incident at ACC. KPMG, and privacy expert Malcolm Crompton, former Australian Federal Privacy Commissioner, have been appointed to conduct the inquiry. "I am pleased to see the terms of reference finalised,” Marie Shroff said. “This was a large data breach where a spreadsheet containing information about thousands of claims has been emailed to an ACC claimant. It has raised a number of concerning questions. "The inquiry will look into the circumstances surrounding this particular incident. The inquiry will also look more widely at whether systemic or organisational weaknesses exist in the way personal information is handled by ACC. Ms Shroff said that her office was involved in finalising the terms of reference and also in suggesting former Australian Federal Privacy Commissioner, Malcolm Crompton, as an expert independent reviewer. "We will be kept informed of progress of the review and will await the results and recommendations with interest," said Ms Shroff. The review team will report their findings to the ACC Board and to the Privacy Commissioner. Individual privacy complaints about the data breach will be handled as usual by the Privacy Commissioner complaints investigation process. The terms of reference for the review can be downloaded below or found at www.acc.co.nz.
An Australian expert has been called in to investigate a privacy breach that saw thousands of ACC files sent to the wrong person. ACC chief executive Ralph Stewart said Malcolm Crompton, who worked at KPMG and was a former Australian Federal Privacy Commissioner, would conduct the inquiry and report back within three months. The inquiry was commissioned by ACC and the Office of the Privacy Commissioner after the details were accidentally emailed out to one claimant. In the fall out from the mistake, former ACC Minister Nick Smith stood down from his portfolios after it was found he sent correspondence to the woman involved without declaring a conflict of interest. The two were friends. The inquiry will focus on the circumstances regarding the release of the private information and whether organisational weaknesses exist in the way ACC handles personal information. Stewart said the report from Crompton would be made public. Privacy Commissioner Marie Shroff said individual privacy complaints would be handled as usual by the Privacy Commissioner complaints investigation process. The breach of thousands of peoples' information had raised a number of concerning questions, she said. "This was a large data breach where a spreadsheet containing information about thousands of claims has been emailed to an ACC claimant." The Commission would be kept informed of progress throughout the inquiry, she said. The inquiry will look into the release of personal information in August last year, it will not look into Smith's advocating for Bronwyn Pullar who received the emails. It will look at the circumstances surrounding the breach and determine whether ACC's policies in relation to security are appropriate and efficient. The inquiry team will also conduct an assessment of ACC's policies, processes, culture and practices to manage client information.
An article from the New Zealand Herald by Audrey Young
The Office of the Privacy Commissioner and the ACC Board have jointly commissioned an inquiry into the privacy breach in which information about more than 6000 claims was emailed to ACC claimant Bronwyn Pullar. KPMG and Integrity Solutions Pty Ltd (IIS) led by former Australian Federal Privacy Commissioner Malcolm Crompton have been commissioned to conduct the inquiry. New Zealand Privacy Commissioner Marie Shroff said the inquiry would look into the circumstances surrounding the particular incident. "The inquiry will also look more widely at whether systemic or organisations weaknesses exist in the way personal information is handled by ACC." The privacy breach occurred in August last year. Bronwyn Pullar and her advocate Michelle Boag, a former National Party president, met with ACC senior manager Philip Murch in December last year to discuss it and the breach was publicised last week. Former ACC minister Nick Smith resigned from cabinet this week after the Herald revealed he had written a reference for Ms Pullar last year and personally handled a complaint about her case in 2010. Dr Smith's involvement in the case is not part of the newly announced inquiry. The Office of the Privacy Commissioner has been involved in finalising the terms of reference and suggesting Mr Crompton for the role as an expert independent reviewer. Individual privacy complaint about the data breach will be handled as usual by the Privacy Commissioner complaints investigation process, Mrs Shroff said. The inquiry will commence on March 28 and is estimated to take three months. The review team will report its findings to the ACC Board and the Privacy Commissioner and its findings will be made public. ACC has also referred the matter to the police. Mrs Shroff issued her statement at the same time as the ACC issued its statement on the inquiry.
Ralph Stewart, ACC’s Chief Executive, announced today the Office of the Privacy Commissioner in conjunction with the ACC Board has commissioned an independent inquiry and approved the terms of reference into the recent privacy incident at ACC. KPMG and privacy expert Malcolm Crompton, former Australian Federal Privacy Commissioner, have been appointed to conduct the inquiry. The inquiry will look into the circumstances surrounding this particular incident. The inquiry will also look more widely at whether organisational weaknesses exist in the way personal information is handled by ACC. The review will commence on Wednesday 28 March 2012, and the final report is expected to be completed within three months. The report will be made public. The terms of reference for the review can be found at www.acc.co.nz and www.privacy.org.nz.
