The Swamp Report

24 August 2012

Knee-jerk privacy measures put ACC staff under more stress

A press release from the Public Service Association

The Public Service Association says ACC has introduced a range of knee-jerk processes around privacy which are only serving to put staff under more pressure.
An independent report into privacy breaches has blamed systematic weaknesses and says a culture change is needed from the top down.
“Frontline ACC staff have been working in a high pressure environment due to cost-saving driven restructuring. They are the ones dealing with the fallout from poor management and privacy breaches which happened at much higher levels of the organisation,” says PSA National Secretary Richard Wagstaff.
“What they are currently facing is a kneejerk response from ACC which will do nothing to change the top down culture outlined in the report.”
ACC staff are reporting that a range of new checks and procedures have been introduced which they were not consulted about and which are having an almost unmanageable effect on their workloads and ultimately their service to clients.
“In its haste to clamp down on privacy breaches ACC is not giving frontline staff the support they need and is transferring a culture of fear down through the organisation,” Richard Wagstaff says.
The PSA says it is good to see the independent report into the privacy breaches acknowledging the need for strong leadership, clear policy and more support for staff.
“ACC should use it as a turning point to make meaningful change throughout the organisation. Staff want to ensure that everything is done to protect client privacy and rebuild public confidence in ACC. They want to be part of the solutions,” Mr Wagstaff says.

http://www.scoop.co.nz/stories/PO1208/S00383/knee-jerk-privacy-measures-put-acc-staff-under-more-stress.htm

Claimants shouldn’t be forgotten in ACC fallout

A press release from the Labour Party by Andrew Little

ACC must take the concerns of sensitive claims unit claimants seriously, and set up a high level unit to deal with the outstanding complaints around breaches of privacy and misuse of information, Labour’s ACC spokesperson Andrew Little says.
Two independent reports yesterday highlighted the "cavalier" nature of information management and called for a change in culture within the Corporation.
"While the work of the two review teams will be helpful in moving to a healthier culture at ACC, it is still surprising little was said by either review team about the fate of nearly 200 sensitive claims unit claimants who had some of their details released in the mass privacy breach that was the subject of the investigation.
"The Privacy Commissioner's review treated the SCU claimants too lightly when it implied not much identifying information was disclosed, but the report shows there was an identifying code for the issues under appeal, so unauthorized ACC staff would know exactly what those claims were about.
"A couple of months ago Labour called for a high level independent review team to be set up straight away to deal with all existing complaints about misuse of information.
"If ACC and Judith Collins are serious about restoring confidence, then this is an initiative that could go a long way to doing so as well as exorcising some difficult demons that will only hold the Corporation back if they are not dealt with.
"ACC really needs to accept that an entirely new approach is required. All of the difficult files of recent years need to be reviewed with a fresh pair of eyes so everyone can move on with the confidence that they have been treated fairly,” said Andrew Little.

http://www.scoop.co.nz/stories/PA1208/S00370/claimants-shouldnt-be-forgotten-in-acc-fallout.htm

Privacy breach a warning for others

An article from the Nelson Mail by Laura Basham

In a chilling revelation, an inquiry into the case of ACC emailing sensitive details about more than 6000 claimants to the wrong person reveals it could have happened to any big government agency.
A spreadsheet containing details of the 6000-plus claimants - including more than 200 handled by the ACC's sensitive claims unit dealing with rape and sexual abuse victims - was emailed to Auckland woman Bronwyn Pullar after an ACC staffer mistakenly clicked on it and sent it as an attachment without noticing.
An inquiry yesterday found simple human error was to blame for the breach, which has so far claimed the scalps of a government minister, the chairman and chief executive of ACC and could yet claim further victims as the hunt continues for the person who leaked an email from Pullar support person, former National Party president Michelle Boag, to ACC Minister Judith Collins.
Former ACC minister and Nelson MP Nick Smith said today he was pleased that the reports concluded that Ms Pullar did not receive any extra entitlements or benefits as a consequence of her friendship with him or that she was known through the pipfruit industry and to former ACC director John McCliskie. The inquiries were initiated out of allegations that because Ms Pullar had been involved with the National Party, she had received entitlements, he said.
"These reports show that is not true and that both myself and the board were very clear Bronwyn Pullar should not be treated in any way differently from any other claimant," said Dr Smith.
However, he said he still regretted writing the letter attesting to Ms Pullar's health prior to her accident, that ultimately triggered his resignation from his ministerial portfolios in March.
Dr Smith also noted that the system issue that led to the accidental email of a large file of client information could happen to other government agencies, and said there needed to be a broader review of systems to ensure that did not happen.
The release of the reports concludes the investigations on the ACC issues, but Dr Smith would not be drawn on the issue of his potential return to Cabinet, saying it was up to Prime Minister John Key. "We'll just have to see how it goes."
The report released yesterday remains silent on whether ACC was justified in going to police over claims that Ms Pullar tried to use the data breach to guarantee her benefit for two years - despite four members of the independent review team listening to a tape recording of the meeting where the blackmail threat was alleged to have been made. Police later tossed out the complaint because of a lack of evidence but ACC has so far refused to apologise to Ms Pullar over the claim.
The head of the review team, former Australian privacy commissioner Malcolm Crompton, said the blackmail allegation was outside the inquiry's terms of reference.
The inquiry, commissioned by the Privacy Commissioner and ACC, was one of two reports released yesterday into the mass privacy breach. The second was by Auditor General Lyn Provost. Both reports call for a culture change at ACC, which acting chairwoman Paula Rebstock promised yesterday would occur after the privacy breach raised "profound questions about our management of private information".
Privacy Commissioner Marie Shroff said the breach threw the spotlight on the use of personal information by government agencies.
"Public sector agencies collect information from us on a very large scale, often by compulsion, in a situation where we really have no alternative but to provide it. The information is held these days in vast electronic databases. That information is the necessary lifeblood of those agencies and a major business asset for those agencies. But the bargain for us, the citizens, the clients, is we need to be able to trust those agencies to protect our information and not to misuse it or lose it."
Both reports released yesterday raise questions not just about the privacy breach, but also over the treatment received by Ms Pullar, who was a former high-flying business woman and moved in National Party circles. Mrs Provost found Ms Pullar received special treatment after she approached a former business associate, Mr McCliskie, who was on the ACC board, over her case and he set up a meeting with senior managers.
"Although meetings with such senior ACC officials are not without precedent, few claimants have that opportunity," she noted.

ACC privacy report may lead to wider overhaul

An article from the New Zealand Herald by Adam Bennett

All government agencies' handling of private data may be reviewed after an independent inquiry into the ACC privacy breach found it could have happened in any department.
The report by former Australian Privacy Commissioner Malcolm Crompton and accountancy firm KPMG examined what led to a spreadsheet containing details about 6748 clients being emailed to claimant and former National Party insider Bronwyn Pullar last year, and ACC's response when it learned of the breach in December.
It concluded that the breach, which was disclosed to the public, senior management and ACC Minister Judith Collins only when Ms Pullar went to the media with the information in March, was down to "a genuine human error".
However, "such an error was more likely to occur because of systemic weaknesses within ACC's culture, systems and processes".
The report also found ACC's subsequent response process could have been better "if appropriate policies, practices, escalation protocols and the right culture were in place".
It made a series of recommendations to improve privacy handling at the corporation.
Acting ACC chairwoman Paula Rebstock said the corporation would be implementing the review's recommendations in full.
Speaking to reporters, Mr Crompton said Ms Pullar had done the public "a service by making sure that we pay attention to the proper governance of personal information".
"Most organisations should be taking great note of the fact that it could have been them."
State Services Commissioner Ian Rennie said the report was "a dramatic reminder of the need for all government agencies to treat private information with the utmost care and respect".
"To this end, I am considering that state sector chief executives review their systems for handling private information. Any stocktake would initially be targeted on areas of greatest potential risk."
But Labour's ACC spokesman, Andrew Little, said he did not believe Mr Crompton's claim it was bad luck that the breach occurred at ACC rather than another department.
"There is nowhere else in the Government where there has been the apparent sloppiness in the approach to managing that information as at ACC."
Mr Little said the National Government on coming to power had painted a picture of an organisation in financial crisis that therefore needed to focus on cutting costs.
"That is at least one explanation for the more cavalier attitude towards claimants, their issues and their privacy. I don't think the Government can disown responsibility for it having got to this point."
Privacy Commissioner Marie Shroff, who commissioned yesterday's report, said it appeared ACC staff had been under pressure and "a failure in systems processes and perhaps leadership has led to them developing a somewhat cavalier attitude towards people's information and that needs to change".
Mr Little called for Ms Collins to be replaced as ACC Minister to allow the culture change required. Ms Collins dismissed that call, and Mr Little, as "silly".
A report by Auditor-General Lyn Provost into whether Ms Pullar gained any advantage in the way her claim was treated because of her connections with former board member John McCliskie, which was also released yesterday, found no evidence that was the case.
But the report did raise concerns Mr McCliskie and then-chairman John Judge failed to recognise wider allegations of illegality and fraud at the corporation brought to their attention by Ms Pullar late last year.

ACC victims still bruised by privacy breaches

A report from Radio New Zealand National

In the wake of a critical report into ACC's culture and privacy failings, victims of its substandard processes feel let down by the corporation they thought was there to help them.

Copyright 2012 Radio New Zealand

http://www.radionz.co.nz/national/programmes/morningreport/audio/2529096/acc-victims-still-bruised-by-privacy-breaches