Background and context
On 3 July 2020, the New Zealand Herald stated that it had received “a spreadsheet with the names, date of births, age, location of isolation, location of quarantine of 19 of the most current active Covid-19 cases.”
Radio New Zealand reported on 4 July 2020 that it “has seen a document that includes the full names, addresses, age and the names of the hotel and one hospital the 18 have been quarantining in.” Other media channels have also reported having seen the information.
This is sensitive personal information that should not be in the public arena.
Objectives of the investigation
The objectives of the investigation are to look into this incident with a focus on:
- identifying who or what caused the personal information to be disclosed;
- identifying what, if anything, might have prevented this from happening; and
- any improvements that might avoid a similar incident in the future.
Matters in scope of this investigation
The investigation is to principally investigate, make findings on, and report on:
- what caused the incident;
- whether any particular individual or individuals were responsible for the incident; and
- whether there is a risk of ongoing breaches or further exposure of the information.
The investigation is also to comment on:
- whether relevant policies or processes were complied with;
- the effectiveness of, and any improvements to, those policies and processes that might prevent similar incidents in the future; and
- any other relevant matters necessary to provide a complete report on the above.
Matters out of scope of this investigation
The investigation will not make findings as to the civil, criminal or disciplinary liability of any person but may identify further steps that could be taken.
Issues relating to containment of the privacy breach and notification of the affected people will be considered separately outside the investigation.
The State Services Commissioner appoints Mr Michael Heron QC (Inquirer) to undertake this investigation.
Functions and powers
Pursuant to section 23(1) of the State Sector Act 1988 and, for the purposes of the investigation, the State Services Commissioner delegates his functions and powers under sections 7 to 9, and 10 of the State Sector Act to the Inquirer.
Application of provisions of the Inquiries Act 2013
The State Services Commissioner certifies it is reasonably necessary that the provisions of the Inquiries Act 2013, specified in section 9A(2) of the State Sector Act, apply in relation to the investigation. This is because:
- the Inquirer should have powers to regulate the procedures of the investigation, including the gathering of evidence; and
- given the nature of the investigation, and the need to balance the public interest in disclosure with the privacy interests of potential witnesses, the Inquirer should have the power to restrict access to the information he/she receives.
Deliverables, timeframes and reporting
The investigation will commence immediately and must be carried out with urgency with an indicative reporting date of 24 July 2020.
State Services Commissioner
6 July 2020