PM: Privacy breaches are inevitable

Prime Minister John Key. File photo / Sarah Ivey

Prime Minister John Key says privacy breaches like the two revealed in one week at the Earthquake Commission are inevitable, and they are a result of human error, not systemic failure.

EQC mistakenly sent an email containing claims status and private details of 83,000 claimants, covering 98,000 claims, to former EQC contractor Bryan Staples.

Six days later it was revealed another claimant received an email with an attached spreadsheet with 2200 names, stopped cheque details and claim amounts worth $23 million.

Mr Key said EQC had been under huge pressure to grow quickly and respond to hundreds of thousands of claims, and operate with a high degree of urgency.

"There's always a trade-off here; there will always be human error.

"I don't have a simple way of stopping human error. If there were a few people you can get them in a room, but you're literally talking about tens of thousands of people who might make a simple mistake by forwarding an email.

"I don't know about you - but over the weekend I happened to get three text messages from people that were nothing to do with me.

"They were very affectionate towards me; but they were nothing to do with me. It happens"

Mr Key said Government employees were expected to treat sensitive information carefully and diligently.

"We need to make sure that we're instructing our agencies and departments to follow the most precautionary steps that they can, in terms of the dissemination of what could be personal information. Inevitably some people still make mistakes."

Information systems at the Earthquake Commission will return to business on a restricted basis.

Last week Minister Responsible for the Earthquake Commission, Gerry Brownlee, called for a complete freeze on IT systems, including all incoming and outgoing emails.

Tonight Mr Brownlee announced a resumption of EQC's claims settlement system and functions that allow the Commission to pay contractors in the Canterbury home repair programme.

Staff will still not be able to email customers, but customers will be able to email staff.

Claims processing will be delayed, including claims payments.

Mr Brownlee has continued to restrict online forms including query forms, Official Information Act requests and complaints forms.

EQC staff worked over Easter with a team from the office of the Government's chief information officer, Colin MacDonald.

Other functions will return progressively this week, subject to EQC and Mr MacDonald's signoff that systems to protect privacy are appropriate and robust, Mr Brownlee said.

Staff were involved in an internal audit, and all staff were reviewing locally-stored files and protecting material where necessary.

"EQC is also identifying how best to manage the large spreadsheets required to document their work programme; and they're working with professional third parties such as private insurers and contractors on how to ensure EQC data is transferred in a manner that protects privacy," said Mr Brownlee.

The commission laid a complaint with Christchurch police last week. No further detail of that complaint has been released by police.