The latest Novopay bungle is "disappointing and frustrating", the Minister in charge says, calling for an investigation.
Steven Joyce is the minister responsible for Novopay, which came under fire again today after a massive privacy breach struck the beleaguered school payroll system.
The breach has seen the pay details of teachers sent to the wrong schools. More than 500 principals and admin staff have been affected by the breach.
In a statement, Joyce said he had taken action.
"What happened today was very disappointing and I have made my views clear to EPL [Education Payroll Limited).
"It is particularly frustrating as it comes after a long period of stability in the payroll service. I have sought and expect a full investigation by the company as to how this error occurred."
Principals say the blunder could risk schools and teachers comparing private pay information.
The information of 530 employees was exposed by the breach, Education Payroll Ltd said in a statement this evening.
It said 522 authorised users accessed the information relating to 10 schools and 530 principals and administrators.
Each user would have been able to view data from one of the 10 affected schools, EPL said.
"This lapse is deeply regrettable and I sincerely apologise to those affected," Duncan Boennic, EPL's chief operating officer, said.
"We take breaches of privacy very seriously. This morning we asked all schools in receipt of this incorrect information to immediately delete it and we will also be following up with affected schools and employees.
"As soon as we were notified of this issue we took action and all SUE report information was removed from Novopay Online."
The information released on the Novopay Online system relates to school employee data, including name, pay details, and type of collective agreement, he said.
Access to this data was inadvertently made available to schools unrelated to the employees.
"The error has arisen as the result of a recent software update. We will fully investigate how the error occurred."
The Office of the Privacy Commissioner has been notified, he said
The payroll blunder has affected schools in Auckland, Taupo, Tauranga and Hamilton.
Principal of Merivale School in Tauranga Jan Tinetti said the error affected her school.
"We were sent the details of a school in Auckland and notified Novopay immediately."
The principal of Hamilton West School, Mark Penman, said his school was sent a payroll report known as the SUE report, containing the names of all staffing and their salary information from a high school in Northland.
He said Novopay staff told his school that the privacy breach was "widespread".
The payroll officer for St Patrick's School in Taupo, Donna Johns, said she "got a real shock when I looked at my draft report this morning."
"The first half was showing information for a secondary school while the second half of the report showed our staff.
"I tried to phone Novopay. It went through and someone answered but quickly hung up again so they are obviously not taking calls over this.
"This is not acceptable. In any way shape or form."
Another concerned principal contacted the Herald saying she had details of another school's payroll including the personal details of every staff member.
That meant she could see the personal details including pay scales of principals, caretakers, support staff and teachers.
Equally disturbing, she had no idea who had the personal details of staff at her school.
"I've contacted all the local principals.
"One of my colleagues has replied saying they have another school's data.
"Mine's gone somewhere but I don't know where."
The principal had immediately contacted the Ministry of Education, Novopay and Education Minister Hekia Parata about the botch-up.
Parata said earlier she and Minister Responsible for Novopay Steven Joyce were awaiting more information on the apparent breach.
"I can't tell you how widespread it is. Of course we are concerned about it. Let's be clear, this [Novopay] has been significantly improved since 2012, and Payroll Limited have been doing a very comprehensive job."
If teacher pay information had been incorrectly sent out, that would be serious, Parata said.
"It is very serious... and it will be treated seriously, and I expect there will be a response from the experts."
New Zealand First education spokesperson Tracey Martin said ministers must be held to account for the latest Novopay "catastrophe".
"The first to go should be Minister Steven Joyce, the "Mr Fixit", under whose watch the payroll system just got worse.
"He claimed in 2014 it was 'no longer a dog'. Yet again he's been proved wrong."
Parata, who signed up for Novopay knowing there had been no trial, and Craig Foss, who cleared the original contract knowing there were serious errors, also needed to be held to account.
"By 2014 the system had cost the NZ taxpayer $100 million, after being bought in 2012 from an Australian company that clearly had no idea what they were doing, but were good at sales."
An alert has been issued on the Novopay website saying it is aware there is an issue for schools surrounding the details for the next pay period.
"We are aware that there is an issue for some schools with the draft Staff Usage and Expenditure report.
"We are working to resolve this now and we will update you as soon as possible," the website reads.
National secretary of the NZ Educational Institute, the primary schools union, Paul Goulter, said even one mistake was too many when it came to people's privacy.
"Novopay must come clean on the extent of this breach. This is yet another Novopay shambles that puts individuals' privacy at risk and puts more strain on school staff at a stressful time of year."
Secondary Principals' Association president Sandy Pasley said she had received a call from a principal who had discovered the pay information of their teachers had been erroneously sent to another school.
If widespread it created a risk that schools and teachers could compare private pay information.
"There is a huge concern about individuals' private information being out there," Pasley said.
The latest breach comes four years after the Novopay debacle where thousands of teachers and support staff were underpaid, overpaid or not paid at all.
The debacle proved hugely embarrassing for the education minister costing millions to fix the specially-developed education payroll software.