That review then claimed there were inadequate working papers from the auditor to be able to determine whether the screening practice was high risk or not, and discredited the auditor, who has not spoken out and is believed to be bound by a confidentiality agreement.
The council did immediately stop the practice at the time, saying a proper policy was needed. The new policy, tabled on Wednesday, excluded emails to elected members, saying they will be "offered support to manage their existing software".
The policy defined three categories of breach, and depending on whether a sender has previously breached the policy and to what extent, the council would determine whether the person was added to the quarantine list, and for how long.
All senders who are considered by HDC to have committed a breach would receive a message to let them know - something HDC had reportedly not always done previously.
Deputy mayor Wayne Bishop said the policy clearly sets out council's processes and will be easily visible for the community.
A statement from the council said the policy had been referred to the Office of the Ombudsman and Local Government NZ and may change, subject to their feedback.