ACC claimant's anger over blunder response

Privacy Commission says information emailed to Bronwyn Pullar was at 'lower end of breach'.

ACC's Bronwyn Pullar email blunder was at the lower end of breaches for the individual claimants affected, the Privacy Commission says.

But one angry ACC client says the response minimises the distress caused by the breach.

The woman's "sensitive claim" status - identifying her as a victim of rape or sexual abuse - was part of the information mistakenly emailed to Ms Pullar by an ACC manager last year.

The ACC claimant complained to the Privacy Commissioner after the privacy breach involving 6700 claimants was reported in March.

Yesterday, she received a response from assistant Privacy Commissioner Mike Flahive in which he noted the commission was investigating the breach and wider privacy issues at the corporation with the help of accounting firm KPMG and the former Australian Privacy Commissioner Malcolm Crompton.

But later in the letter, Mr Flahive appears to pre-empt the investigation's finding which are not due until June or July.

And while Ms Pullar reportedly described ACC's mistake in emailing her a spreadsheet containing the information about other claimants as New Zealand's "biggest-ever privacy breach", Mr Flahive didn't appear to agree.

"The disclosure of the small amount of information about you, to essentially one other person, is at the lower end of the potential breaches that occur in any agency," he told the claimant.

"The privacy breaches that are being investigated in this instance, while very concerning in an overall information handling context, involve the disclosure of mostly inoffensive information, albeit on a large scale."

Mr Flahive also noted the commission was investigating possible breaches of the Privacy Act by Ms Pullar as well as ACC and he asked the claimant to identify which of those two parties she was complaining against.

The claimant told the Herald she made the complaint because she was angry about what was the latest in a series of breaches of her privacy by ACC.

She was upset by the commission's response to her complaint. "I just feel that they've really minimised it."

She was not seeking compensation, but other claimants who contacted the Herald after the breach said they believed they should receive some.

But Mr Flahive indicated in his letter to the claimant that compensation was unlikely.

"Our experience is that in circumstances such as this data breach, it will be difficult for most subjects of the breach to show that they deserve substantial compensation."

Labour's ACC spokesman, Andrew Little, said he was surprised by Mr Flahive's comments. While most of the claimants affected were probably due no more than an apology, he believed those who had sensitive claims should be entitled to more.

"That is a massive breach of trust. They've been promised by ACC that sensitive claims information would be confined to a small group of specialist people and I think the privacy commissioner's simply wrong on that, and in understating the impact on those claimants of that breach."