The NZ Security Intelligence Service (NZSIS), the country's domestic intelligence agency, reported one incident on May 1. A staffer left a locked bag in a bathroom at the Archives Cafe in Wellington. It was later handed to a security guard, likely by a member of the public.
The highest security classification of the information in the bag was "in confidence", the agency stated in an explanatory note, but "it was sensitive information that ought to have been held securely".
The staffer retrieved the still-locked bag about 10 to 15 minutes later and the NZSIS stated it is confident the bag wasn't opened during that time.
The case recalls a 1981 incident when the 10-year-old son of Herald journalist Fran O'Sullivan brought home a briefcase left on a nearby fence, belonging to an SIS officer and containing a Penthouse magazine, three cold meat pies and notes of a dinner party conversation hosted by a German diplomat.
The Ministry of Foreign Affairs and Trade has had four incidents since 2016, but refused to provide any details, arguing to do so would prejudice New Zealand's security, defence or international relations.
The most serious breaches in terms of private information being disclosed came from some of the country's 20 DHBs, although in the vast majority of cases material was handed in or recovered.
• Wellington's Capital & Coast DHB disclosed seven incidents. A nurse lost a patient's medication sheet from their back pocket while at a market. The patient wasn't told "on clinical advice". Another patient found a staffer's bag while out walking, and handed it in, saying it "contained a lot of information about clients and their care".
In September last year a woman found information on 26 patients on a handover sheet in her garden "and published the fact of the breach on Neighbourly website". An investigation determined a nurse had taken the sheet home and put it in the recycling, which blew over. Two months later another person found a nurse handover sheet on their property, with information on 41 patients.
In February this year a new mother was called by a stranger, who advised her pregnancy and delivery record was "blowing about in her front yard". The same month a staff member drove off with three folders including patient information still on the car roof.
• Counties Manukau DHB recorded eight incidents. Patient handover lists were found in the carpark, hospital entry and Middlemore train station, surgical sheets with patient details were lost, patient therapy notes were left unattended in a community gym, and a patient blood result report was left behind and later found by a nurse. Smoke-free referrals for 13 patients were left on a train.
• Auckland DHB had 16 incidents since 2016, including when a nurse put a patient file on a taxi roof while helping a patient into a wheel chair. The taxi then drove off.
• Southern DHB had 15 incidents, covering at least 178 patients. Patient notes and lists were found on the street and in a carpark.
• Canterbury DHB's four incidents included a ward handover sheet found outside Hagley High School, and a patient list found in Hagley Park. A South Canterbury DHB staff member came across a doctor's patient list on the hospital grounds, including diagnosis and treatment notes.
• In Bay of Plenty, a doctor put his laptop bag, containing his computer and notes on clients, on a car roof and drove away. A member of the public handed the bag to police.
In 2016/17, the Office of the Privacy Commissioner was told about 132 data breach incidents by agencies, about 30 per cent of which involved the loss of physical files.
Privacy Commissioner John Edwards said legislation progressing in Parliament currently will introduce a new legal requirement to report on data breaches, if there is a risk of harm. His office and the people affected will need to be told.
"While we need to take all reasonable steps to protect information in the digital environment, we should not lose sight of the high number of data breaches that occur involving hard copy files or information."
Earlier this month the Herald on Sunday revealed police had been called in after a doctor lost information about breast cancer patients, while walking near Dunedin Hospital.
