The Privacy Commissioner is asking Vehicle Testing New Zealand for an explanation after it emerged an employee leaked personal information to a notorious unit of the Head Hunters gang.
No charges were laid against the VTNZ employee following a police investigation into the incident which was linked to the kidnapping of Auckland woman Jindarat Prutsiriporn.
The worker had provided the police informant's name and address to the Head Hunters' ghost unit after they attempted to kidnap the 50-year-old Thai woman last year.
The link was made yesterday when Justice Matthew Palmer sentenced six men in relation to Prutsiriporn's kidnapping and death.
The ghost unit, which was hired by Cambodian man Seng Lek Liev to carry out the kidnapping, first tried to snatch Prutsiriporn on February 15, 2016.
However, they were spooked when a member of the public told police about a suspicious-looking group waiting outside Prutsiriporn's Waterview home.
The gang, through its VTNZ source, then discovered the name and address of the complainant.
Justice Palmer described the leak of personal information as disturbing.
"A captain in the Head Hunters was later able to obtain the name and address of the passerby who called, through a source in Vehicle Testing New Zealand, from the licence plate of the car in which he passed by," he said.
Police said they investigated all parties involved in the VTNZ breach and no charges were laid.
"This is an internal matter for VTNZ and it would be inappropriate for police to comment any further," a police spokeswoman said.
VTNZ general manager of operations Greg O'Connor said the company fully investigated, and the employee no longer worked for VTNZ.
He said the integrity of VTNZ's system was vital and security protocols were in place, but it was not possible to stop all breaches, especially where an employee went "out of their way to act fraudulently".
However, Privacy Commissioner John Edwards said he was very concerned about Justice Palmer's findings.
Edwards said he will be asking VTNZ for more details, and for an explanation of the security processes and procedures in place at VTNZ.
Prutsiriporn was kidnapped during a second attempt on February 29, 2016 when she was lured into a ute under the guise of a drug deal.
She was then tied up, gagged, and held at several Auckland locations by the gang for the next 22 hours.
On March 1 at about 5pm she made a desperate escape from her captors by using a chef's steel to open the boot of the car she was being kept in while it was at a set of traffic lights on Huia Rd, Papatoetoe.
But she was thrown from the car as it sped off.
Motorists found her barely breathing and foaming at the mouth with ties around her neck, waist and ankles.
She died from her injuries in hospital two days later.
Prutsiriporn, a mother of three and known as Nui, had been involved in the criminal drugs world.