Oranga Tamariki privacy breach: Spreadsheet with abuse allegations, children’s details shared

A document containing the personal details of more than 30 children in unapproved Oranga Tamariki placements has been accidentally shared with a member of the public.

Oranga Tamariki has apologised and is now in the process of contacting those affected by the shared document, which included allegations of abuse, a police visit and a parent being arrested.

Privacy law expert Kent Newman told the Herald he was speechless at the breach, saying it was “unspeakably bad practice”.

“That document should never have been created. Once it was created, it needed to have appropriate safeguards around it,” said Newman, a Victoria University of Wellington PhD candidate.

“Put a password on the document, limit control to that document, and minimise the amount of information.”

Newman said Oranga Tamariki should have a password-protected database.

“Every corporate in New Zealand of a reasonable size is doing this and is concerned about this and doing this better than the Government. The Government keeps getting caught with these practices that are just simply below what the law requires them to do. I mean this is terrible.”

It was shocking that issues like this had been happening for more than a decade and the Government had not lifted its game.

“There are multiple layers that have clearly failed here.”

This breach is the latest in a recent series of woes for the agency, which revealed earlier this month three staffers had been charged by police.

Service delivery deputy chief executive Rachel Leota said the error was “deeply regrettable”, and apologised to those whose privacy had been breached.

She told the Herald the Privacy Commissioner was alerted the same day as the breach and the agency was working with his office to address the breach.

“Oranga Tamariki is making all efforts to contact those affected. The welfare of families that we engage with at Oranga Tamariki is incredibly important and we consider any breach of privacy to be extremely serious.”

She said the breach occurred as a result of human error when the spreadsheet was mistakenly forwarded to a person they were communicating with on another matter.

Leota said data within Oranga Tamariki was managed in accredited systems and spreadsheets were used for some day-to-day tasks but not for long-term storage of information.

“Oranga Tamariki recognises our data system requires improving and is in the process of doing this.”

The document also detailed the children’s names, birthdays and what action Oranga Tamariki workers had deemed necessary, including medical reports.

The woman who was accidentally sent the document said she was shocked but given her history with the agency, she was not surprised by the breach.

“I would feel so angry if it was me and if I knew about it [would] want an apology and answers.”

A wide-ranging review of the agency released last month found the need for significant improvements in children’s residences.

The rapid review into Oranga Tamariki’s Youth Justice and Care and Protection residences was announced in June 2023 after serious allegations involving staff acting inappropriately.

It recommended improvement to leadership and governance, culture, behaviours and values, rangatahi and tamariki experience, workforce management and development as well as to health, safety and wellbeing, systems and structure, partnerships, as well as resources and assets.

Katie Harris is an Auckland-based journalist who covers social issues including sexual assault, workplace misconduct, crime and justice. She joined the Herald in 2020.