Wellington City Council unable to contact those worst-affected by privacy breach

The office of the Privacy Commissioner has been informed of the breach. Photo / 123rf

The Wellington City Council has not contacted some of those worst-affected by a “serious harm data breach” because police have out-of-date details for them.

The Herald revealed in June that the Wellington City Council inadvertently released personal details of people involved in road crashes, including the names of drivers and medical details such as blood alcohol levels and drug use.

Council officials only became aware of the breach after the Herald reported it to them. They immediately notified the Privacy Commissioner’s office, an independent investigation was launched, and the council made sure the personal details were scrubbed from the internet.

Just a few weeks later, a second, unrelated breach occurred when the council published the names, IP addresses, and accessibility needs of some people who made submissions on a plan to remove private cars from the Golden Mile.

An update on the first breach was presented to Wellington City Council’s Audit and Risk Committee this morning.

The private information was published in a spreadsheet as part of an Official Information Act response and made available on the FYI website.

It was revealed the website page was accessed 35 times before the spreadsheet was removed.

Council officials spent almost two weeks going through more than 4000 lines of data to identify the personal information involved.

They used a “harm matrix”, with input from police, to determine eight people reached the threshold to be personally notified of the breach.

However, police said they had out-of-date contact details for them.

“We would have to use personal information collected for other purposes (via Waka Kotahi) to find these individuals and to contact them. This step has not been deemed proportional to go beyond the public notice,” committee documents said.

The individuals have not been contacted as there would likely be privacy concerns if further contact details from Waka Kotahi NZ Transport Agency were sought, the council advised in a public notice regarding the breach.

The council also noted the public notice has been publicised for some time and concerned individuals continue to have the opportunity to contact the council.

A more in-depth report about what the council has learnt from the incident and any recommended changes will be published later this year.

Georgina Campbell is a Wellington-based reporter who has a particular interest in local government, transport, and seismic issues. She joined the Herald in 2019 after working as a broadcast journalist.