Wellington City Council’s second data breach sees names, IP addresses of Golden Mile submitters published

The second data breach relates to submissions on the plan to remove private vehicles from Wellington's Golden Mile.

Wellington City Council has committed another privacy breach after it had already inadvertently released the personal details of more than 4000 people involved in road crashes, the Herald can reveal.

This time the council published the names, IP addresses, and accessibility needs of some people who made submissions on a plan to remove private cars from the Golden Mile.

The information was collected by the Let’s Get Wellington Moving transport plan and these personal details were therefore not covered by the council’s privacy policy for further sharing.

An investigation has found the personal information was publicly available on the Wellington City Council website for nine days before council officials were made aware of it.

There is no evidence that personal information has been misused at this stage.

Council spokesman Richard MacLean said it was “another regrettable incident”.

“But our staff acted quickly to pull the information down when it was spotted.”

One person affected is Retail NZ public affairs and policy manager Aimie Hines who said another data breach was incredibly disappointing.

“Especially when it has involved the personal contact details of Wellington’s retail sector as they engaged in good faith with Let’s Get Welly Moving.

“Retailers require confidence that the personal information they provide to Wellington City Council and Let’s Get Welly Moving during consultation or other matters is looked after appropriately.”

In an email to those affected, a council democracy adviser said a clean copy of the 112 submissions with redactions was later uploaded.

An incident report was raised with the council’s internal privacy and official information team who were quick to provide guidance to remedy the situation, the adviser said.

“This incident has led us to review our processes around gathering, sharing, and storing personal information collected by us and/or passed on to us from third-party public consultants.

“To prevent future breaches, our team is committed to developing a well-thought-out security plan for all personal information. Work on this has already begun.”

The adviser apologised to the people affected and for any concerns the breach may have caused them personally.

Wellington City Councillor Diane Calvert said she was made aware of the breach by one of the submitters on Monday.

“I was surprised to hear about another significant data breach by Wellington City Council from a member of the public.

“I will be following this matter up with senior officers as it is disappointing to find out this way along with it occurring when there is an investigation already under way for a similar breach.”

An independent investigation is under way into the other breach involving crash data.

Specialist privacy consultancy INFO By Design has been reviewing documents, scheduling interviews, and identifying the people most severely affected by the breach.

Georgina Campbell is a Wellington-based reporter who has a particular interest in local government, transport, and seismic issues. She joined the Herald in 2019 after working as a broadcast journalist.