An independent investigation has found Wellington City Council failed to follow procedures when it accidentally sold off hundreds of “sensitive and confidential” files to a member of the public locked in an old mayoral desk.
The Herald revealed in September last year that the top secret files had landed in public hands after a local man purchased the piece of furniture at the city’s tip shop, only to find it was stuffed full of papers dating from 1988 to 2004.
The files, obtained by the Herald, included sensitive employment information, a sexual harassment claim against a councillor, and years of misogynistic correspondence, deliberately locked away for safe keeping in the mayor’s desk because of their confidential nature.
An independent probe has now found multiple failings, criticised the council’s document management practices, and detailed how the privacy breach unfolded.
Wellington City Council CEO Matt Prosser commissioned an external investigation shortly after learning of the incident, despite the council initially saying it did not believe the incident to be true when first approached by the media about claims of the documents’ existence.
The report by consultancy firm Grant Thornton found the council had not followed its own processes in storing the documents, said three inspections of the desk before its sale were insufficient, and warned the council was susceptible to another similar incident due to a lack of safeguards.
It also made a suite of recommendations which the council have adopted.
The 231 documents, made up of thousands of pages, dated from 1988 to 2004 and ranged from handwritten notes and newspaper articles through to Chief Executive performance evaluations and documents discussing allegations against elected members.
They were “deliberately stored outside of the WCC filing system as they were considered confidential to the Mayor”, an interview with a mayor revealed.
All but two of the 231 documents should have been destroyed years earlier, the report found.
“From our analysis, we are satisfied the storage of the documents in the desk for between 21 and 35 years was inconsistent with current Council policy.”
The desk was used by former mayors Sir Jim Belich (1986 – 1992), Dame Fran Wilde (1992 – 1995), Mark Blumsky (1995 – 2001) and Dame Kerry Prendergast (2001 – 2010) in the city’s old Town Hall.
Former mayors have expressed their outrage over the incident, calling it “appalling” and “diabolical”.
The desk was first thought to be emptied in 2013 when it was moved to the nearby Capital E building after the Town Hall was closed for remediation work.
While the desk was checked over at the time, the locked side cupboard built into it went unnoticed, and the files remained inside.
After having some of the old Town Hall furniture appraised by auction house Dunbar Sloane, the decision was made to sell the desk at the council-owned Tip Shop at the Southern Landfill.
During the process, a third party provider contracted to remove furniture checked over the desk at the Capital E building, but again did not notice the locked cupboard.
Those contractors found other files, namely old council agenda documents, in other furniture during checks.
The desk was checked over again at the Tip Shop, with staff there also not noticing the locked cupboard.
“The desk was inspected and deemed clear for sale,” the report states.
Once on the Tip Shop floor, it was purchased by Breaker Bay builder Raymond Morgan, who took it home for $200.
Upon arriving home he noticed papers hanging out the cupboard, he broke the locks and found the “treasure trove”.
“Given the discovery of the documents, and other documentation identified by the Tip Shop personnel, it is apparent that checks undertaken were not sufficient,” the report found.
The Grant Thornton report raises concerns the breach could happen again, warning current council policies are not robust enough.
“We understand there have been a number of issues with personnel attempting to recycle (rather than securely destroy) documentation which includes personal information in the Council’s current relocation project,” the report states.
“These reported issues demonstrate that while Privacy Policy requirements are detailed and align with legislative compliance, there is a lack of understanding of these requirements at the individual level,” it said.
A key finding was the council has an “enhanced risk of sensitive documentation being inappropriately released,” due to poor filing systems by council workers.
Another risk was the council’s upcoming move to a new HQ, a relocation which the review said “inherently increases the risk of inappropriate disposal of sensitive documentation”
It found that the council does not have any policy or supporting procedure governing the disposal of physical assets, something it recommends should change.
The Tip Shop should also implement an explicit requirement to check all donated items for documentation and verify them as clear, the report suggested.
“Where unintended items or documentation is found, this should be returned to the donor (during donation) or securely destroyed.”
An asset disposal policy should be created by the council, which would “include explicit requirement to verify asset is clear of all physical electronic WCC information”, something currently lacking.
Information management training should be made compulsory for staff and the council should monitor compliance, it suggested.
The council should also consider revisiting policy to “explicitly address the risk of informal personal filing systems and ensure it appropriately addresses both physical and electronic information”, it said.
The council’s executive leadership team have accepted the findings and implemented the following recommendations:
The report said the council has also removed some recycling bins in favour of secure documentation disposal bins.
The council has not confirmed the cost of the independent investigation, but it is understood to be near $20,000. The report will be discussed at the next Audit and Risk Committee meeting.
Ethan Manera is a Wellington-based journalist covering Wellington issues, local politics and business in the capital. He can be emailed at ethan.manera@nzme.co.nz.