24 Oct 2018

IRD privacy breach raises data handling concerns

From Nine To Noon, 9:08 am on 24 October 2018

Inland Revenue's data protection protocols are being questioned after a woman received information about a stranger's child support in a copy-and-paste error.

No caption

Photo: Supplied

The Wellington woman got a letter from Inland Revenue addressed to her that included the full name of a father who was paying child support, and his child.

She told Nine to Noon Inland Revenue told her it was a copy-and-paste error.

The woman, who RNZ has agreed not to name her to protect the privacy of her children, said it raised wider questions about the way IRD handled private information.

"I thought IRD would have the most secure system in New Zealand," she said.

"Out of any government organisation to hold personal details I would've had the most confidence in IRD.

"I can't believe they are copying and pasting people's names into letters."

The woman said the privacy breach occurred after she filled out a form to cancel her child support payment, and received the stranger's details in return. She is seeking assurances from Inland Revenue about its data protection protocols.

"IRD have assured me my details haven't gone to anyone else. I've got their [the stranger's] details and IRD is telling me no-one else has mine. I'm not confident that's the case."

Inland Revenue Deputy Commissioner Gaye Searancke said in a statement said the mistake was due to human error when a staff member was manually handling two customers' information at the same time.   

She said IRD regretted the mistake and was committed to ensuring that this sort of thing did not happen again.

IRD was writing a formal letter of apology to the customer.