14 Aug 2013

ACC admits another privacy breach

9:24 pm on 14 August 2013

ACC has defended the time it took to inform clients their personal information was stolen from a case manager's home in the fourth major privacy breach involving the corporation in just under two years.

The Accident Compensation Corporation has launched an investigation after a notebook containing details about claims and bank account numbers was taken from the Christchurch house on 3 August.

ACC believes details of 35 clients were in the notebook but is contacting 124 clients the woman has dealt with this year. It said it would consider compensation and also offered to help those affected change their bank account details or phone numbers.

A client spoken to by Radio New Zealand was only notified of the situation on Tuesday afternoon and said he was shocked to hear that his information may have been taken home by a case manager, as the details are extremely personal.

ACC's general manager of claims management, Sid Miller, said taking client information home is a major breach of protocol, but defended the 10 days it took for the corporation to start informing people.

Mr Miller told Radio New Zealand's Checkpoint programme on Wednesday that ACC was waiting to hear from the police investigation and to see if the notebook could be recovered quickly. He said ACC always intended to go public about the breach.

"As soon as it became clear that there was no quick resolution to this investigation, we took the action to then commence informing all clients.

"We are very, very apologetic for what has happened here. We want to work through with them to deal with this situation. We've also undertaken a whole series of actions internally in terms of reminding our staff about the policies and procedures."

Mr Miller said clients affected should precautions such as changing their bank account numbers.

In 2012, Privacy Commissioner Marie Shroff found there was an almost cavalier attitude towards client privacy at ACC and recommended several changes.

That year, ACC offered $250 to 200 people whose privacy was breached. Wellington lawyer John Miller said clients in the latest breach might be eligible for a similar amount.

PM downplays breach

The Prime Minister said while the latest breach is disappointing, it should be kept in context.

John Key.

John Key. Photo: RNZ

John Key said the staff member was probably being diligent and took her work home, never thinking that she would be burgled. Mr Key said while he is careful, he too leaves his briefcase sitting around home.

But Opposition MPs say it is a serious breach that will affect public confidence in ACC and are also critical of the fact that it took the corporation over a week to contact clients.

The Labour Party said on Wednesday that once again, ACC has several questions to answer about how another privacy breach was able to happen.

It questions what sort of pressure staff are under that they have to take work home and whether there has actually been a culture change within the corporation.

Independent MP Peter Dunne says the delay in informing clients is unacceptable. He said ACC should have acted as soon it was aware there was a problem so those affected could take steps to protect their personal information such as bank accounts.