A senior gang member was able to access the private details of nine people through a friend who worked at Vehicle Testing NZ.
Photo: VTNZ
RNZ reported last month a member of the Head Hunters gang was able to get the identity of a man who called the police about gang members being on his street early one day in February last year.
The man's call foiled a kidnapping attempt by a group of Head Hunters, known as the Ghost Unit.
But court documents seen by RNZ show senior Head Hunter Latana Oloamanu was able to get the names and addresses of eight other people from his source inside VTNZ as well.
When Justice Palmer sentenced six men for their part in kidnapping an Auckland woman who escaped, bound and gagged, from the boot of a moving car but later died of head injuries, he said a gang member had obtained a police complainant's name and address from a contact at VTNZ.
Justice Palmer said he was disturbed by the Head Hunter's ability to find out the man's identity.
Since then, RNZ has been granted access to the court file which includes cellphone records that show Oloamanu was able to discover the identities of eight other people from the VTNZ employee.
In a statement to police, Oloamanu said he met the VTNZ employee through mutual friends and the pair also used the same tattoo artist.
One gang member known as Caps said he was approached by mates asking if he had a contact at VTNZ. He passed the information on from his contact but didn't know if it was acted on and didn't ask what the information was for.
Privacy Act recommendations 'out of date' - Privacy Foundation
Privacy Commissioner John Edwards is investigating, but declined to be interviewed on the case. It's not known if he was aware that there was more than one breach of privacy.
The Privacy Foundation advocates for the protection of privacy. Acting chair Gehan Gunasekara said the apparent breach by the VTNZ staff member was serious.
It's not clear if VTNZ has notified the people whose details have been passed on to the Head Hunters, but Mr Gunasekara said they should.
"Those people may have been at risk and they needed to be told, that hey these guys have now got your details."
Mr Gunasekara said there needed to be a law change to give the Privacy Commissioner more teeth.
"The recommendations for reforming the Privacy Act are so out of date now, that they've been left completely neglected by the government."
Mr Gunasekara said currently the Commissioner could only make a recommendation, but proposed changes would allow the Commissioner to make a finding and compel an institution to make changes or face fines.
"There's a separate issue as to whether the employee would have clearly breached their own employment expectations to their employee and quite conceivably was disciplined.
"I don't know the facts around that, but that's a poor consolation to the people whose very sensitive information has been obtained by others."
VTNZ has a defence - lawyer
Lawyer Simon Judd's work includes prosecuting on behalf of the Director of Human Rights Proceedings before the Human Rights Review Tribunal.
Mr Judd said the alleged breaches were very serious.
"Potentially the information could be used for purposes which are harmful, very harmful."
Mr Judd said if the Commissioner deemed there had been a breach, it could be referred to the Director of Human Rights Proceedings and there could be a prosecution before the Tribunal.
If successful, there could be a range of penalties.
"The sanctions include a declaration that there's been a breach of privacy, a training order requiring VTNZ to put in place better measures to make sure their staff are properly trained, there's also the ability to award damages for harm caused."
But Mr Judd said VTNZ had a defence.
He said they would be able to argue that they had policies, practices and procedures in place and that was only a rogue individual who acted on their own.
VTNZ did not return phone calls but have previously said the female staffer was no longer working for it. It's not clear if she was fired or left the company. It is also not clear if VTNZ or police have contacted the people whose details were passed on to the Head Hunters.
VTNZ was a state-owned enterprise before being privatised in 1999. It's been appointed by the Transport Agency to carry out vehicle inspections, and contracted to provide vehicle registration and driver licensing services.
RNZ asked the Transport Agency if it had raised concerns with VTNZ about people's personal details being given to gang members. The agency has yet to respond.
