The State Services Commission investigation into the use of external security companies reveals disturbing and unethical behaviour, says the Prime Minister.
Jacinda Ardern was briefed on the report, which was released this morning.
The inquiry was critical of private security firm Thompson and Clark, which was found to have used an unlicensed private investigator and recorded closed meetings without the consent or knowledge of attendees.
From 13 March 2014, Thompson and Clark, working on behalf of Southern Response, the government's insurance agency working for claimants of the Canterbury earthquakes, attended and recorded several closed meetings of insurance claimants.
Ms Ardern said the problems highlighted by the report need to be rectified.
"Look it does demonstrate some pretty disturbing behaviour, unethical behaviour, behaviour that we would not expect as part of the work commissioned by the public service."
The spying by the quake claims settlement company was on claimants who organised information evenings for those struggling to settle their claims.
The commission says this breached its code of conduct and may have been done illegally.
It has passed the matter on to the police to investigate.
Southern Response chair Ross Butler resigned on Wednesday evening after a meeting with the Greater Christchurch Regeneration Minister Megan Woods.
Earlier today one of the organisers of the meetings, Cam Preston, said people had a right to expect their privacy to be preserved and Mr Butler should go.
"It's a basic democratic right for people to be able to get together and discuss issues and if we're in a free and democratic society then we should be able to do that."
In a statement, Mr Butler apologises for Southern Response's actions and said its clients had a right to expect they could express their views freely.
Christchurch MP Megan Woods said Southern Response had a legitimate role in keeping staff safe, but the report made it clear that their actions morphed into protecting the brand of a Crown entity and "that's not appropriate, it's not acceptable and I'm really saddened."
Ms Woods - who is also Minister Responsible for Greater Christchurch Regeneration - said after the quake was a difficult time for people and they did not deserve to be spied on.
The commission has written to Ms Woods suggesting she look at what action should be taken against Southern Response.
In brief statement, Thompson and Clark director Gavin Clark said the commission's report has found that much of the work it did for government departments was within the State Services code of conduct.
Mr Clark said the company has had the report for less than 24 hours and it will take some time to consider the detail.
But it is conducting an internal review.
Thompson and Clark has been barred from doing any more work for the government and the departments that used their services have been given to April to come up with robust policies about how they use consultants.
Minister of State Services Chris Hipkins said those who may have breached the law will be referred to the relevant authorities or professional bodies.
"In the case of Thompson and Clark, because they clearly haven't been adhering to the relevant professional standards, we've been pretty clear as a government that actually we don't see room for this type of behaviour, that's not to say there shouldn't be any surveillance, in some cases it's necessary to identify fraud or to identify wrong doing."
The Privacy Commissioner hopes the investigation into government agencies' use of private security firms results in improved conduct across the public service.
John Edwards said the investigation has flushed out the worst of the conduct and the report has highlighted a lack of guidance and oversight, and the State Services Commissioner is urging government agencies to follow the rules and act responsibly.
Meanwhile, the police say there is no evidence of corrupt behaviour after it was revealed 16 police officers were linked to the security company at the heart of the state services inquiry.
The police were not included in the State Services Commission's investigation so launched one of their own.
Four officers were found to have been working for both police and security firms at the same time.
Three of those were dealt with and one has been referred to the Professional Conduct group.