The Ministry for Culture and Heritage has apologised and accepts it breached the privacy of applicants for the Tuia 250 voyage, says the chief executive.
Photo: RNZ / Charlotte Cook
A flotilla of waka hourua and talk ships, including a replica of the Endeavour, voyaged around the country as part of the commemorations - its last day was yesterday.
People were able to apply to be part of the voyage trainee programme which aimed to give people the opportunity to sail aboard the vessels during October to December 2019.
But in August, details of the 309 people who applied to be part of the programme were compromised and private data including images of passports, driver's licences, birth certificates and other forms of identification became available on the internet, accessed and copied by third parties.
Personal identification documents that have been compromised include:
- 228 passports (209 NZ, 19 international - Australia, Brazil, China, US, Canada, South Africa, UK, and Denmark)
- 55 driver licences
- 36 birth certificates
- 6 secondary school IDs
- 5 NZ residential visas
Ministry accepts recommendations
Manatū Taonga chief executive Bernadette Cavanagh said she accepts all of the reports findings and recommendations.
"It's clear that this privacy breach should never have happened, and I take full responsibility. I'm truly sorry for the harm caused to all the applicants," Cavanagh said.
The review found the Minstry did not follow proper practice and failed to pick up that the information was not secure and did not manage the appropriate risk assessment before the application form went live.
"I have taken immediate action to implement improvements to our security systems. A follow-up plan to action all the remaining recommendations is in place.
"In the period immediately after the breach the Ministry tested all its externally facing websites to ensure no other privacy breaches can occur," Cavanagh said.
The Ministry is continuing to work with those affected by the breach, 287 cases are closed but 22 remain open and it's working to close them as soon as possible, it said.
