Report into Covid privacy breach

The Heron report into the Covid privacy breach has been released.

Media release:

Findings of investigation into COVID-19 active cases privacy breach

Deputy State Services Commissioner Helene Quilter has today announced the findings of an investigation into a breach of privacy regarding sensitive personal information.

The investigation looked into who or what caused the disclosure of the information, and what might have prevented the information from being disclosed and what, if any, improvements might prevent that happening again in the future.

The deputy commissioner said the investigation, led by Mr Michael Heron, QC, found that sensitive personal information was passed to someone who was not authorised to see it, who then placed it in the public arena.

The breach happened after the then Acting Chief Executive of the Auckland Rescue Helicopter Trust, Ms Michelle Boag, passed on the information, without authorisation, to Mr Hamish Walker, MP. Mr Walker subsequently passed the information on to the media.The report findings around Ms Boag, the Auckland Rescue Helicopter Trust (ARHT) and Mr Walker have raised privacy issues which are outside the deputy commissioner’s jurisdiction. Ms Quilter has therefore referred the report to the Privacy Commissioner. In particular, she has referred the actions of Ms Boag, the ARHT and Mr Walker for specific attention. Mr Walker’s actions may fall outside the jurisdiction of the Privacy Commissioner but that is for him to determine.

The deputy commissioner has also shared the report with the Speaker of the House of Representatives and the Leader of the National Party, who are referred to in the report and who may have jurisdiction.

In relation to matters under the Commissioner’s jurisdiction, Ms Quilter said the policy around the security of personal information within the Ministry of Health could have been tighter and the agency should have reviewed this earlier.

The Director-General of Health, Dr Ashley Bloomfield, has assured the Commission that the agency is fixing the areas identified in the report for improvement.“The Ministry’s policy should have been reviewed when the context shifted and it was not,” said Ms Quilter.

“I am not going to criticise the Ministry of Health beyond that when lives have been saved as a result of their actions on the broader COVID-19 front.

“The information should not have been placed in the public arena. The Ministry of Health did not place it there.”

Report Executive Summary:

Ms Boag and Mr Walker were each responsible for the unauthorised disclosure of this sensitive personal information. Their motivations were political. Their actions were not justified or reasonable. Each acknowledged their error publicly and cooperated fully with this inquiry.

The Ministry of Health policy and process in notifying emergency services of active cases was a considered response to the pressures arising during the early stages of the crisis. Whether the policy was appropriate in the circumstances applicable in April 2020 will be the subject of further review by the Privacy Commissioner. The policy and process should have been reviewed once there were no longer cases in the community and the dissemination to emergency services of the personal information ought to have stopped. In any event, there ought to have been better protection over the personal information.

On Boag and Walker:

The statements of Ms Boag and Mr Walker indicate that the cause of the leak was, first and foremost, deliberate and politically motivated. Both have expressed their sincere regret at their poor judgement in distributing this sensitive personal information to others. I was contacted by a COVID-19 patient to convey their shock and dismay that such information would be passed around in this manner. The Ministry was aware of the risks of unauthorised disclosure of such information and the harm that could be caused. Given its sensitivity, disclosure of such personal information requires clear legal authority and careful judgement.

The Privacy Act is unlikely to apply to Mr Walker in these circumstances. Section 2 of the Act states that an “agency… does not include… a member of Parliament in his or her official capacity.” Mr Walker considers he received and disseminated the information in his capacity as an MP. He says and I accept that he sought to hold the Government to account with respect to the countries from which new cases were originating and with respect to the lack of security around personal information. Mr Walker accepted that the spreadsheet did not assist to prove the first point. In my view, however, Mr Walker was acting in his official capacity.

Ms Boag’s actions in disseminating the personal information would not have been compliant with ARHT policy.

The State Services Commissioner could consider a formal referral of Ms Boag and the ARHT to the Privacy Commissioner, who is the appropriate statutory body in their case. The Privacy Commissioner is, however, already reviewing the question of whether the Ministry policy was appropriate and can investigate this matter with or without a referral or complaint.

On Michael Woodhouse:

Ms Boag had earlier provided similar personal information (but different spreadsheets) to Michael Woodhouse, MP. I received information relating to those other occasions from Ms Boag and proactively from Mr Woodhouse. Mr Woodhouse advised he did not forward such information on and has now deleted it. I considered whether I should pursue the deletion further with Mr Woodhouse, but ultimately because the information was similar in nature and it was not central to my inquiry, I determined it was not necessary to pursue it. I accept Mr Woodhouse deleted the information. Ideally, he would have counselled Ms Boag not to disclose such information and/or alerted the Ministry or Minister.

Full report:

Leave a comment

19 Comments

  1. John J Harrison

     /  30th July 2020

    Boag, the gift that keeps on giving— to the socialists !

    Reply
    • Duker

       /  30th July 2020

      Why does he get away with saying ‘socialist’, I cant call him a [4 letter word for old style english conservative originally meaning cattle rustler] … I understand the real reason was to avoid exactly the “intentional senseless’ name calling associated with ‘flaming’

      Reply
    • Blazer

       /  31st July 2020

      ‘These opportunist, lying, National dirty tricksters have assured me…”
      Non inquiry of the year award goes to…Mr M.Heron’.-TM@TS.

      Reply
      • Alan Wilkinson

         /  31st July 2020

        They lied how?

        Reply
        • Blazer

           /  31st July 2020

          Boag has admitted to lying on many occassions.

          Walker’s explanations beggar belief.

          You are really grasping at straws this morning Al.

          Reply
  2. NOEL

     /  30th July 2020

    “MPs receive all sorts of information on a daily basis, including sensitive information. As I
    have indicated above, I believe there should be systems in place that make it harder for
    anyone properly receiving such information to forward it to another person.
    With the benefit of hindsight, I accept that once I had seen that data I should have
    immediately disclosed to the Government that the information had been made available to
    me.”

    Interpretation

    Someone sent me this Medical in Confidence information and I’m going to use it for political purposes but its not my fault because the systems should not have allowed the other person to forward it to me.

    Reply
  3. Duker

     /  30th July 2020

    What ever happened to the Helicopter Rescue Trust saying the CEO ( whoever it was and theres a sad story of why it was Boag ‘acting’ at the time) should never ever see patients names under any circumstances. Its for medical staffonly , of which they have heaps including a ‘medical director’
    She had been ‘acting CEO’ for something like 6 months so its wasnt a 2 week thing . So the ‘never had a Trust email address’ doesnt stack up. These days its easy to have multiple email accounts connected to your ’email app’ so you dont have to ‘login in each time’

    Reply
  4. Alan Wilkinson

     /  30th July 2020

    Boag and Walker dead and buried. Woodhouse burnt. Muller in recovery ward. Collins left with the wreckage. Bridges carefree. NZ stuck shut off from the world printing money until vaccine and inventing new regulations for the next three years.

    Reply
    • Duker

       /  30th July 2020

      Australia is cut off too, you even have to get permission to leave and they have hundreds of new cases each day. Im sure they have a limit with the airlines of 350 arrivals each day at Sydney airport from international flights…350 per day at Sydney…they used to have planes that could carry that EACH flight.
      get real about what its like in the big world

      Have you thought of going to Sweden….oh thats right its neigbours Norway and Denmark have closed their borders to Swedish travellors ….a bit like Queensland has done to NSW and Victoria…thats internal borders have police checkpoints. Notice any on your local travels or for Cook Str.?

      Reply
  5. Blazer

     /  30th July 2020

    ‘Heron said he took Boag at her word when she said she hadn’t shared the data with anyone other than Boag and Walker.”

    I have seen some absolutely hopeless Q.C’s in my time…welcome to that club Mr Heron…can just imagine his back story.

    Reply
    • duperez

       /  31st July 2020

      I agree with the Heron approach. It will save millions.

      You just ask someone the questions, they say yes or no, no need to check phones or computers, and it’s all over, done and dusted.
      Miscreants up and down the country will love it.

      On the other hand I suppose some people are above shoddy behaviour, they have integrity and status so you can take them at their word.

      ‘You’re free to go Ms Boag, we trust you.’

      Reply
      • Alan Wilkinson

         /  31st July 2020

        Alternatively scream racist at somebody and when they produce evidence their statement was factual destroy their career by saying they shouldn’t have had the evidence and shouldn’t have been allowed to produce it.

        Oh yes the Left have a firm grasp on morality.

        Reply
        • Blazer

           /  31st July 2020

          Self destruction …Al.

          Reply
        • duperez

           /  31st July 2020

          Would a wise old head like you have put out a press release saying that
          up to 11,000 people arriving from overseas could be destined for quarantine in the south without any consultation with the community? Then add, “It’s absolutely disgraceful that the community hasn’t been consulted on this.
          “These people are possibly heading for Dunedin, Invercargill and Queenstown from India, Pakistan and Korea.”

          I wonder which press release writing school he attended. If it were back a few months and you were mentoring him would it have looked like that? And would he still be in a. job?

          Maybe we could start a business mentoring MPs on how to get the point across without destroying a career.

          He wanted to sensationalise and politicise the issue for his advantage but that’s what sank him. The ‘up to 11,000’ bit suggests he could get a job with Briscoes.

          On the bright side I guess the people of the Deep South no longer have nightmares about 11,000 Indians, Pakistanis and Koreans flooding the region. They can pray for the virus thing to pass so they can welcome 11,000 tourists from Indian, Pakistan and Korea.

          Reply

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s