File photo. Privacy Commissioner Michael Webster pictured in 2021. Photo: VNP / Phil Smith
Oranga Tamariki has still not fixed the systems that led to privacy breaches that put people in danger of physical harm, almost a year after a review into them.
The review was made public only last week, months after RNZ asked for it under the Official Information Act, and 11 months after it was completed.
It found "grievous" breaches that were some of the worst the Deputy Privacy Commissioner had seen, that in some cases led to actual physical harm being done to the person whose details were given out when they should not have been by social workers or other staff.
These included including a staff member who took a screenshot of a mother's file and shared it with the child's father, leading to further physical abuse to the mother.
Read more:
"We are pleased to see that Oranga Tamariki (OT) are making public the review findings," Privacy Commissioner Michael Webster told RNZ.
When RNZ asked why he did not make them public 11 months ago, he said: "The timing of the publication of the report, and action taken to date by OT in response to it, are matters for OT to talk about."
Other regulators had previously given Oranga Tamariki (OT) the okay on its privacy processes. The commissioner, however, received 35 notifications of serious breaches by OT from 2021-23, and instigated the newly released review in May 2023.
Its recommendations include putting blocks on what staff can see which files, getting them to use digital files instead of paper - as papers were often left lying about - and introducing quarterly reports on breaches and "reported near misses" to the chief executive.
Webster said OT had picked up on these in the "next stage" of its privacy improvement plan. It also has a new privacy steering group, and elevated the role of Chief Privacy Officer to a deputy chief executive position.
His office was still a few weeks away from finishing helping the ministry with this.
"This is a good step forward," said Webster in a statement.
"However, there is still a considerable amount of work for Oranga Tamariki to do to improve their privacy practices that goes beyond this plan.
"We are in the process of working through with them our expectations for uplifting privacy capability and information safeguards within the organisation. We expect to complete this in the next few weeks."
The ministry said it had not had a breach of privacy in the last year serious enough to be notified to the commissioner.
However, the review in April 2024 said staff told it not all breaches below the notifiable level were being reported, and because the ministry did not have an accurate picture of all breaches it could not identify a pattern behind the cause.
