Tuia 250 Voyage Trainee Privacy Breach – Independent Review Finalised

Manatū Taonga has received the independent review into the Tuia 250 trainee privacy breach and fully accepts all the report’s recommendations, Chief Executive Manatū Taonga Ministry for Culture and Heritage Bernadette Cavanagh said today.

“It’s clear that this privacy breach should never have happened, and I take full responsibility. I’m truly sorry for the harm caused to all the applicants,” Bernadette Cavanagh said.

“Everyone has a right to trust that information they share with us is managed well and kept secure. The review showed that there was a flaw in our security systems which resulted in the privacy breach.

“The review also showed that key policies were not followed properly. The website which held the trainees’ information wasn’t secure and we failed to pick this up.

“We didn’t manage the risk around personal information and the appropriate risk assessment wasn’t completed before the application form went live.
“Our response to this report will ensure we learn from this experience and that robust processes will always be followed.

“I have taken immediate action to implement improvements to our security systems. A follow-up plan to action all the remaining recommendations is in place.

“In the period immediately after the breach the Ministry tested all its externally facing websites to ensure no other privacy breaches can occur.
“Security testing will be mandatory on all our technical systems holding personal information. No system will go live without this testing to ensure personal information is secure.

“Next steps include making sure all our systems that hold, or have the potential to hold, personal information are signed-off at senior level. We will ensure all appropriate assessment and testing is undertaken so personal information is secure.

“The role of Privacy Officer will be moved to the legal team and we’ll ensure all new projects with privacy implications are appropriately managed through all stages of the project.

“We are continuing to work with those who were affected by the breach and again I extend my sincere apologies to all of them for what happened. Their personal information should never have been available online.

“A total of 309 trainees were affected by the privacy breach. Some 287 cases are closed and 22 remain open and we are working to close all the remaining cases as soon as possible.

“My thanks go to staff in the Department of Internal Affairs, the New Zealand Transport Agency and Immigration New Zealand who assisted us in managing the responses. The New Zealand Police also provided security advice to some of the trainees. Many other public sector organisations have also supported us during the aftermath of the breach.

“My thanks also to Doug Craig, a Director of RDC Group, for his comprehensive review of the privacy breach and for outlining what went wrong and what we can do to see the right steps are taken to ensure this doesn’t happen again,” Bernadette Cavanagh said.

A copy of the full report and the Ministry response is available on the Manatū Taonga Ministry for Culture and Heritage website.

Ends

© Scoop Media