By Lloyd Burr and Patrick Gower
An independent report into ACC’s privacy and security systems has slammed the corporation, highlighting systemic failures in its culture, systems and processes.
The report, commissioned by both privacy commissioner Marie Shroff and ACC, was conducted after a spate of privacy breaches brought on by the Bronwyn Pullar saga.
It says there is “an almost cavalier” attitude towards clients and their private information and a culture change from the top down is vital to prevent more breaches.
Ms Pullar made headlines in March when she blew the whistle on ACC, which sent her the private files of 6,700 ACC claimants, including victims of incest and rape.
It was her final straw in a 10-year battle for proper compensation after a cycling accident. She claimed there had been many other breaches and she’d had enough.
The ACC retaliated by claiming Ms Pullar had tried to blackmail them for two years’ worth of benefits in a meeting last year, and lodged a complaint with police.
But police threw out the complaint after a recording of the meeting made by Ms Pullar showed no such blackmail had taken place.
The saga saw ACC chief Ralf Stewart and former ACC Minister Nick Smith resign, along with the corporation’s board chair and two company directors.
It also saw current ACC Minister Judith Collins launch defamation action against Labour MPs Trevor Mallard and Andrew Little after comments they made during a radio interview.
The report says the breach made public by Ms Pullar was the result of human error.
“The manager inadvertently clicked and dragged an email so it became an attachment... This could be viewed as a hazard of multi-tasking.”
But overall, the report says systemic issues increased the chances of a privacy breach which included a lack of clear accountability and a variable culture in dealing with privacy issues.
It also says that dual computer screens and the use of spreadsheets to manage the reports added to the systemic failures in the company.
Its recommendations include:
- Lead from the top down, starting with board governance and company leadership
- Create a “vision for privacy” and a plan to rollout a new privacy mindset
- Overhaul employment roles so all near misses and breaches are handled better
- Enforce policies that create a “positive policy mindset” to rebuild customer trust
- Establish a “firm but seen as fair” public image
- Create a coherent strategy and process to mitigate privacy risks
- Ensure there are adequate resources to respond to breaches.
Ms Collins says she welcomes the report but there is work to be done.
“There is a great opportunity now for ACC to restore the public’s trust and confidence,” she says.
“Genuine culture change will take time, but with the right systems and processes, focussed leadership, and commitment to change, ACC can make positive progress.”
The report was conducted by former Australian privacy commissioner Malcolm Crompton and accounting firm KPMG.
SECOND REPORT CLEARS PULLAR OF SPECIAL TREATMENT
A second report regarding ACC’s privacy breaches and the Bronwyn Pullar saga was also released today, clearing Ms Pullar of receiving special treatment.
Auditor-General Lyn Provost launched an inquiry into the interaction between Ms Pullar and ACC board members after she met with them in December last year.
The report says there is no evidence the meeting affected Ms Pullar’s ACC claim and points to a lack of policy guiding board members in their communication with individual claimants.
However, the report says despite Ms Pullar getting no special treatment as a result of that meeting, the offer of a further meeting with the national claims manager was special treatment.
ACC’s failure to recognise and act on the “allegations of illegality and fraud” toward ACC by Ms Pullar were a greater concern, the report says.
“It seems that the Board and ACC management were so focused on the appropriate separation of governance and operational matters that they did not recognise these issues as possible symptoms of systemic failure,” it says.
PULLAR PRAISED FOR WHISTLEBLOWING
"I think it simply highlights the lack of concern by ACC managers for a mass privacy breach," says Ms Pullar.
There was no judgement call, no opinion at all, on the controversial decision by ACC to put the police onto Ms Pullar, accusing her of blackmail.
When asked about the subject, Ms Shroff said they were "not qualified to form an opinion on that".
ACC chair Paula Rebstock said that "wasn't the purpose of this report".
Labour MP Andrew Little said the breach was "driven in part by the cost-cutting mentality that this government sanctioned and promoted", and has called on Ms Collins to resign.
Ms Collins responded by calling him a "silly man".
Ms Pullar's role in revealing the breach received praise from the Australian expert on the inquiry.
"Ms Pullar has done the people of New Zealand a service by making sure that we pay attention to the proper governance of personal information," says Malcolm Crompton.
But still, as yet, Ms Pullar has no apology.
3 News