Opinion by Melanie Reid
Since early on in the ACC privacy scandal, the almost constant refrain from those defending the corporation has been the same.
Why didn’t Bronwyn Pullar just give the file back?
Does that just sound like a typical attack the messenger tactic?
But since it’s been bandied about so much, of course I asked Ms Pullar when I interviewed her for the 60 Minutes story “In the Eye of the Storm”.
The answer raises another important question that seems to have been glossed over.
To understand things, you need to know the sequence of events and a bit of context.
Ms Pullar had been in a nine-year battle with ACC about a variety of issues to do with her claim. But during that, she had become horrified about the corporation’s handling of privacy.
In the midst of complaining about what she said was a breach of her own privacy, she received an email from a senior ACC manager in August last year.
Attached to the email was a copy of a file. Initially, it didn’t mean anything to Ms Pullar at all and she set it aside.
It wasn’t until much later – on the eve of the now infamous December meeting – that she realised the file was embedded with spreadsheets of data. That data included private information on the ACC claims of almost 7000 people.
Since the December meeting between Ms Pullar, her support person Michelle Boag and two ACC senior managers had already been arranged, she decided to tell ACC about the mass privacy breach there.
And, as you heard on the recording played on our programme, that’s exactly what happened.
But rather than react immediately, the recording shows that the managers took a while to realise the implications of what was being said. And even then, they hardly reacted at all.
Eight days after the meeting, one of the managers wrote to Ms Pullar saying how constructive it had been, and setting out what they proposed to do with regards to Ms Pullar’s personal situation. And, yes, they asked for the information to be returned.
Now, by the time the letter arrived, Ms Pullar was in Wellington dealing with a family health crisis as well as arranging her wedding.
“I didn’t actually even really deal with the letter, because I had quite a lot of other things going on. I was in Wellington at that time, and I’d pretty much parked ACC stuff off to the side for a couple of months,” she says. When she did get focused on ACC matters again, she realised the concerns raised in the December meeting were not being dealt with and were probably never going to be dealt with.
“After the meeting, we found out…that there had been more cover-ups between management and the board,” she says. “So I knew that these guys weren’t going to elevate these issues.”
If she deleted the email, she’d have had no evidence of the mass privacy breach.
And so she spoke to the Dominion-Post reporter Phil Kitchin. To be clear, she did not give Mr Kitchin the copy of the file – she told him about it and what was in it.
Funnily enough, the day his story hit the paper, action suddenly ramped up. Inquiries were ordered, the police were called in, and legal demands were made to Ms Pullar about the return of the file.
So, if ACC had been so concerned, let’s remind ourselves: what was their response was when they were first told about it – three months earlier?
I asked her:
So Bronwyn, you’re saying that they sent you this letter eight days later. Did anything else come of it in the following months?
"I didn’t get any knocks on the door, the police didn’t turn up and grab my computer to get the file back or anything like that, no."
So just so I get it clear… They wrote to you saying look, we want the file back, but there didn’t seem to be any urgency over it?
"No, that’s right. They wrote back and said how constructive the meeting was, and how productive it had been, and how it had gone well, and by the way, can I have the file back?"
So no-one was belting down your door?
"No, not at all, Mel."
Why didn’t Ms Pullar return the file? Let’s answer that with another question: if she had - without going public about the file - do you think there would be the same level of attention on ACC’s lax privacy and the inquiries there are now?