Prime Minister Jacinda Ardern has signalled the head of the Ministry of Culture and Heritage will keep her job despite a serious privacy breach.
Bernadette Cavanagh Photo: RNZ / Charlotte Cook
Speaking at her weekly post-Cabinet press conference, Ms Ardern also announced tougher data security rules for government departments in a bid to prevent a repeat botch-up.
Ministry chief executive Bernadette Cavanagh yesterday revealed the agency had mistakenly exposed the private details of about 300, mostly young people, to fraudsters online.
Sensitive documents - including passports, drivers' licences and birth certificates - were uploaded to an external website without sufficient protections.
Ms Ardern - who is chiefly responsible for the ministry - acknowledged the breach was serious and had been "extraordinarily stressful" for the victims.
Asked whether Ms Cavanagh should have offered to step down, Ms Ardern said: "I do not expect a resignation. I do expect, though, better results."
Ms Ardern said she was satisfied with the "swift" steps taken by the ministry once the breach was discovered.
"I'm confident that [the ministry has] has prioritised the needs of those affected," she said.
"They have moved to offer support immediately, including the replacement of those documents that have been compromised."
Prime Minister Jacinda Ardern Photo: RNZ/Dan Cook
Ms Ardern would not say whether anybody should lose their job over the error, saying "a few more questions" still had to be answered.
She said officials were examining whether the company that designed the unsecured website had fulfilled its contract with the ministry.
"I do need to allow them to do that, because, obviously, there will be - possibly - legal ramifications here."
Ms Ardern said ministers had today signed off on a set of new "mandatory requirements" for a range of government departments to help prevent another security breach.
The "interim" rules will apply to agencies with limited ICT capabilities, including the ministries of Defence, Transport, Housing, and the Treasury.
From now on, those departments will be required to use an approved list of providers for the procurement of any web or digital services.
The agencies will have to immediately review any technology projects planned or underway, and they will require final sign-off from the government chief digital officer.
The new approach would continue for the "near future" while officials worked to "ensure the security of all New Zealanders' data and restore confidence in the system," Ms Ardern said.