The State Services Minister says the government will do everything it can to track down who is responsible for a massive privacy breach relating to New Zealand's active Covid cases, and is not ruling out pursuing criminal charges.
State Services Minister Chris Hipkins. Photo: RNZ /Dom Thomas
An investigation has been ordered into the breach, with a leak revealing the personal details and identities of New Zealand's 18 active Covid cases.
RNZ has seen a document that includes the full names, addresses, ages and the names of the hotel and one hospital the people have been quarantining in.
Minister Chris Hipkins said the investigation could result in criminal charges, depending on the outcome.
"Ultimately, if there are avenues available to us to pursue somebody who's done this maliciously then we'll certainly be exploring those, this is not the sort of thing that I am willing to let go," Hipkins said.
"This is a major breach of trust and confidence and it should be rigorously pursued."
He was "very, very angry" such highly sensitive information was leaked, but said the source was still unknown.
It would be "abhorrent" if it was a deliberate act, Hipkins said.
The information is held by a number of agencies and by some involved in the management of managed isolation and quarantine facilities.
The State Services Commission has been asked to work with all of the relevant agencies, he said, as at the moment there were several government agencies involved. He said at this point "we don't have certainty about where in the process the information has ended up being released".
"To identify what the record keeping practices are, who has access to the information, how it came into the public domain, I want them to do that really thoroughly, I want them to leave no stone unturned."
Motive also had to be determined, Hipkins said, whether it was a mistake "and then someone took advantage of the mistake they made, or whether it was more malicious than that".
Someone "impartial" would be brought in to carry out the investigation, which may also involve forensic analysis of IT systems, the minister said.
"I think it's important that we bring someone in who's not directly involved ... which is what the State Services Commissioner will help to facilitate".
He had this message for the thousands of people coming through the border regime, who are obliged to hand over personal information.
"On behalf of the whole government, and I'm not sure where in the government the system has fallen down, I can apologise to those people, this is not acceptable, no government should tolerate this kind of behaviour and we won't.
"And I want to give an absolute assurance that we will get to the bottom of it, and that we will make sure it doesn't happen again and that anyone who has acted maliciously will be held accountable for that."
Privacy Commissioner John Edwards said it is important to find out how information was leaked and the general sense of unease when health information is leaked has been heightened with Covid-19.
"We have seen some public vilification, there is some stigma attached to the illness, wrongly but in some quarters, so there could be some adverse effects for people in their communities."
Edwards said the investigation also needs to find out whether the leak is malicious or a security leak.
Massive privacy leak "shabby" - National Party leader Todd Muller
The National Party leader says the major leak of personal details revealing the identity of New Zealand's active cases is unacceptable and "shabby".
Photo: RNZ / Dom Thomas
Todd Muller said the breach was "quite staggering, it talks to a government that's slipping off the side of a cliff, in terms of managing this issue, the border, the informaton pertaining to it".
"If they can't manage personal information, bluntly, they can't manage the border and they can't manage the country."
From the National Party's perspective, Muller said it was "unacceptable" and they would see where it ended up.
"Is it a deliberate leak or is it accidental? It doesn't really matter at a level ... it's loose, it's shabby and it's a reminder these guys can't manage important things well," he said.
"These guys need to step aside and let a competent government take over."
He would wait to see "how it all unfolded", Muller said, but it talked to a culture within the government which was "pervasive".
"Sloppy, not disciplined, not focused on delivering."
The party's spokesperson for health, Michael Woodhouse, said this was "yet another serious failing" that showed the government was not capable of managing Covid-19.
National Party's Michael Woodhouse. Photo: RNZ / Richard Tindiller
"This is unconscionable and unacceptable that those suffering from the incredibly dangerous virus now have to suffer further with their private details being leaked," Woodhouse said in a statement.
He said the government needed to get to the bottom of the source of the leak, and added that "keeping confidential information confidential should not be a difficult task".
"The Ministry of Health have been assuring people since the beginning of the epidemic in New Zealand that personal details would remain private, it's unfathomable that they couldn't handle a simple task like this."