Photo: RNZ / Samuel Rillstone
Unauthorised people could access employer and migrant details on an Immigration New Zealand system for months because the button that removed their authorisation did not work.
Former advisors and lawyers who were no longer involved in work visa applications could still see the personal details of job candidates and migrant workers, job check applications and accreditation renewals.
Immigration New Zealand (INZ) admitted the problem in a letter to an immigration lawyer, which came two months after he complained about it.
Lawyer Mike McMellon said he had asked INZ whether it had notified the Office of the Privacy Commissioner, and whether it intended to issue a warning to people potentially affected by the privacy issue.
His business partner, Nick Mason, said only authorised people should have access to such sensitive information and the response had been unsatisfactory.
"This is a really serious privacy issue, and if I was one of the applicants involved I would be upset with my details being available for someone who I have no knowledge of," he said.
INZ online services' acting director Fran Doran said INZ took the privacy of individuals seriously and it had identified a small number of applicants affected by the problem.
"We have prioritised contacting these applicants," she said.
"We are currently continuing to contact any employers that have been impacted. The Privacy Commissioner has been notified of the incident. We have put in place a monitoring system to prevent this from happening again."
The problem with the online system concerned the 'stop sharing' function, which was used by people with access to visa applications, such as licensed immigration advisors, employers or lawyers.
The applicant or their representative could either choose to stop sharing themselves, or call the INZ customer service centre to do it on their behalf, she said.
"A technical issue where the 'stop sharing' function wasn't working when it was initiated by our contact centre has now been fixed. The 'stop sharing' continued to work when initiated by the applicant/representative.
"We have also resolved the sharing permissions for the applicants affected. We are following our processes as a priority."