There have been 29 breaches in the Whangārei High and District courts - the most in Northland with Kaikohe the only other regional court to record breaches. Photo / Michael Cunningham
There have been 29 breaches in the Whangārei High and District courts - the most in Northland with Kaikohe the only other regional court to record breaches. Photo / Michael Cunningham
Last year proved the most tempting for the Whangārei courts when it came to breaches of confidential personal and criminal information, figures revealed.
Staff at the High Court at Whangārei and Whangārei District Court recorded the most breaches in 2021 with 16 - compared with three so far this year, five in 2020, none in 2019, four in 2018, and one in 2017.
A total of 34 breaches have been recorded in Northland since 2017 - fewer than Auckland, Wellington and the Bay of Plenty.
The Whangārei district and high courts had 29 total breaches, according to information obtained under the Official Information Act. The Kaikohe District Court recorded five breaches.
"Any privacy breach is disappointing. Ministry staff have appropriate access based on their roles and are expected to maintain the integrity of the courts and tribunals."
Acting Privacy Commissioner Liz MacPherson told Open Justice all "serious" breaches must be reported to the Commissioner within 72 hours.
She said the numbers were higher than she was aware of - but they might not have all reached the threshold for reporting.
"We will contact the ministry for further information to confirm if any of these breaches were above the serious harm threshold and should therefore have been notified."
According to the figures, obtained by Open Justice under the Official Information Act, 150 staff were formally warned and one was dismissed in the six years from 2015-2021.
All 151 of those employment actions were the result of staff members looking through court records without a justified reason.
They also all happened in 2020. Outside of that year, not one employment action was taken against a staff member.
The ministry said the employment investigations came after concerns were raised about staff accessing documents they shouldn't be.
Although the breaches were in 2018 and 2019, it wasn't until 2020 that action was taken, after the completion of employment investigations.
When asked why it took so long for that action to be taken Crafar said it took time to carry out the process properly.
Questions remain however over why there was employment action against 151 staff in one year, but none in other years.
The ministry strongly denied any suggestion that lax breach-monitoring processes were the reason no action was taken in the other five years.
"Our information security policies meet the government standard."
The Whangārei High and District Court recorded the most breaches in Northland. Photo / Michael Cunningham
1500 privacy breaches in six years
Of the 1537 occasions where sensitive personal and criminal information held by the ministry was breached, 1225 times were by the ministry's staff, and 220 by third-party contractors.
Just over 400 of those breaches were last year - four times the number of breaches in 2015.
Most of the breaches happened in the Wellington region, home to New Zealand's senior judiciary as well as the Supreme Court and Court of Appeal.
Auckland followed closely - again likely explained by the region's substantial caseload.
Privacy_Breaches_OLE
But the data also identified areas where privacy breaches were higher than their caseload would suggest, such as Tauranga, which had more breaches than the entire Canterbury, Waikato and Otago regions.
The Tauranga District Court and public defence service offices had 34 total breaches. The wider Bay of Plenty region recorded the third-highest number of breaches after Wellington and Auckland, sitting at 64.
A total of 256 of the nationwide breaches did not have a location recorded, and an extra 175 breaches were at non-ministry locations.
Ministry staff the 'biggest risk' - professor
Auckland University Associate Professor in Commercial Law Gehan Gunasekara, who is also chair of the Privacy Foundation, told Open Justice breaches by ministry staff was always the biggest risk for an agency its size.
"I would think that's massive; that's the Trojan horse, your biggest risk," the professor said. "You want to make sure you've got trustworthy people on the inside.
"It would be disappointing if Ministry of Justice officials were not following the law."
Around 2700 ministry staff work in or around courts and tribunals. The ministry would not confirm how many of them have access to court documents through their roles.
Gunasekara said the increase in privacy breaches in recent years may be related to a change in the Privacy Act, which now requires all serious breaches to be reported almost immediately.
MacPherson said there is a misconception that privacy breaches only occur where personal information is inadvertently shared to, or inappropriately accessed by, someone external to the agency.
"That's not the case. Internal issues such as employees looking up other people's personal records without good reason are also privacy breaches."
Crafar said the organisation has since taken steps to review its processes and introduce further prevention strategies, regular training and reminding staff of the code of conduct.
"Data security and privacy are central to our work at the Ministry of Justice and all staff receive training on the importance of safeguarding personal information."
