PM Jacinda Ardern says new rules approved to prevent more data breaches

Cabinet has introduced new rules aimed at preventing another significant data breach like the one which occurred at the Ministry of Arts, Culture and Heritage.

That breach resulted in more than 300 people's personal information being exposed online.

Speaking to reporters at her post-Cabinet press conference today, Prime Minister Jacinda Ardern said the new mandatory, but interim, set of rules would help prevent such an occurrence happening again.

The rules are specially designed for Government departments with less intensive ICT departments, such as the Ministry of Transport, Department of Prime Minister and Cabinet and the Treasury.

From now on, these departments must receive the green light from the Government's Chief Digital officer before they hire contractors to work on their computer systems.

Government departments will be required to choose from a list of pre-approved ICT providers for any procurement work.

Prime Minister Jacinda Ardern said the new mandatory, but interim, set of rules would help prevent such an occurrence happening again. Photo / Mark Mitchell

Ardern said this would help "ensure the security of all New Zealanders' data, and restore confidence in the system and agencies [which] are providing services to the New Zealand public."

Yesterday, it was revealed more than 370 private documents – including passports, driver's licences and birth certificates – were exposed on a website.

The information belonged to 300 or so young people who had supplied their details to the Ministry of Arts, Culture and Heritage (MCH) as part of their applications to sail on the double-hulled canoe Fa'afaite, as part of the Tuia 250 commemorations marking 250 years since James Cook landed in New Zealand.

The breach was, according to the Ministry, a result of an "information management issue".

The company responsible for the breach was hired by the Ministry of Arts, Culture and Heritage.

After Budget information became available before the allocated day, advice was sent to all Government departments ordering them to check their security protocols.

"I've been given an assurance by the Ministry of Arts, Culture and Heritage that they did that," Ardern said and stressed that the information was made available on a separate site the ministry contracted the project out to.

Meanwhile, the Government is working with Google to make sure any trace of the information has been scrubbed from the internet.

"That's ongoing work," Ardern said.