ACC chief executive Megan Main has apologised for privacy breaches made by staff at the organisation.
ACC chief executive Megan Main has apologised for privacy breaches at the organisation. Photo: RNZ / Samuel Rillstone
A damning independent review found ACC's privacy culture was poor, its policies were outdated and its staff not well informed.
The review, by laywer Linda Clark, was commissioned after RNZ revealed a group of call centre staff had shared, and laughed at, client information in a private Snapchat group, while another client discovered his old sensitive claim had been viewed more than 350 times by 92 staff.
Chief executive Megan Main told Morning Report she was taking the incident seriously and no breach of privacy was acceptable.
"I'm personally sorry about the impacts that events in the Snapchat incident had on New Zealanders trust and confidence in ACC but I do want to reiterate that the review did find that we had a focus on privacy - we need to broaden it, that's the focus of the recommendations and that's what I'm committed to doing."
Main said ACC had been more reactive than proactive in the privacy space.
Her focus now was on making sure the policies were embedded into the culture.
She didn't know why ACC's privacy policy wasn't updated last year. It was being updated now and the recommendations of the review would be incorporated into it, she said.
"The review gives me and the organisation a real opportunity to think much more broadly about privacy being the care of people's personal information in everything that we do, so that's really important."
The last major privacy breach incident was in 2011, she said.
"This incident was was a handful of ACC people acting inappropriately. The review found that that wasn't a widespread or systemic issue."
It would take around 18 months to fully implement all 30 recommendations.
"That's because some of them are system changes, some of them are to do with updating some of our policies but actually embedding this new way of thinking about privacy, about personal information being a taonga, a treasure that we are entrusted with, takes time."
The public could be confident the agency would protect their private information, she said.
'They need to turn this around'
Victim advocate Ruth Money said a massive amount of work was needed to turn around ACC's culture and staff training.
She said Main's apology was a start but she expected that ACC would have introduced reforms already.
The review was announced in October 2021 and the final report went to the ACC Board in May.
"A lot of it is common sense," Money said. "Your policies are outdated. It's not a difficult task to update them before this report comes out."
She was concerned that even now ACC was saying it would take another 18 months to fully introduce all the report's recommendations.
"It terrifies me - the personal information that ACC and other agencies hold."
It was "almost obtuse" of the ACC chief executive to say the agency was good with privacy policy on an external basis, yet its staff had been laughing at some clients' personal information.
Asked if New Zealanders could be confident in ACC, Money hoped changes would be made quickly.
"It can't get much worse in terms of the trust and confidence of a number of my survivors that I work with on a daily basis have with ACC."
However, some good mahi was being done in the sensitive claims unit although she would like to see the work done with more urgency.
"They [ACC] need to turn this around."
