MSD releases report from review of client level data privacy breach

Tue 16 May 2017

The Ministry of Social Development (MSD) has released the report from the independent review of the privacy breach relating to the collection ...

The Ministry of Social Development (MSD) has released the report from the independent review of the privacy breach relating to the collection of individual client level data (ICLD).

In April, MSD confirmed a privacy breach of the IT system used to collect ICLD from non-government organisations. The IT system was shut down and Social Development Minister Anne Tolley announced an independent review of the system.

The report from the review notes no client data was disclosed as the folder which was able to be accessed was empty. However, the report was critical of the process to develop and implement the system. The Government announcement stated that an employment investigation is now being conducted related to the breach.

Minister Tolley said:

“While this occurred at a time when the Ministry was going through major organisational change, the report highlights that the project lacked the appropriate governance, project management processes, and dedicated project resource.

“The reviewers also found there was insufficient due diligence in the selection and implementation of the temporary IT solution. There was a lack of appropriate checks and testing to confirm the system’s readiness. Privacy considerations and security risks were not properly identified and mitigated in a timely manner.

“Some of these difficulties could have been mitigated if the team had used the experience and knowledge from within the Ministry and from other agencies."

The MSD media release stated:

"While we are satisfied that no breach of privacy occurred, it is concerning that there was the potential for this to occur. We note the findings in the report relating to clear governance structures relating to the ICLD project.

The report also highlights other aspects of the project that were less than satisfactory. These include a timely Privacy Impact Assessment, and a lack of rigour in selecting SWS [Government Shared Workspace] as an interim solution. While the timeframes for delivering this project were tight, more focus was needed in these critical project areas.

MSD and the Ministry for Vulnerable Children, Oranga Tamariki will take the lessons learned from this independent review and ensure they are applied throughout both organisations. The protection of client data is a high priority, Mr Boyle said."

The full report is available on the MSD website.

Radio NZ reported the Privacy Commissioner said "What we have seen is an agency which has gone too quickly to implement policy without thinking through the implications - and perhaps the unintended consequences." This follows the Privacy Commissioner's recent report criticising the collection of individual client level data as "excessive and inconsistent with the privacy principles."

ComVoices chair Brenda Pilott said "We have said from the outset that this process was being rushed and was not affording MSD time to consider all the issues. Nor have they engaged well with providers and other experts."

Social Service Providers Aotearoa is working with ComVoices to continue to raise these concerns with the Ministers.

Webinar

Community Research is hosting a webinar The Community Sector and Collection of Client Level Data on 3 July 2017.

Related research

Young people who participated in research a proposed information sharing computer system in the UK “reported their reluctance to share information of a sensitive nature and many may choose to forego vital services if their need for privacy in some areas is not respected.”
‘I think it’s about trust’: Young people give their views on information sharing
Paediatric Nursing. 18, 8, 4-4.

An article by Munro (2007), The Dangers of Information Sharing published in the Social Policy Journal of New Zealand (Issue 31) emphasised the importance of confidentiality for parents' and children's willingness to confide in professionals.

The New Zealand research Breaking the silence but keeping secrets: What young people want to address sexual violence by Point Research (2013) found that fear of loss of confidentiality was a major reason young people did disclose sexual violence to adults.

The Morgan Foundation has questioned the effectiveness of targeting social service interventions only to people considered to be at high risk, citing the research below:

"The final lesson is not to expect a targeted intervention aimed at only some determinants of a problem to achieve transformative effects for entire areas or populations. It is well established within public health science that the most effective way to alleviate the overall burden of illness in a population is to ensure interventions include the large numbers of people at low or medium risk rather than focus solely on the small numbers at high risk. The same is true of social outcomes such as teenage pregnancy and indeed violence."

Bonell Chris, McKee Martin, Fletcher Adam. Troubled families, troubled policy making BMJ 2016; 355 :i5879

Background information

For further information see these previous NZFVC news stories:

Government announces independent review of client level data IT system

Privacy Commissioner's report criticises MSD collection of individual client level data

Temporary reprieve for sexual violence services on individual client level data

Research project investigates people’s views of data linkage

Consultations on more proposed government agency information sharing

Government continues work on integrated data and "social investment"

Concerns and public meeting on NGOs and provision of individual client level data

ComVoices paper highlights issues with govt requiring individual client level data

MSD to require individual client level data from community agencies