Postal blunder – are your tax records safe?
Sunday Star-Times
TREASURY HAS lost a computer disk containing millions of New Zealanders’ confidential tax records, after ignoring procedures and sending the CD through the mail.
The news comes just two weeks after a Treasury official dropped a notebook on a busy road by parliament that contained confidential details of a proposed intelligence agency merger. It was found by a journalist.
Inland Revenue officials had entrusted the sensitive tax data to Treasury and are privately unhappy at the blunder. It is understood the disk includes personal IRD numbers and tax records for most people in New Zealand.
Treasury officials are said to be embarrassed, but both agencies played down the incident when approached by the Sunday Star-Times yesterday, saying in a joint statement: “No individual taxpayers’ names were included on the disk, and anybody who accessed the disk would not be able to match the data to individuals or identify any corporates, unless they knew their IRD numbers.”
Sources say each month IRD delivers to Treasury a CD that contains an update of all its tax records and is used to help forecast tax revenues. The sensitive data is encrypted on the disk, requiring a password for access. About two months ago IRD delivered a CD to Treasury but officials had trouble accessing the data. Instead of delivering it back to IRD by hand, it was sent by post and that was the last time it was seen.
Because no one at Treasury was tracking the disk, it was some weeks before it was discovered missing. New Zealand Post was asked to investigate discreetly, but it was not found.
A public sector data specialist, who asked not to be named, says that putting such data in the mail was “incredibly foolish” and broke all established procedures. “The issue is personal privacy and it seems neither agency was taking that seriously enough.”
Two years ago in Britain a major scandal erupted after the tax department there sent two CDs containing the entire child benefit database through the mail to another agency. The CDs were never seen again. Chancellor of the Exchequer Alistair Darling said there was no evidence the information had gone to criminals but he apologised for the mistake.
The New Zealand data specialist says it is hard to believe New Zealand agencies “had not heard about and learnt from the British debacle”. She said there was no good reason for IRD to provide any personal information to Treasury since it only needs “anonymised” information.
In their joint statement IRD and Treasury said: “The staff member concerned accepts that an error of judgement was made in not following Treasury’s procedures for handling disks, and has been spoken to by his manager.
“Treasury and Inland Revenue conducted immediate internal reviews when they learnt in August that a disk was missing.”
According to the statement, both agencies have “reviewed their processes for sharing such data and taken immediate steps to ensure a very high level of protection of all data”. The finance and revenue ministers were told of the blunder.
The information on the disk could be valuable to criminals, including for identity theft, if they had specialist assistance to break the encryption.