Privacy blunders mount at Winz

PAULA BENNETT: ''All I can do is try and put the right security around it and get it to the right people.''
PAULA BENNETT: ''All I can do is try and put the right security around it and get it to the right people.''

Prime Minister John Key says a privacy blunder resulting in the personal details of beneficiaries being mistakenly handed to a Work and Income client was simple human error.

A list of the full names of the beneficiaries, along with the type of benefit they were applying for, was handed to a Masterton woman last week.

The sensitive document appears to have been used as scrap paper by office staff, and featured a hand-written note between staff members.

"It needs to be seen in the context of the advice I've had, which is: it was just a human error, someone wrote something on a piece of paper and on the other side it had some information on it and unfortunately they've given that out,’’ Key said.

‘‘That's unacceptable, but it's also true that it is the sort of thing that can happen to any person."

The head of Winz has apologised, blaming "human error and poor judgment".


Yesterday, the 60-year-old woman, who was accidentally given the piece of paper, said she had visited the Winz Lincoln Rd office last Monday to apply for a food grant.

She was informed her documents were not ready and to return two days later.

That Wednesday she was given an envelope containing her paperwork, but when she read the papers she noticed a handwritten note telling a staff member to contact her.

On the back was a list of clients' names, along with a deadline and priority status for each job.

"I don't know these people at all," she said.

"But I shouldn't know that these people are receiving benefits - it's disgusting, really."

The woman had first contacted Winz in April after being made redundant from her job of 12 years.

She was horrified to think such a mistake might happen with her own private details.

"Masterton is a small town, everyone knows everyone else," she said.

"You wouldn't want your private details bandied about all over the place.

‘‘This should be staying in the office and it should be shredded if they don't want to use it."


Key said while the case was unfortunate, workers should also be given "a bit of credit" for trying hard to do their job.

"From time to time [they] can make a human mistake."

He rejected suggestions it undermined the Government's push for greater information sharing between government agencies.

"I think that's quite different; we're talking about a an information sharing system which will be established to actually target information and to share it among agencies [in a] professional manner. That's quite different from someone that simply makes a mistake, writing down something on a piece of paper that already had something written on the other side."

Social Development Minister Paula Bennett says the breach was a human error by a junior staffer, not evidence of systemic failure.

Bennett said the error was disappointing.

"It doesn't point to systemic issues. It points to someone making an innocent mistake that shouldn't have been made.

"I think we should be fair and not build this into systemic issues, which it is not."

Bennett said she would not widen an inquiry launched after it was revealed kiosks in Winz offices could access thousands of private files on ministry servers such as the names of children in care and beneficiaries who owe money.

"This tells us that procedures in place were not followed but we do have procedures in place."

The minister said she was not going to "hang the staff member out to dry".

"But I don't think it will be happening again in a hurry."

Mistakes had been made under every government, she said.

Labour's social development shadow minister, Jacinda Ardern, said the minister had to acknowledge there had now been a raft of breaches.

"I've counted at least 10 that have been publicly reported on this year and that is quickly moving from human error to a systemic failure."

Labour wanted Bennett to widen the two-week inquiry into the kiosks, she said.


On Monday, Fairfax Media reported the personal identification numbers (Pins) for the payment cards being rolled out to 2600 young beneficiaries were the last four digits of the card numbers.

A signature was also required but security experts said that was no longer considered sufficient safeguard.

Bennett has asked for a full briefing from MSD this week.

''But to be honest, they're as secure as a credit card really.''

A lot of people still verified their credit card with a signature and, while it was not the most modern practice, MSD did not have concerns about security, she said.

The pin was used to open the account, but identity was verified by signature.

MSD was ''quite sure'' that was safe. She did not believe it raised concerns about ongoing security issues within MSD.

An independent review into the ministry's information systems was underway after secure information was able to be accessed through public kiosks in Work and Income (Winz) offices.

However, Bennett said she had heard anecdotal evidence about misuse of the payment cards.

''I can't stop individual practice really, we have some bizarre things that happen; you know people buy 10 cooked chickens and then go and sell them in the car park.''

Batteries were the most purchased item on the cards because they were easily onsold, while food was being swapped for cash, she said.

''All I can do is try and put the right security around it and get it to the right people.''

The cards can only be used in supermarkets, to pay bills, or where Work and Income quotes are accepted.

Alcohol, tobacco and fast food cannot be bought using the cards, nor can cash be withdrawn.