Novopay privacy blunder 'really not good enough'

20:03, Nov 16 2012

Yet another failure has been added to the Novopay report card following revelations that a Waikato School has had the names and personal details of 12 Nelson teachers added to its payroll.

Rosemary Hendrikse, principal of Manawaru School in Te Aroha, discovered the teachers' names on the school's Novopay report in September and has since been corresponding with Novopay to sort the issue.

She was assured the names would be gone on Wednesday, but when they were still there, Ms Hendrikse clicked on them, only to find details including personal addresses, cellphone numbers and bank details for each of them.

"It was all the things you give to an employer that are supposed to remain confidential, sitting there for us to see. And they had no idea. It's really not good enough. You trust that your details are going to remain confidential and for it not to be so is a worry. Our details could be right throughout the country. How big is this?" she said.

It was not until she contacted her local MP, Scott Simpson, who in turn contacted the Education Ministry calling for an immediate investigation, that the problem was remedied.

Ministry Group manager and Novopay business owner Rebecca Elvy said the issue had been fixed last night and apologised to both schools, citing human error at the Talent2 processing centre as the cause.


"The ministry takes the issue of privacy extremely seriously. Any breach will be thoroughly investigated. We are disappointed Talent2 did not act immediately in this case and are following this up with them," she said.

However, this was not the first breach of its kind, and Waikato Principals' Association chairman John Coulam said it was not good enough, and nor was the length of time it took to fix the issues.

"This is not the first time it's happened and I guarantee there are more out there. I'd just like to know how many other schools out there can access private information that they're not entitled to because of this," he said.

"It's not good enough. The length of time it takes to get it fixed isn't good enough, either. We're having to do all the middle man's work and if all our time is being spent on this, then something else is missing out."

The other breach was at Deanwell School in Hamilton, where the school's executive officer, who also works at Crawshaw School, would log into the Deanwell system but get Crawshaw information instead.

While the issue was now fixed, principal Pat Poland said the school had been told it would not receive compensation for nearly 100 extra hours of work over two months trying to work through the issue, costing the school about $2000. When he asked the ministry about reimbursement, Education Minister Hekia Parata assured him the decision to implement Novopay in August was made after "extensive testing and quality assurance".

"I am confident that Novopay was ready to implement . . . We don't anticipate, and would not tolerate, the reported difficulties continuing," she wrote in an email. "We don't have plans to reimburse schools for additional time they may have spent on Novopay in this first pay period. No future funding should be required for the same reason - as the system is fine-tuned and users gain more experience, Novopay will take less time, not more."

Waikato Times