New Zealand's Privacy Commissioner Warns of a Hidden Threat Inside Your Own Organisation
A quarter of all reported privacy breaches in New Zealand now involve staff snooping on people's personal records. Organised crime is making the problem worse.
Key points
- New Zealand Privacy Commissioner Michael Webster told Nine to Noon that 25 percent of reported privacy breaches now involve employees looking at personal records they have no right to see.
- Webster believes the true number is higher, because many organisations lack systems to detect unauthorised browsing.
- Criminals are increasingly bribing, blackmailing, and pressuring bank and health sector employees to hand over data from internal databases.
- Organisations in New Zealand are legally required to report a serious privacy breach to the Privacy Commissioner's office within 72 hours of discovering it.
- Accessing a colleague's or customer's record out of curiosity, or under outside pressure, can be a criminal act.
When people think about data breaches, they picture an outside hacker. Michael Webster wants them to think again.
The Privacy Commissioner says a quarter of all breaches reported to his office come from inside organisations, where employees browse personal records they've no business looking at. He told Nine to Noon he believes the real figure is considerably higher, because many workplaces simply don't have the tools to catch it.
The examples range from uncomfortable to criminal. A delivery worker used a customer's address, obtained at a department store, to ask if she was single. A health professional sent unsolicited personal messages to a young female patient after a clinic visit. Webster's description was blunt: "creepy, serious, harassment."
But there's a sharper edge. Webster says organised crime is now actively targeting employees with access to valuable databases, the digital filing systems where banks and health providers store customers' personal details. Staff are being bribed or threatened into pulling records and passing them on.
Why should ordinary customers care?
If one of your bank's or doctor's employees is pressured into accessing your file, your home address, financial position, or medical history could reach criminal hands. You'd almost certainly never know.
Webster pointed to a recent case within New Zealand Police, where an officer accessed the force's database for dishonest purposes. Police subsequently issued new internal guidance on what counts as unauthorised access. Our earlier report on insider threat detection and access controls covers why the institutional response to that kind of case so often lags the problem.
His advice to organisations is practical: run proper induction and training from day one, build technical controls that flag unauthorised access, and keep audit logs, automatic records of who looked at what and when, so a breach can be traced after the fact.
Under New Zealand's Privacy Act 2020, a serious breach must be reported to the Commissioner's office within 72 hours of discovery. The affected individuals must also be told.
Should you worry about your own data?
You have the right to ask any organisation what information they hold on you and how they protect it. Unexpected contact from someone who should only know your details through a business transaction is worth reporting. The threat isn't always coming from outside the building.
