As a plan to pump treated wastewater into the Manukau Harbour is notified today, locals are furious at Watercare publishing private details of about 120 submitters and misrepresenting their positions
South Auckland residents invited representatives of the city's water agency into their homes to privately express their hopes and fears about a new wastewater treatment project; they were dismayed when Watercare then published all their details on the Auckland Council website.
Among them are two police officers and people involved in family court matters; fellow residents in the newly-formed Stop Polluting Manukau Harbour residents' group say those people are worried the publication of their addresses could endanger them. Others say they've since been targeted by phone and email phishing attacks.
Newsroom has spoken to five people whose private data was disclosed. "It's an invasion of privacy," says Glenbrook resident Dave Jackson. "They've published comments from that meeting at our home, and same with our direct neighbours, and they've published everyone's views and opinions on the project – except they've taken statements out of context."
Watercare's published report claimed there was "general support" from people spoken with in the community but in fact, Jackson says, more than 60 people turned out for a public meeting this week to oppose the wastewater discharge.
The council has now redacted the private information and apologised, and Privacy Commissioner Michael Webster confirms he's been formally notified of the privacy breach.
READ MORE: * 17000 households and businesses overcharged by defective 'smart' water meters * Quick start to Three Waters could save Auckland and Northlanders $1000
"Our focus has been to provide agencies who have experienced a breach with advice on how to minimise the harm caused by the breach," Webster says.
"Privacy breaches are a very serious event, which is why we frequently say that businesses need to treat privacy with the same seriousness as health and safety or prudent financial reporting."
Watercare chief infrastructure officer Steve Webster explains that when the agency submitted its application to designate coastal land on Glenbrook Beach Rd to Auckland Council on September 1, its documents included a section detailing the stakeholder engagement undertaken as part of this process.
"The need to show evidence of engagement is a requirement under the Resource Management Act," he says. "Unfortunately, the document included contact details of people who had attended our information sessions. This information was then published on Auckland Council’s website on September 12."
When Watercare became aware of this potential privacy breach it notified the Privacy Commissioner, asking his advice on this "conflict" between the Resource Management Act and the Privacy Act. Watercare is still awaiting the commissioner's formal response.
The information was taken down from the council’s website on September 18.
"We also wrote to the people whose details were published to let them know of the potential privacy breach and extend our sincere apologies.
"We are truly sorry for any concern and inconvenience this privacy breach has caused, and will be taking all necessary steps to prevent this type of error happening in the future. Since this incident, we have made a ‘protecting privacy’ training module mandatory for Watercare staff involved in collating submissions which may contain personal information.
"Once we receive feedback from the Privacy Commissioner we will implement their recommendations."
"We join Watercare in apologising for any concern this breach has caused, support their efforts to rectify the situation and reassure Aucklanders that we are taking swift measures to avoid it happening again." – Rose Leonard, Auckland Council
That is echoed by Rose Leonard, the manager of governance services at Auckland Council. She says Watercare notified the council on September 18 that this information had been published, and the council removed it immediately. It also cleared any cached records so they wouldn't be found by a Google search.
The published information appeared in an appendix to the Notice of Requirement package, which has since been anonymised and re-uploaded.
Both the council and Watercare notified the Privacy Commissioner and Watercare worked quickly to inform those affected and issue an apology.
"While responsibility to seek permission to share information lies with the people that collected the information, we recognise that we have a role to play in protecting third party data," Leonard says.
The council, too, has completed refresher privacy training with its policy and planning team, and will write to frequent Notice of Requirement applicants like AT, Watercare and the Ministry of Transport, reminding them of their obligations regarding affected people’s information under the Privacy Act 2020. Auckland Council is modifying its website to include a pop-up notification to applicants, to the same effect.
"We join Watercare in apologising for any concern this breach has caused, support their efforts to rectify the situation and reassure Aucklanders that we are taking swift measures to avoid it happening again," she says.
