Privacy commissioner learnt about ‘serious’ breach from the media

The Privacy Commissioner is “frustrated” to have learnt about a “serious” privacy breach through the media, relating to the email addresses of 147 firearms owners being spilled.

In July, it was reported that the email addresses of licence holders were to sent to each other after a list of addresses was pasted in the carbon copy (cc) address field, rather than as in the blind carbon copy (bcc) field.

Privacy Commissioner Michael Webster said his office wasn’t formally notified of the breach by Te Tari Pūreke / Firearms Safety Authority until the following day.

Police launched the register of the country’s estimated 1.1 million firearms, via the authority, in June.

“This [breach] is frustrating, given the significant known risk of email address errors and the opportunity the new authority had to design in system guardrails,” Webster said.

“We understand the police sent out an email to affected people within minutes of the serious breach occurring. But this was an avoidable serious privacy breach.”

Mr Webster said it was his hope the establishment of a special purpose Firearms Safety Authority would contribute to community safety – and secure management of firearm owners’ personal information is an important part of that.

“I will be asking Te Tari Pūreke to provide me with assurance that they have implemented robust systems and processes across the authority to protect the sensitive personal information they hold.”

Director superintendent Richard Wilson previously told Stuff the email which contained the email addresses was a generic message asking the recipient to update their address, and did not contain any further personal information.

“Te Tari Pūreke confirms that on this issue being identified internally it immediately ceased emailing groups, and it sent a follow-up email to the 147 recipients asking them to delete the previously sent message.”

Grant Fletcher,​ one of New Zealand’s foremost experts on gun laws, said the privacy breach was “not even remotely close to being good enough”.

“All firearms users are entitled to have their details protected, as are all users of government services,” he said.

Fletcher said people were already hesitant about putting personal details into the system when it was launched, because there had been similar data leaks overseas which resulted in those gun owners being sent death threats.

“This leak has just further eroded their trust. People are furious… The entire firearms’ community are shaking their heads at this.”

Police have been contacted for further comment.