An independent review of the access and use of client information within CCA will be led by distinguished lawyer Linda Clark.
The review was announced after RNZ revealed that a group of ACC employees shared and laughed at customer information in a private Snapchat group, amid recent concerns over inappropriate access to sensitive claims related to sexual abuse.
This follows a decision by ACC management to suspend 14 staff over allegedly improper access and use of customer information. This included 12 staff who reportedly shared customer information in a private Snapchat group. The ACC said internal investigations by the acting director general are underway.
The terms of reference, released today by the Treasury and the ACC Board of Directors, show that the review will focus on two key areas: the number of employees with access to customer information and access and allegedly inappropriate use of customer information among staff.
The review will take up to six months, although ACC management continues to make operational improvements where needed.
ACC Chairman of the Board, the Honorable Steve Maharey, said the Board takes the privacy and management of clients’ personal information very seriously.
The suspected improper access and use of customer information is of great concern, therefore independent review is needed to ensure that the public has confidence in ACC when reviewing the access and processing of customer data. and recommending any improvement.
The objectives of the review will be to:
1. Perform a comprehensive review of recent suspected access and misuse of customer information (and after examining the causes, including examining the potential impact on internal information security of recent changes in the way complaints are received). sensitive are managed)
2. Make recommendations to the CCA Board of Directors on relevance, effectiveness and how to improve:
- Systems and policies regarding access and use of customer information among ACC staff
- Access and usage monitoring, surveillance and auditing (to detect and prevent unauthorized access and use of customer information)
- Continuous training related to this access and use of customer information
Clark, a former RNZ reporter, is a partner at Dentons Kensington Swan and co-leads the firm’s public law and litigation practice in Wellington. She is part of the whole government inquiry and inquiry panel.