Privacy Commissioner Issues Compliance Notice To Oranga Tamariki
Press Release – Office of the Privacy Commissioner
Oranga Tamariki has one of the most important roles in New Zealand – to help safeguard the wellbeing of our children, particularly those children in their care. Improving its privacy practices will contribute to the safety and wellbeing of children, their …
A compliance notice has been issued to Oranga Tamariki for failing to comply with the requirements of the Privacy Act. The Privacy Commissioner has also taken the step of publicly releasing the Compliance Notice itself.
Privacy Commissioner Michael Webster says while Oranga Tamariki has taken positive steps to improve its privacy practices, considerably more improvement is needed.
'Oranga Tamariki has one of the most important roles in New Zealand – to help safeguard the wellbeing of our children, particularly those children in their care. Improving its privacy practices will contribute to the safety and wellbeing of children, their whānau, caregivers, and foster parents
Transparency about the nature of the Compliance Notice requirements is in the public interest and is an important accountability mechanism. We all have a stake in ensuring Oranga Tamariki improves its privacy performance.'
The notice has been issued in response to a series of privacy breaches reported to the Commissioner that have caused serious harm to whānau and tamariki. It relates to the storage and security of personal information, and its unauthorised disclosure.
Under the compliance notice, Oranga Tamariki will need to make privacy improvements including improving staff skills and capability, and strengthening three areas:
1. Information access settings
2. Oversight of service providers
3. Accountability and reporting of privacy incidents.
These improvements will need to be completed by 31 March 2026.
'I consider the notifiable privacy breaches reported to my Office and the systemic privacy issues identified in an independent review to be significant. This is because the sensitivity of the personal information involved and the vulnerability of the individuals the information relates to is at the high end of seriousness', Mr Webster says.
'Oranga Tamariki currently doesn't have sufficiently robust systems and practices in place to appropriately protect the personal information it holds, as required under the Privacy Act, and there is ongoing likelihood of further privacy breaches.'
OPC began an investigation into the privacy practices and culture at Oranga Tamariki in 2022, and in May 2023 recommended it commission an independent review of its privacy practice and culture.
'That report was completed in April 2024 and confirmed our concerns about systemic failures in protecting sensitive personal information that Oranga Tamariki holds.
'In response to that review, Oranga Tamariki has taken steps to improve their privacy practices, including undertaking a privacy improvement plan, and this is a positive move towards helping keep sensitive information about the children they care for safe'.
'This is a good step forward. However, there is still a considerable amount of work for Oranga Tamariki to do to improve their privacy practices that goes beyond this plan to address the ongoing risk of further serious privacy breaches resulting in harm to individuals.'
Issuing a Compliance Notice, and publicly releasing it, will ensure Oranga Tamariki takes the steps necessary. 'We are all invested in the safety of the children in Oranga Tamariki's care, and keeping sensitive information about children safe is critical.'
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Scoop
3 days ago
- Scoop
Privacy Commissioner Issues Compliance Notice To Oranga Tamariki
Press Release – Office of the Privacy Commissioner Oranga Tamariki has one of the most important roles in New Zealand – to help safeguard the wellbeing of our children, particularly those children in their care. Improving its privacy practices will contribute to the safety and wellbeing of children, their … A compliance notice has been issued to Oranga Tamariki for failing to comply with the requirements of the Privacy Act. The Privacy Commissioner has also taken the step of publicly releasing the Compliance Notice itself. Privacy Commissioner Michael Webster says while Oranga Tamariki has taken positive steps to improve its privacy practices, considerably more improvement is needed. 'Oranga Tamariki has one of the most important roles in New Zealand – to help safeguard the wellbeing of our children, particularly those children in their care. Improving its privacy practices will contribute to the safety and wellbeing of children, their whānau, caregivers, and foster parents Transparency about the nature of the Compliance Notice requirements is in the public interest and is an important accountability mechanism. We all have a stake in ensuring Oranga Tamariki improves its privacy performance.' The notice has been issued in response to a series of privacy breaches reported to the Commissioner that have caused serious harm to whānau and tamariki. It relates to the storage and security of personal information, and its unauthorised disclosure. Under the compliance notice, Oranga Tamariki will need to make privacy improvements including improving staff skills and capability, and strengthening three areas: 1. Information access settings 2. Oversight of service providers 3. Accountability and reporting of privacy incidents. These improvements will need to be completed by 31 March 2026. 'I consider the notifiable privacy breaches reported to my Office and the systemic privacy issues identified in an independent review to be significant. This is because the sensitivity of the personal information involved and the vulnerability of the individuals the information relates to is at the high end of seriousness', Mr Webster says. 'Oranga Tamariki currently doesn't have sufficiently robust systems and practices in place to appropriately protect the personal information it holds, as required under the Privacy Act, and there is ongoing likelihood of further privacy breaches.' OPC began an investigation into the privacy practices and culture at Oranga Tamariki in 2022, and in May 2023 recommended it commission an independent review of its privacy practice and culture. 'That report was completed in April 2024 and confirmed our concerns about systemic failures in protecting sensitive personal information that Oranga Tamariki holds. 'In response to that review, Oranga Tamariki has taken steps to improve their privacy practices, including undertaking a privacy improvement plan, and this is a positive move towards helping keep sensitive information about the children they care for safe'. 'This is a good step forward. However, there is still a considerable amount of work for Oranga Tamariki to do to improve their privacy practices that goes beyond this plan to address the ongoing risk of further serious privacy breaches resulting in harm to individuals.' Issuing a Compliance Notice, and publicly releasing it, will ensure Oranga Tamariki takes the steps necessary. 'We are all invested in the safety of the children in Oranga Tamariki's care, and keeping sensitive information about children safe is critical.'
NZ Herald
21-05-2025
- NZ Herald
TSB blocks probe after staff help customer send $1m to scammers
He told the Herald he is devastated TSB is refusing to waive the Banking Ombudsman's $500,000 financial threshold to allow an independent probe into TSB's actions. He believed this was the last avenue he had to recover any money. Fan accused the bank of trying to avoid public scrutiny and sidestepping potential compensation orders if it was found to have missed crucial red flags. 'It's obfuscation. If they've got nothing to hide, why are they trying to evade the Ombudsman?' TSB is defending its actions, saying there were no 'indicators to suggest fraud or obvious customer vulnerabilities' when Fan made the payments. Given the amount involved and the 'complex and technical' nature of the scam, the bank believed it was more appropriate for Fan to seek review through the courts. Fan, 69, is a Kerikeri retiree who cares fulltime for his sick wife. He was cold-called in late 2022 by a man purporting to be an investment broker for Magnitude Financial. Fan agreed to invest $1m, which he and his wife had saved while running an English language school in Taiwan. Auckland businessman Carel Johannes Viljoen, 61, was found guilty of two counts of money laundering in connection with the scam. Photo / Alyse Wright He thought he was buying low-risk bonds with the Commonwealth Bank of Australia. In fact, the funds ultimately went to an Auckland Westpac account controlled by South African businessman Carel Viljoen. The Beca costings professional was found guilty this year of money laundering in connection with $2m, which was stolen by scammers from Fan and another elderly victim in Rotorua. Viljoen claimed he thought he was part of a legitimate business venture, alleging that Westpac gave him clearance to move the money overseas. But a jury found he was reckless as to whether the large payments coming into his account were the proceeds of crime. He could be jailed for up to seven years when he is sentenced next month. 'I want to make a transfer of almost $1m' During the trial it emerged that Fan made two $1m payments to the scammers, though the bank successfully recalled one. TSB staff helped him make the first by outward telegraphic transfer to an Australian bank in late December 2022. But days after the money left Fan's account he realised the so-called bonds investment was not jointly registered in his wife's name. He contacted the man pretending to be his broker, who instructed Fan to ask TSB to reverse the transaction. The scammers then sent payment instructions for Viljoen's Westpac account. Again, TSB staff helped him transfer $1m by phone. After Viljoen's trial, Fan requested copies of the recorded phone calls from TSB under the Privacy Act and provided them to the Herald. In the first recording, he tells staff he needs to reverse the initial $1m transfer as his broker 'made a mistake'. The staff member reminds Fan that the money has now left his account and it's unlikely TSB will be able to get it back unless the recipient agrees to return the funds. Steven Fan has accused TSB Bank of trying to avoid public scrutiny after he lost $1 million in an investment scam. The recovery application was ultimately successful. Then on January 13, 2023, Fan calls TSB again to make his second payment. 'I want to make a transfer of almost $1m to my broker who's buying some bonds from the Commonwealth Bank of Australia,' Fan says. He explains the money was originally sent to an Australian account, but because of an error, it is now being sent to his broker's New Zealand 'escrow' account. The staff member says she needs her manager to call Fan to finalise the payment because of its size. Fan then emails the staff member payment instruction documents provided by the scammers. On receiving the documents she says, 'It looks like everything I need'. She continues: 'So you mentioned that you're transferring these funds to Magnitude Financial and you will be buying bonds from Australia. Is that right?' Fan replies: 'Yes at the Commonwealth Bank of Australia, but it has to be sent to a New Zealand account.' TSB responds: 'This is not a decision we made lightly' The Herald asked TSB why Fan's apparent vulnerability combined with his cancellation of the earlier $1m payment did not trigger any red flags. We also asked whether he was warned about the possibility of a scam and if staff interrogated him about why money for a supposed Australian bank bond investment was being sent to a Westpac account in Auckland. TSB general manager customer delivery Penny Burgess said staff had several discussions with Fan about the investment. They asked him to confirm what the payment was for and received a 'consistent response'. 'We made further inquiries ourselves internally, which included reviewing the payment invoice. In these inquiries, based on what we knew about the fraud landscape that applied at that time, we didn't identify any indicators to suggest fraud or obvious customer vulnerabilities.' Burgess said Fan's loss was nearly twice the Banking Ombudsman Scheme's financial limit. The scheme's terms and conditions prevented investigations over this threshold unless both parties agreed. 'In this instance, we declined to agree.' Given the significant value of the loss and the 'complex and technical nature' of the scam, TSB believed it was 'more appropriate' for Fan's claim to be considered by the courts. 'This is not a decision we made lightly. The impact this has had on Mr Fan has been front of mind for us throughout this process. That's why we believe it would be best dealt with in a more appropriate setting to achieve an outcome that is fair to all parties.' Banking Ombudsman Nicola Sladden confirmed her office did not have jurisdiction to investigate Fan's complaint, as his loss was above the scheme's $500,000 threshold and TSB had refused to waive the limit. Sladden suggested asking TSB about its decision to block an independent review by her office. Lane Nichols is a senior journalist and Auckland desk editor for the New Zealand Herald with more than 20 years' experience in the industry. Sign up to The Daily H, a free newsletter curated by our editors and delivered straight to your inbox every weekday.
Newsroom
21-05-2025
- Newsroom
When public spending cuts precipitate a meltdown
Comment: Stand by for more blunt cuts to government agencies' staffing and spending in Thursday's Budget – and for potentially more of what a new Auditor-General report identifies as rushed, evidence-free, poor-practice changes to please ministers. Finance Minister Nicola Willis has made clear her second Budget will need to mirror her first in finding savings in state spending to fund new initiatives no longer covered by a reduced operating allowance. Indications are that those public service cuts will again need to be substantial to make her numbers work, for now. Last year, one of the agencies that endured a flat 6.5 percent cut to its voted budget was Oranga Tamariki. Its example in finding the necessary savings to meet the Cabinet's demand leading up the 2024 Budget is salutary for the next wave of spending reductions. A new report from the Office of the Auditor-General into Oranga Tamariki's sudden changes to its contracts with external organisations providing prevention and care services for children would be one of the most scathing to emerge from that office in the past few decades. The Auditor-General points to a cluster of poor practice, bad execution and near non-existent communication from the children's ministry in cutting around $60m in its contract spend, cancelling around 30 agencies' funding for 2024/25 and trying to strong-arm others by not paying its bills on time. The 64-page inquiry report says Oranga Tamariki decision makers did not adequately establish what the changes would mean for the children needing care. Worse, the agency simultaneously moved last year to accentuate a policy of grabbing back from some providers all money it said they underspent and had instead put into their reserves. 'Previously, Oranga Tamariki had generally allowed providers to retain funding even if they had not achieved 100 percent of all contracted measures,' the Auditor-General's office said. 'For example, providers could move funding from under-utilised services to over-utilised services to meet demand.' The process of seeking full return, known as 'reconciliation', saw Children's Minister Karen Chhour publicly declare, without evidence found by the Auditor-General, that some community service providers had used the taxpayer as a 'cash cow' for too long. And at the same time as the cuts to contract funding and the reconciliation demands, OT was also restructuring out about half the relevant staff, some of whom worked in regions liaising with the outside providers being cut. Told it needed to find the 6.5 percent budget cut, it attempted all these changes at once. The result, according to the Auditor-General report, was dire. OT gave notice to providers that equated to a few working hours (not days or weeks) over Matariki weekend in 2024. It did not tell them why they were losing money, would not engage or explain and then it was forced to keep referring children to some of those same agencies for help. It tried to make the agencies losing funding do the work of finding new services to refer children to. It withheld payment to some organisations as a way to force agreement on either new contract arrangements or to enforce returns of the underspent monies from previous years. The inquiry report says OT had no evidence where the money some organisations had in reserve might have come from – for example, other income streams, other government funding lines. It also would not let the agencies redirect the 'underspend' in areas where they had 'overspent' because of demand for care of children. Organisations affected by the contract changes eventually had a reprieve six months later, when Chhour's office announced a delay to the changeover timeline for some funding until December this year. Crucially, the savings programme aiming to cut contracts by $60m to $400m ended up finding just half that because OT had to keep paying transition costs, among other things. Politically, all this was at arm's length. Chhour and the Government can claim the contract problems were operational decisions, as were the decisions to seek 'reconciliation' by taking back underspent monies and also to cut staff involved in managing the contracts. But the defence is thin. A blunt demand for cuts of 6.5 percent spooked an apparently dysfunctional government agency to rush and botch funding changes, with unknown effects on wait times, service standards or service cuts for … children. Chhour repeatedly told opposition MPs in Parliament there had been no change to 'frontline' OT services, but the Labour and Greens MPs retorted then that her definition of 'frontline' to mean OT's own staff working directly with kids was artifice. The Auditor-General's report, so timely in the week before another Budget of expected cuts, cannot say so, but the evidence it lays out and the findings within clearly show the political direction was central to what resulted. 'Oranga Tamariki told us that it received a clear direction from the Minister for Children that Oranga Tamariki needed to focus on its core purpose.' Chhour told the Auditor-General's inquirers that her instruction was not to find savings but to ensure funding went to outcomes sought and were connected to core purposes, without duplication. Given what followed, and OT's focus for months on savings and dollars, that argument amounts to something of an out-of-body-experience. The report says the OT failures 'have harmed trust and confidence' and 'public organisations need to actively demonstrate that they can act as a trusted partner'. 'The services provided under contract support some of New Zealand's most vulnerable children and their families. Therefore it is critical that Oranga Tamariki manages the contracts well.' Something might have been learned between 2024 and the expected further cuts to public agency budgets for the 2025/26 financial year. The Auditor-General sure hopes so. 'The effects of decisions on children and their families are still not known. Given this is the core role of Oranga Tamariki, it is unacceptable for it to be in this situation.'
