• Home /
• Your responsibilities /
• Privacy breaches /
• Breach case notes

Your responsibilities

Case notes are a great way to learn about privacy by understanding how others have responded to a breach. We anonymise them and explain what happened and what outcomes there were.

Disposing of personal information

Organisations must not keep personal information for longer than they need it. If your organisation is finished with personal information, you must dispose of it securely to avoid a privacy breach.

• Medical practice recycles paper with personal information on it
• Prescription labels leak out of health agency’s rubbish
• Mobile phone on-sold without deleting previous owner's information

Loss and theft of personal information

Physical security is an important part of protecting personal information, whether it’s in a paper file or a on device such as a laptop or smartphone. Sometimes it’s necessary to take personal information out of the workplace, but it does increase the risk of it being lost or stolen.

• Sensitive file burgled from social worker’s home
• Government department employee drops file on the street
• Medical practice mitigates harm after USB is stolen

Sending personal information to the wrong recipient

This is the type of breach that agencies most commonly report to us. Always double-check that the address is correct before you send information and have other systems in place that will help prevent or mitigate a breach.

• Naming documents clearly
• Agency averts harm by recalling email
• Recruitment agency discloses applicant's email address to other email recipients
• Power company discloses man’s address to estranged ex-partner

Disclosing personal information inappropriately

Under the Privacy Act, organisations cannot disclose personal information unless a specific exception applies. Disclosing information when an exception doesn’t apply can lead to a privacy breach, even if it was unintentional.

• Company accidentally discloses debtor details
• Hospital employee discloses health information about a woman to a mutual friend
• Daughter's photograph used to promote holiday programme
• Parents complain school mishandled their child’s sensitive medical data
• Patients’ sensitive medical information disclosed by receptionist

Storage and security

Organisations have an obligation to store personal information securely. System errors, scams and employee browsing can all lead to a security failure.

• Testing systems with real data leads to breach
• Don’t bite when a phisher calls
• Woman accesses estranged brother’s IRD file
• Holding on - your responsibility to protect personal information
• Keeping it professional