Michael Webster: Privacy Commissioner chats growing problem of unauthorised employee snooping on private information

Privacy Commissioner Michael Webster says that cases of unauthorised employees snooping on private information are growing.

He told Heather du Plessis-Allan "it looks like at least 1 in 10 cases are employee browsing, and a greater percentage, up to a third, are, are what we call unauthorised access. So, people who have a right to look at material, but only for work purposes, and they're using it for their personal purposes."

LISTEN ABOVE

See omnystudio.com/listener for privacy information.

Episode Transcript

Speaker 1 (00:00):
Now, the Privacy Commissioner says, employee snooping on members of
the public's private personal information is a bit of a
growing problem. We're talking about delivery drivers using your address
to get in touch outside of their work, or doctors
getting creepy with the patients, that kind of thing. Privacy
Commissioner Michael Webster's with us on this.

Speaker 2 (00:16):
Hig Michael, Hello, Heather, how are you.

Speaker 1 (00:18):
I'm very well, thank you. How many cases you're getting
of this?

Speaker 2 (00:22):
Our statistics for the year just finished, it looks like
at least one in ten cases are employee browsing, and
a greater percentage, up to a third, are what we
call an unauthorized access, So people who have a right
to look at material but only for work purposes, and
they're using it these personal purposes for the things you

(00:43):
talked about.

Speaker 1 (00:44):
Worst case you've come across.

Speaker 2 (00:47):
In one example, we had a person who was in
a position of power and they looked at the details
of a colleague's partner and then use their position to
repeatedly sexually harass them their text message. The victim contacted us.
They said they felt, of course intimidated, scared, even fearful
in their own home and that's just terrible that kind

(01:08):
of behavior, Okay.

Speaker 1 (01:09):
And in all of these cases, is that the person
being contacted or harassed who is coming to you with
a complaint.

Speaker 2 (01:16):
Sometimes organizations do have what we expect, which is systems
in place to identify that unauthorized access to the information
databases has happened, So they sometimes notify us of the
privacy breaches, but also have individual complaints as well.

Speaker 1 (01:33):
Okay, So what happens if you come across one of
these cases? What do you do?

Speaker 2 (01:38):
Well? If a breach is reported to us, we will investigate.
We'll ensure that the organization in question has taken steps
to notify the people affected. If an individual comes to
us with a complaint, we'll make sure that they're a
first approach the organization concerned to see if they can
resolve their complaint that way. Otherwise we will investigate what's

(02:00):
happened and see whether they're right to privacy has been
interfered with, and whether there should be some compensation or
some settlement of that.

Speaker 1 (02:09):
Michael, is there ever a case in which you know, gosh,
I'm walking a line here, but is there ever a
case in which you know, you get hold of somebody's
details in your job and you get in contact with
them and it's you know, and you would deem that
yourself in your position to be okay because it's modern
life and this could be the love of their life.

Speaker 2 (02:31):
So what we say in the area of privacy, it's
about balancing interests, the individual's right to privacy and the
public interests good things like law and order or public health.
If there was a strong public health reason for breaching
that kind of database security or strong law and order reason,
that's the sort of thing we might look at. But

(02:52):
at the end of the day, New Zealanders need to
know that when they hand over really sensitive personal information,
say their medical records, their children's medical records to a school,
for example, don't want to know that that information is
going to be held securely and only accessed by those
who have the right to see it.

Speaker 1 (03:10):
What I'm meaning is, say girl goes into the footstore,
a shoe store by pairs of sneakers, has an account there.
The guy behind the counters like Jesus, I like the
look of her, calls her after ours and says, you
want to go out on a date? Would that ever
be okay?

Speaker 2 (03:25):
I don't think so. I think that is using that
personal information for absolutely the wrong reason. There is only
one reason that information is being collected, and that's for
the store's business purposes. It's not for the personal purposes
of that sales assystem for example.

Speaker 1 (03:39):
Okay, so basically the rule of thumb is if this
information is being collected at work, you are not to
use it for any personal reasons.

Speaker 2 (03:46):
That's right.

Speaker 1 (03:47):
Yeah, Michael, thanks very much, really appreciate it. Man, you
have a lovely weekend. That's Michael Webster, Privacy Commissioner. So
don't think about it if you're working in the shoe store.
For more from Hither Duplessy Allen Drive, listen live to
News Hawks it'd be from four pm weekdays, or follow
the podcast on iHeartRadio.