An investigation has been launched after Wellington City Council committed a “serious harm data breach” by releasing personal details of people involved in road crashes including the names of drivers and medical details such as blood alcohol levels and drug use.

The data was extracted by the council from Waka Kotahi and details 1876 crashes involving 4224 people. Some of the crashes have been the subject of court cases.

In many cases, the names of the drivers, car registration numbers, and driver’s licence numbers were released. Sometimes statements from drivers with their accounts of the crashes were provided as well as medical details like hospitalisations, blood alcohol levels, and whether they were under the influence of drugs.

Senior council staff notified the Office of the Privacy Commissioner today and the council will launch an independent investigation.

A spokesperson for the Office of the Privacy Commissioner said the council first needed to investigate to ascertain the size, scope, cause and impact of the breach.

“Our focus in these early stages is to provide agencies who have experienced a serious harm breach with advice on how to minimise the harm caused by the breach on the individuals impacted.

“As with any serious harm data breach, once the council has finished their investigation, we will be interested in what caused the breach and what the council has done to prevent breaches of this kind occurring again.”

Wellington Mayor Tory Whanau said she was extremely disappointed and frustrated.

The council extracted data from Waka Kotahi’s Crash Analysis System as part of an analysis of options to reduce speed limits across the city.

This database is publicly available with careful redactions but the council has direct access to the raw data under an agreement with Waka Kotahi.

Waka Kotahi provided a copy of that agreement to the Herald. It said information should not be used in a way that identifies individuals involved or published in a way that could reasonably be expected to identify them.

The council, however, did not scrub private details before undertaking its speed management analysis. The spreadsheet was then publicly released under the Local Government Official Information and Meetings Act (LGOIMA).

Wellington City Council acting chief executive Stephen McArthur apologised and said the council wanted to get to the bottom of it.

McArthur said the council took its responsibilities to protect personal information seriously and he found this disclosure “very concerning”.

After the spreadsheet was released under the LGOIMA in July 2022, it was subsequently published on the FYI website, which publishes OIA requests, meaning any member of the public could view the response.

As soon as the Herald learned of the breach yesterday morning, the FYI website was contacted which restricted access to the spreadsheet.

It was released to Tony Randle in his capacity as a private individual. Randle was elected as a Wellington City Councillor later that same year in October.

Wellington Mayor Tory Whanau said she was extremely disappointed and frustrated. Photo / WCC

Randle said he had completely forgotten about the spreadsheet when he recently asked council officials, in his capacity as a councillor, for their analysis of a plan to drop speed limits on most streets in the city to 30km/h.

Officials gave Randle the same spreadsheet as in 2022 and officials cited the need to keep private details confidential.

Randle said he did not share the spreadsheet with anyone else and only took a couple of screenshots of parts of it that did not include private details. There is no suggestion Randle is at fault in relation to the data breach.

Randle used the spreadsheet to find council officials miscalculated the cost-benefit analysis of a plan to reduce speed limits in the city. The benefit of reducing crashes was overstated by more than $250 million.

Whanau has asked McArthur to instigate an independent investigation, given the seriousness of the situation.

“I can’t express how frustrated I am at the data breach, coming as it does on top of the human error made in calculations regarding the 30kmh speed limit. It’s just not good enough.”

A member of the public alerted the Herald to the 2022 spreadsheet and a potential privacy breach in an email late on Monday night.

Disclaimer: The New Zealand Herald supports the web-hosting of FYI.org.nz and provides technical support for the operation of the website. The Herald has offered this support because it believes that the Official Information Act is an important institution and that this website is a valuable public service. FYI is an Open NZ project, and run by volunteers independent of The New Zealand Herald.

Georgina Campbell is a Wellington-based reporter who has a particular interest in local government, transport, and seismic issues. She joined the Herald in 2019 after working as a broadcast journalist.

For more local politics news and views from Georgina Campbell, listen to On the Tiles, the Herald’s politics podcast