NSW police apologise for sending email with sensitive information to wrong person
When a sensitive email from New South Wales police landed in Richard McDonald’s inbox earlier this month, he could scarcely believe the irony.
The email, obviously not intended for him, contained confidential and personal information about a woman police had just fined for a Covid lockdown breach in questionable circumstances.
Officers had believed the woman’s work checking grocery stock levels for a distribution company was not essential under Covid-19 restrictions.
It was bad enough that police sent the material to McDonald, a civilian who had nothing whatsoever to do with the case, in an apparent case of mistaken identity.
Worse still was the fact that McDonald had just won his own case against NSW police months earlier, after it had breached his privacy in precisely the same way.
Perhaps most ludicrous of all though was the fact that McDonald’s case had prompted the Information and Privacy Commission to warn NSW police to change its systems to avoid further breaches and “remind staff of the importance … of addressing emails correctly”.
It appears NSW police were attempting to send details of the case to a lawyer with the same name as McDonald.
The embarrassing blunder has now prompted an apology from NSW police and a fresh complaint to the privacy commissioner.
McDonald said the fact that a forward commander of the police operations centre sent him the confidential material should pose serious questions by the privacy commissioner.
“They didn’t even know of the breach until I contacted them and told them,” he said.
“Given the levels of access to personal information that the [NSW police force] enjoys, this incident highlights precisely why privacy protection should have paramount importance to the NSWPF.”
NSW police said it had since apologised to “all those involved”.
“The NSW Police Force is aware of an incident in which an email was sent in error to an individual and an apology has been made to all those involved,” a spokesperson said.
“The NSW Police Force treats the privacy of personal information in strict confidence.”
Privacy has been a persistent problem for NSW police.
Last year, more than 150 people had
their personal email addresses leaked after complaining about the use of capsicum spray against protestors at a Black Lives Matter rally in Sydney.
NSW police emailed one man, Samuel Leighton-Dore, to tell him his complaint about excessive use of force had been dismissed. It sent him a second email, not intended for him, and copied in the personal email addresses of about 150 other people who had lodged complaints.
The incident prompted an internal investigation.
In McDonald’s case, he had submitted a request for information held by NSW Police through the state’s Government Information (Public Access) Act 2009.
Police wrongly sent their decision on his request, including his personal information, to a stranger, despite him confirming the correct email address earlier.
Police tried to tell the Information and Privacy Commission that the mistake had been the result of a “typographical error”.
The IPC said there was “no evidence before me that justifies this conclusion”.
“The Commissioner has not produced evidence from the person who sent the email explaining why the wrong email address was used,” he said. “A number of explanations suggest themselves, both innocent and otherwise.”
NSW police were urged to investigate whether they could automatically populate email addresses from its case management systems and use read receipts for important emails.
The IPC also directed police apologise to McDonald. He only received the apology on Friday. The Guardian also understands NSW police only emailed staff reminding them of the need for email address accuracy on Friday.