Security concerns over info sharing

''All the women we work with are very sensitive about where their information goes." Marlborough Women's Refuge manager Rachel Black

A new policy on collecting personal details from clients of services funded by the Ministry of Social Development will exclude sexual violence victims for the first year as the security of the new system is tested.

But the change raises concerns about the security of information from other clients when the policy is rolled out in July, a Women’s Refuge manager says.

Marlborough Women’s Refuge manager Rachel Black said she was pleased that the Government was reviewing the policy, but the exemption should be extended beyond just sexual violence victims.

‘‘What about domestic violence victims? I don’t know how they can exempt one and not the other. All the women we work with are very sensitive about where their information goes.’’

The policy would require organisations with ministry contracts to provide the name, date of birth, address, gender, ethnicity, iwi and country of birth of clients, as well as the number of children and date of birth of a client’s youngest child.

Programmes or services used by the client would be recorded, as would a source of referral, and a start date and an end date.

If the ministry was worried about the security of information for sexual violence victims, it should be worried about the security of other information, Black said. ‘‘How can they even be rolling it out if they can’t guarantee the safety of others?’’

Ministry deputy chief executive Murray Edridge said the purpose of the policy was to analyse the effectiveness of organisations funded by the ministry.

The Privacy Commissioner was reviewing the policy to ensure clients’ privacy rights were protected.

Social Development Minister Anne Tolley said specialist sexual violence services were being treated as a separate case because she wanted to ‘‘make sure we get this right’’.

She met with both the Privacy Commissioner and Rape Crisis earlier this week to discuss their concerns. ‘‘Part of this work includes looking at what needs to be in place so these providers can collect and securely store what is incredibly sensitive information from those using their services,’’ Tolley said.

As this work was ongoing, Tolley decided sexual violence providers would be exempt for at least 12 months.

The Office of the Privacy Commissioner was expected to report its findings later this month.