The Earthquake Commission has been forced into an embarassing admission that details of all 83,000 clients in its Canterbury Home Repair programme were accidentally sent to the wrong address.
On Friday, the commission said the details of 9721 customers had been mistakenly sent in a spreadsheet to the wrong e-mail address.
But on Monday afternoon EQC chief executive Ian Simpson admitted the spreadsheet in question can be manipulated to show the details of every Christchurch claimant on its books, after Labour Party MP Lianne Dalziel raised the matter.
The information did not include customers' names.
Mr Simpson has again apologised for the lapse, which he has put down to human error.
He says the recipient and four others in the room at the time saw the information, which has now been destroyed.
He says last Friday when the commission announced there had been a privacy breach it wasn't aware of how bad it was.
"Our focus on Friday was to contain the breach, to ensure the information had been destroyed, and then to talk to the media and the public to be fully accountable for that. With hindsight we should have spent more time
examining the spreadsheet. I understand the data was hidden in the pivot table."
(A pivot table is a data summary tool.)
Earlier on Monday the commission was adamant the e-mail had been examined and no other client information was contained in it, something Mr Simpson now acknowledges was not the case.
Ms Dalziel had said details of 67,745 claims were sent to the address.
Initially EQC claimed its number of just under 10,000 was right and that Ms Dalziel was wrong.
But since then staff talked to Ms Dalziel, who told them how to access the details in the spread sheet.
She says the information is hidden in pages behind the page that EQC worked from.
"What this shows is that either EQC is incompetent and that they don't know what data they are handling or they are now covering up the scale of the data breach, which in my view amounts to the largest such event in New Zealand's history."
Earthquake Recovery Minister Gerry Brownlee wants an investigation into how the details were mistakenly emailed to the wrong person.
Mr Brownlee told Checkpoint the breach should not have happened and he wants to prevent the mistake from being repeated.
