In a statement just issued, the Commission says it was informed last week that more than 200 meeting and interview transcripts across a range of the Commission’s work were contained on computer equipment stolen in a burglary.
According to the Commission the transcripts may date back to early 2016 and contain some confidential information businesses and individuals have provided the Commission.
But the Commission says its own network and systems have not been breached, and the information potentially contained on the stolen computer equipment does not include any documents or general consumer complaints provided to the Commission.
“We are in the process of contacting those affected to discuss the details of the information potentially compromised. Some of the information is subject to a confidentiality order issued by the Commission under section 100 of the Commerce Act,” Meikle said.
“This makes it a criminal offence for any person in possession of the devices or information from the devices to disclose or communicate it to anyone while the orders are in force. We are also exploring other potential legal avenues to help protect the confidentiality of the information.
“We will also no longer be using the external provider. It was subject to contractual and confidentiality obligations to ensure that information was stored securely and deleted after use. The provider has informed us it did not meet these obligations.
“While this breach has resulted from criminal activity and our provider failing to meet the obligations we placed on it, it is our job to keep sensitive information safe and we apologise unreservedly to those affected. We acknowledge the distress this incident may cause businesses and individuals who have provided information to us in confidence.”
Commission Chair Anna Rawlings said two separate independent reviews have been initiated in response to the security incident and, in addition, the Commission will be contacting its third-party suppliers to seek assurances that they are meeting its expectations in relation to information handling and have systems and processes in place to protect its information.
“Information security is crucial to our role and it is vital that those who interact with us can be confident in our ability to protect confidential and commercially sensitive information. We have engaged Richard Fowler QC to undertake an independent review of the circumstances that led to this specific incident.
“Separately, we have also engaged KPMG to review our information handling processes, including third-party supplier engagements. These reviews will report directly to me and the Commission Board. We will make the findings public once we have considered them and any recommendations made.”