EQC Privacy Breach Email to Claimants Too Slow

Ten days is too long.

That from insurance claimant advocate, Ali Jones.

EQC has today made contact with homeowners via email after accidentally releasing confidential details of 8000 insurance claims on May 26.

Jones says although she has not received an email, she has seen it and a number of friends, were emailed today.

“The common response I have had from them is, why has it taken so long for EQC to make contact with claimants? And I think that’s a fair question. It would also be good to know where the information is now?” she says.

The email from EQC’s Chief Executive, Sid Miller, says “The customer and lawyer who received the information were contacted immediately and we are working to ensure that the information is destroyed.”

“This is a great deal of personal information about a very large number of people and their claims. I am sure some claimants are quite stressed about where that information is, and I think EQC should be clearer about that and what they are doing to sort the situation,” says Ms Jones.

Claimant *Mary Thomas, who battled with EQC for seven years before her claim was put over cap, says she is appalled by the time it has taken EQC to contact people who had their information leaked. She heard about the security breach on the radio in late May and assumed their details weren’t a part of the 8000 because they hadn’t been contacted; until today.

“Over the past fortnight, EQC has not only spoken to media, they have contacted the Privacy Commissioner, the unintended recipients of this information and correctly taken steps to rectify the situation and ensure this does not happen again. I am incredibly disappointed that notifying those of us whose privacy was breached was not higher up their priority list,” she says.

Mrs Thomas says she’s actually less worried about the breach itself and hopes the poor staff member is being supported.

“Mistakes are made and no one is infallible but why has it taken EQC so long to contact us? I am not surprised but am deeply disappointed that EQC is continuing to put communicating with those impacted by their failings at the bottom of their priority list,” she says. “It has been nearly 10 years since the 4 September earthquake, EQC’s communications issues should have been fixed by now.”

On a lighter note, Mrs Thomas adds that after trying for years to get all of her claim information from EQC, it’s good to see someone now has it all in one place.

 

*Name has been changed for privacy reasons.

 

The email sent to claimants today:

Claim Number: CLMXXXXXXXX

4th June 2020

Sent by email to: XXXXXXXX

Dear XXXXXX

On 21 May 2020 a staff member unintentionally sent a spreadsheet to a customer and their lawyer containing information regarding approximately 8000 EQC customers’ claims. Unfortunately your claim details were included.

Please accept my sincere apologies for this error. EQC has made a concerted effort to make sure customer information is as secure as possible and increased the level of security checks, but regrettably this mistake has still occurred, and I apologise to you for this.

The spreadsheet contained the following information fields: claim number, name, address, private insurance company, EQC cap amount, apportionment and amount paid/estimated.

As soon as we became aware of the breach, we took prompt steps to rectify the error and notified the Office of the Privacy Commissioner. The customer and lawyer who received the information were contacted immediately and we are working to ensure that the information is destroyed.

EQC takes the security of its customers’ information extremely seriously as we handle thousands of documents and files each year. We continue to strengthen our training and processes for keeping information secure as well as maintaining a high staff awareness. Additional measures have been put in place since the breach including, management of emails and documents, and additional quality checking.

We follow the guidance provided by the Office of the Privacy Commissioner, their website www.privacy.org.nz provides information which may be of help if you are concerned about what steps, if any, you may want to consider in response to the breach.

Further Information
If you require further information or wish to make a formal complaint to EQC about the breach, please phone 0800 DAMAGE (0800 326 243) between 7am-9pm Monday-Friday or email us at info@eqc.govt.nz

Yours sincerely,

[Sid Miller]

Sid Miller
Chief Executive Officer