Lake Alice data breach: Minister Erica Stanford asked Sir Brian Roche to personally sign apologies to survivors

The staffer was meant to send the bulk email to survivors using the blind carbon copy, or “bcc”, function, which hides email addresses of recipients from each other. But the person accidentally used the carbon copy, or “cc”, function and inadvertently exposed the email addresses of the recipients to anyone else who received the message.

The CRO chief executive apologised at the time and the staff member immediately apologised to each of the survivors and acknowledged this was unacceptable.

In her letter to Roche, Stanford said most survivors on the individual pathway had not spoken publicly about their experiences, and some had not even disclosed to the people closest to them that they were at Lake Alice.

“Protecting their names was critical not only to maintaining their trust in the redress process but also in ensuring that additional harm and distress was not caused to them by the state.”

She said survivors of torture had agreed to participate in the redress process under the commitment their privacy and confidentiality would be strictly safeguarded, including from other survivors engaged in the process.

The investigation is expected to be completed in April. The purpose of the review is to assess what happened and what improvements may be needed. A Public Service Commission spokesperson said the review would also look at whether staff followed the correct policies and processes when preparing and sending the email, the decisions that were made, and whether the checks in place were adequate. It would also identify any changes required to prevent a breach from happening again.

Stanford said in her letter she was “deeply concerned” the “purported apology” for the breach was “insufficient and not appropriate”.

“For example, it did not acknowledge that distress would have been caused by the disclosure of their personal details and it presumed survivors would be ‘understanding’ of their privacy being breached.”

Stanford also requested the individual responsible for the breach did not attend meetings with officials while the investigation was ongoing.

She said she expected the CRO to work directly with survivors’ lawyers on individual formal apologies and that Roche should sign each of these apologies.

“As the Prime Minister is personally signing apologies to survivors for the torture they suffered at the Lake Alice Unit, I consider it appropriate you as Public Services Commissioner personally signs out these apologies given that the Crown Response Office resides with the Public Service Commission.”

In a statement, a spokesperson for Roche said he agreed with the minister that the incident was unacceptable and harmful for survivors.

The Commissioner takes these matters very seriously, and an independent review is carefully examining what happened and why, the spokesperson said.

“Until this important work is finished, it would not be appropriate, nor fair to the survivors impacted by the privacy breach, to discuss any response, changes or actions that may be needed.”

A series of meeting notes obtained by the Herald under the Official Information Act imply Stanford’s office had not wanted the CRO to send emails directly to survivors.

In a meeting with CRO chief executive Rajesh Chhana on the day of the breach, Stanford asked: “Why did you [CRO] do this [send emails directly to survivors]? You were told not to and that emails needed to go to the lawyers.”

Stanford says in that meeting the incident was “totally unacceptable” and the CRO “have to own this”. According to the meeting notes, Chhana told her 32 of the 37 email addresses used belonged to survivors. A message had been left with the independent arbiter Paul Davison, KC, and the CRO was preparing media lines, he said.

In a follow-up meeting with another executive from the CRO on December 9, Stanford said she had spoken to a survivor who was “terrified” and the situation was “really serious”.

She said it would be hard for someone to appreciate how serious the situation was if they didn’t understand the context of Lake Alice.

Last year, the Government formally acknowledged that what some children and young people experienced at the psychiatric hospital amounted to torture. In the 1970s patients at Lake Alice were given electric shocks without anaesthetic, as well as painful and immobilising paraldehyde injections.

As the independent arbiter described in his report, instead of being treated therapeutically for whatever reason or issue led to them being patients at Lake Alice, the survivors’ accounts indicated some of these young people were “tortured and ill-treated in what was a cruel and malevolent process wholly inconsistent with proper standards of medical and nursing care for vulnerable children”.

Prime Minister Christopher Luxon, who delivered a formal apology to abuse in care survivors, said what the Lake Alice survivors went through was “profoundly disturbing” and “reprehensible”.

Julia Gabel is a Wellington-based political reporter. She joined the Herald in 2020 and has most recently focused on data journalism.