STATE SERVICES COMMISSION

TE KAWA MATAAIIO

19 December 2019

Dear -

Official Information Request Our Ref: SSCOIA 2019-0260

I refer to your official information request received on 19 November 2019 for:

"all communications including briefings, reports, memos, aides memoirs, cabinet papers and texts regarding the following information:

Around a meeting between the State Service Commission and the Ministry of Arts Culture and Heritage around two data breaches discussed in WPQ 32859 (2019), including all emails on this matter involving Nicola Purvis and Kate Salmond".

On 29 August 2019, the State Services Commission (SSC) staff met with Ministry of Culture and Heritage (MCH) staff.

This meeting was scheduled to discuss the MCH approach to the independent review into the Tuia 250 matter, how the engagement would be managed internally, and to provide support in answering Official Information Act requests and parliamentary questions regarding this matter. MCH's previous data breaches came up in conversation as part of the context to the proposed answers to parliamentary questions.

Information being released l have interpreted your request as being for the information that SSC holds regarding the two data breaches that were discussed at the meeting between SSC and MCH on 29 August 2019. Please f ind enclosed following documents which we have found within the scope of your request.

nmm iiu,- ..... ~ i•t,..._ , _ ■-:~ ii,~ I . . • ... 1 17 September 2019 Email titled - Re: Advice please - Tuia PQs Released in Part

From Heather Baggott to Nicola Purvis

2 17 September 2019 Email titled· - RE: Advice please - Tuia PQs Released in Part

From Nicola Purvis to Aaron Lloydd

I have decided to release the relevant parts of the documents listed above, subject to information being withheld under one or more of the following sections of the OIA, as applicable:

• section 9(2)(a) - to protect the privacy of natural persons, including deceased people

If you wish to discuss this decision with us, please feel free to contact Ministerial. Services@ssc.govt.nz.

2 The Terrace

PO Box 329 Wellington 6140

New Zealand

Phone +64-4-495 6600

www.ssc.govt.nz

You have the right to seek an investigation and review by the Ombudsman of this decision. Information about how to make a complaint is available at www.ombudsman.parliament.nz or freephone 0800 802 602.

Please note that we intend to publish this letter (with your personal details removed) [and enclosed documents] on the State Services Commission's website.

Yours sincerely

~ Nicky Dirks Managing Principal - Ministerial Services State Services Commission

Neha Pawar

From: Heather Baggott Sent: To:

Tuesday, 17 September 2019 12:37 PM Nicola Purvis

Cc: Kate Salmond Subject: Re: Advice please - Tuia PQs

Hi Nicola - I wonder if they need to get that kind of assessment from DIA's Chief Privacy Officer?

I think at best we can say that based on an initial discussion at which the breaches were broadly discussed, they

sounded like they were "low level" and not of a similar nature to the Tuia breach.

Heather Baggott Assistant Commissioner I g(2)(a) privacy

Te l<awa Mataaho I State Services Commission

On 17/09/2019, at 11:53 AM, Nico la Purvis 9(2)(a) privacy w rote:

Are you two okay to say that we told MCH (when we met with them) that t here previous privacy breaches were low

level?

Thanks Nicola

From: Aaron Lloydd 9{2)(a) privacy

Sent: Tuesday, 17 September 2019 11:41 AM To: Nicola Purvis <32J(a) privacy Cc: Sarah Marten'912)(a) privac.:,;y====::.. ; Sa rah Ingram J9(2Ra) privacy ,__ ________ __, Subject: Advice please - Tuia PQs

Hi Nicola

The Prime Minister's office has asked for some changes to t he answers to our parliamentary questions. One in particular relates to SSC and the meeting you, Kate, and Heather attended at MCH on 29 August, and I wanted to run it past you to make sure you were ok. You'll recall we discussed the 2 previous data breaches, both of which were unrelated to Tuia and very low level. Are you comfortable if we say, in relation to those ...

"The Ministry has subsequently d iscussed the matter with officials from the State Services Commission, who agreed

that the breach was low level."

Any thoughts?

Thanks for having a look at this

Aaron

Aaron Lloydd I Poutoko Ture - Chief Legal Advisor Manatu Taonga - Ministry for Culture and Heritage Promoting a confident and connected culture Public Trust Office Building, 131-135 Larnbton Quay PO Box 5364, Wellington, New Zealand

9(2){a) privacy

1

This email is confidential to the Ministry for Culture and Heritage and may be privileged. If this email is not intended for you, do not use, read, distribute or copy it. Please delete the email and any attachments and notify the Ministry for Culture and Heritage immediately.

This is an email between the Ministry for Culture and Heritage and the intended recipients only. It may conta in privileged material If this email is not intended for you do not read, use, distribute or copy it. Please notify the sender immediately and then delete the email and any allachments.

2

Neha Pawar

From: Nicola Purvis Sent: To:

Tuesday, 17 September 2019 1:22 PM Aaron Lloydd

Cc: Subject:

Sarah Marten; Sarah Ingram RE: Advice please - Tuia PQs

Hi Aaron

I remember agreeing the other two breaches seemed low level, but it would probably be fairer to record that our view was based on limited information provided orally. Maybe something like:

"The Ministry has subsequently discussed the matter with officials from the State Services Commission, who agreed that, based on t he summary information provided, the breaches appeared to be low level."

If you want a more definitive view, maybe the Government Chief Privacy Officer is the place to go?

Nga mihi Nicola

Nicola Purvis Chief Legol Officer

J9(2}(a} privacy

Te Kawa Mataaho I State Services Commission www.ssc .govl.nz I www.govt.nz

From: Aaron Lloydd <Aaron.Lloydd@mch.govt.nz> Sent: Tuesday, 17 September 2019 11:41 AM To: Nicola Purvis <nicola.purvis@ssc.govt.nz> Cc: Sarah Marten <Sarah.Marten@mch.govt.nz>; Sarah Ingram <Sarah.lngram@mch.govt.nz>

Subject: Advice please - Tuia PQs

Hi Nicola

The Prime Minister's office has asked for some changes to the answers to our parliamentary questions. One in particular relates to SSC and the meeting you, Kate, and Heather attended at MCH on 29 August, and I wanted to run it past you to make sure you were ok. You'll recall we discussed the 2 previous data breaches, both of which were unrelated to Tuia and very low level. Are you comfortable if we say, in relation to those ...

"The Ministry has subsequently discussed the matter with officials from the State Services Commission, who agreed

that the breach was low level."

Any thoughts?

1

Thanks for having a look at this Aaron

Aaron Lloydd I Poutoko Ture - Chief Legal Advisor Manatu Taonga • Ministry for Culture and Heritage Promoting a confident and connected culture Public Trust Office Building, 131-135 Lambton Quay PO Box 5364, Wellington, New Zealand ' (2)(a) privacy

This email is confidential to the Ministry for Culture and Heritage and may be privileged. If this email is not intended for you, do not use, read, distribute or copy it. Please delete the email and any attachments and notify the Ministry for Culture and Heritage immediately.

This is an email between the Ministry for Culture and Heritage and the intended recipients only. It may contain privileged material. If this email is not intended for you do not read, use, distribute or copy ii. Please notify the sender immediately and then delete the email and any allachments.

2