Later that month, it was found that thousands of Kiwis had requested replacement driver licences after the Latitude Financial data breach.
The hack victim said if finance companies could not provide adequate data protection guarantees, they shouldn’t be allowed to do business.
“Our information, especially in today’s age, is very valuable and very sensitive.”
He shared some correspondence he received from the Office of the Privacy Commissioner (OPC).
“It’s crazy that it’s taken this long anyway.”
The OPC said it conducted a joint investigation into this data breach with the Office of the Australian Information Commissioner, which regulated privacy in Australia.
“The Australian Financial Complaints Authority (AFCA) have also investigated the breach,” it added.
“Given the number of regulatory bodies investigating this matter, it has been a lengthy and complex process.”
AFCA released some findings last August. It fielded more than 100 complaints and used two of those as lead cases.
In a determination made on December 19, AFCA said Latitude Finance Australia failed to meet its obligation to protect a complainant’s information.
The OPC said the Australian jurisdiction and process differed from New Zealand’s but it might take the Australian recommendations into account when settling local complaints.
It added: “In light of this development, our focus will be on resolving complaints about the privacy breach from individuals in New Zealand.”
The OPC said Section 77 of the Privacy Act gave a chance for complaints to be settled and for Latitude to provide an assurance against repetition of the action.
The office in an email to the complainant late last month said it would “shortly” notify Latitude of the relevant complaints under the Privacy Act.
“We expect that the AFCA lead determinations will provide a useful comparator for purposes of assessing resolution outcomes for the New Zealand complaints.”
The OPC said the victim should tell them by May 11 if he wanted to continue with the complaint.
“If you wish to progress your complaint, it would be helpful to receive any updates from you regarding what harm you have suffered because of this data breach,” it added.
In one of AFCA’s findings, the Australian entity said the breach caused a complainant stress and inconvenience.
AFCA said Latitude offered the complainant some support which ameliorated her loss but “did not offer key supports until around four months after it notified the complainant of the data breach”.
It said Latitude should reimburse the cost of replacing her driver licence.
The Herald approached the Office of the Privacy Commissioner last week for comment.
Patrick Sharp, Aura Information Security general manager, said sometimes information from different breaches was triangulated.
“Ultimately that could be used for something as deep as identity theft.”
He said three years seemed like a long time to progress complaints about the Latitude breach.
“This was at the time, and possibly still is, the largest cybersecurity data breach in New Zealand history,”
He said after an earlier 2022 Medibank data breach, the Australian Government reacted quickly to examine privacy obligations companies had.
“Our Government didn’t really do that.
“That said, if you look at Medibank, the Australian office of the Information Commissioner is still going through the process.”
The Australian Information Commissioner in 2024 filed civil penalty proceedings in the Federal Court over the Medibank breach.
Sharp said companies were often legally required to hold some personal information for a fixed time.
“They should be retaining it for a certain number of years and then destroying it.”
He said Genoapay and Gem breach customers should change driver licences if they hadn’t already done so.
In a February discussion paper, the Government suggested that directors of critical infrastructure entities be responsible for ensuring compliance with minimum cyber security requirements.
BusinessDesk said companies could be fined 2% of annual turnover and directors up to $500,000 for major cyber security failures under proposed regulations.
Stay ahead with the latest market moves, corporate updates, and economic insights by subscribing to our Business newsletter – your essential weekly round-up of all the business news you need.