Paul Holmes interviews Ralph Stewart
PAUL ACC - accident compensation. Its been a year of controversies and complaints around ACC. As a result, inquiries by the police and the Privacy Commissioner are being conducted. The ACC Minister, Judith Collins, is threatening to sue two Labour MPs for defamation and says the corporation needs to rebuild public trust. And yet last week ONE News revealed yet another privacy breach involving the private financial details of more than a hundred ACC clients being sent to the wrong people, so whats going on? The ACC chief executive, Ralph Stewart, is with us live. Good morning.
RALPH STEWART - ACC Chief Executive
Good morning, Paul.
PAUL Youve been in the job, what, six or seven months?
RALPH Seven months.
PAUL Seven months? You come from- You were head of AXA?
RALPH Yes, I was.
PAUL Youve come from a very successful private-sector company. How would you describe your first six months in the public service?
RALPH (laughs) Its been a baptism of fire, Paul, quite genuinely, but Im enjoying it. Its very challenging. ACC, in particular, is an organisation thats quite different to a private-sector insurance company. Its deep and rich in New Zealand, both in a financial sense and a social sense, and Im really enjoying that.
PAUL Right, now, when it comes to the security lapses, these privacy breaches, how seriously do you take them?
RALPH Immensely seriously. Can I-?
PAUL Why do we-? Go on.
RALPH Can I give you three examples of what were doing in terms of privacy at ACC?
PAUL All right.
RALPH The first example is weve conducted a complete independent report thats now halfway through. Its been conducted by KPMG as experts and also has on the panel the ex-Federal Privacy Commissioner out of Australia. Itll be completed by June. Itll be made public. Secondly, in terms of privacy, I think one of the key influences of privacy is development of the digital age. As a consequence, were sending a lot more files out electronically, ie, attaching things to emails. So weve commissioned a second piece of work to look at the infrastructure in ACC and say, How can we take us from where we are in terms of client records and privacy and take us to world best practice? And thirdly, if I may just quickly, is weve commissioned 80 privacy champions through the ACC network to constantly monitor, maintain and raise awareness for privacy in ACC.
PAUL Well, that seems a very effective package, but, you know, we still have to ask the question - why are we suddenly getting these substantial leaks of private information? Youre not getting them from Work and Income. I cant think of any other government department or government corporation that is leaking willy-nilly to the tune of thousands of peoples files.
RALPH I understand, Paul.
PAUL Why is this suddenly happening?
RALPH Can I try and give it some context? ACC is a
very large, complex organisation. To give that some content,
for example, were talking about almost 160 claims per hour.
Were talking about 140,000 per month, 1.7 million per year.
Its a very busy, complex organisation. I think a sense of
context helps to understand the privacy issues.
PAUL Yeah, I mean, youve got an incredible workload. People understand that, Im sure. Perhaps unfortunately dont. Look, this whole fuss started, didnt it, Ive got to ask you about Bronwyn Pullar - Miss Pullar. It started with the release of the 6500 claimants names and info to this particular person, Bronwyn Pullar. Now, you claim that she threatened ACC at this particular meeting that she attended. She says she did not. We understand she has sent ACC a transcript showing she was not blackmailing or threatening. Why continue with this police complaint against her?
RALPH Paul, I want to be as helpful this morning as I possibly can. There are two things that prevent me from going further on this particular issue. Now, the first is Bronwyn Pullar is a client, and I wont talk about client issues on air, and second-
PAUL I dont want you to be specific, but what Im saying to you is taking this police complaint against this particular person looks vindictive - big company against little person. Hows that helping you gain the hearts and minds- the hearts of New Zealanders?
RALPH Paul, I really want to be helpful, but the review for the Pullar case has to play out first.
PAUL Ms Pullar is not well - thats the point Im trying to make. She admits that. She has a head injury.
RALPH Shes a client, and we support her in every way we can.
PAUL No, youre not. Youre taking police action against her. Im sorry Im distracting here. Im fiddling around with the microphone. Theres something urgent with that.
RALPH Its okay.
PAUL Yeah, I mean, shes a client, and she wanted some action, and she feels wrong done by.
RALPH Were managing her case as we can under legislation and as carefully and sensibly as we can through ACC.
PAUL Look, I dont want to bore in on this. I promise you we will not have this for the whole interview, but the thing that Im saying to you is your ministers said youve got to restore trust amongst the public of New Zealand, and here you are slamming down on an injured single person the might of ACC.
RALPH Paul, again, I bring you back to-
PAUL And you apparently have a transcript saying it wasnt a threat, showing it wasnt a threatening meeting.
RALPH I know youre trying to challenge this particular point. It would be wrong of me for both Bronwyn and for ACC and for all those involved for me to talk further about that case. If I can revert back to context, ACC is a critical part of New Zealands infrastructure. Bronwyn is one of 1.7 million claims last year. If you think about the context, the amount of support we provide in New Zealand, let me just give you a short example. For example, seriously injured people, ACC managed 12,000 seriously injured people in New Zealand, of which 5000 of those are very very seriously injured.
RALPH Theyre with us for decades. Their
relationships were going to have for 20, 30, 40 years because we
help them return to independence and return to some sort of
vocational guidance if they can or social independence.
PAUL Yeah, the point Im trying to make is you say youve got 1.7 million clients, and Im sure most of those are very well served and appreciative of the care and service they get from ACC. But the Minister, your minister, said a month ago that ACC needs to rebuild the public trust, and Im simply wondering how turning the cops on Bronwyn Pullar is helping you with that.
RALPH In terms of public trust and confidence, I believe that ACC has it. I believe the good work that ACC does in the community every single day from injury prevention, to providing rehabilitation services, to helping seriously injured people-
PAUL No, youre missing my point, Ralph, which is that how does turning the headlights of ACC on one little person help restore the trust and the confidence of the people in New Zealand in ACC?
RALPH Because I really do believe - and I cant go too far, Paul; I know where youre trying to go with this - is trust and confidence comes from two aspects. One is what we do for people who are injured in New Zealand. The second piece is how we manage New Zealand money in terms of the revenue collected and the levies paid. Its important to manage both sides.
PAUL Yes. Of course, the other side to manage also is 6500 bits of private information that went out to Bronwyn Pullar, but lets move on. We had another leak found this week - details of a hundred clients sent to the wrong person. You have apologised for this happening, but you did say if TVNZ had not discovered it, you would have shut up about it. Do you regret that?
RALPH What I- That was a piece of- Let me explain to you. What I said was that there is a process to follow, and its a three-step process. Under the act, the Privacy Act, there is a definition or a criteria for a breach. So when theres a breach that occurs, the first thing we do, whether its in the criteria or outside of the criteria, is contact the people involved. That is the first step. The second step is if the breach is material enough, we advise the Office of the Privacy Commissioner. And third, if theres any need for media, it might come then, but its certainly a long third.
PAUL Well, you see, youve got the media involved anyway,
because breach after breach appears to be happening, and its a
magntitude. And you made it clear that if TVNZ had not come
to you, you would not have gone public about it. Was that
wise? And do you regret that?
RALPH Paul, can I answer the question I was asked-?
PAUL I understand you have process, but youve got a media game happening here.
RALPH I was asked is the first port of call to advise this to the media? It is not. The first port of call, the first responsibility is to our clients.
PAUL Would you ever have gone to the media about it after youd been through your processes?
RALPH There is an established process for the media and for the public at large-
PAUL Would you have owned up publicly?
RALPH If you let me explain, Paul, as I just mentioned, through the Office of the Privacy Commissioner, they collect statistics about breaches. They collect statistics about ACC breaches. And if you look at last years annual report, you can identify the number of breaches that occurred for ACC.
PAUL All right, now, have you got your provisions - privacy
provisions - and protocols in order. Again, Collins wants you
to do that. Have you done that? Is that your
three-stage that youre doing?
RALPH It is. Were in the process of doing it.
PAUL Youve now got- I wonder about you coming from the private sector across to the government - the public sector. Youve now got a police inquiry, the Auditor General inquiry and the Privacy Commissioner breathing down your neck. Is that comfortable or uncomfortable?
PAUL Enjoying that?
RALPH Its very hard to say its comfortable. Its not.
PAUL No. The Privacy Commissioner, Marie Shroff, she wants the powers to come in and fix your privacy issues. Would you welcome that?
RALPH Weve been working with Marie and the OPC for years. This is nothing new. Weve had a strong relationship with the OPC. In fact, if you look at some of the publications in the past from the OPC, youll note that they quote the ACC privacy approach as being of a good standard.
PAUL So should Marie butt out?
RALPH Marie has a job to do under legislation. Its important that she fulfils it for trust and confidence in New Zealand.
PAUL Would you invite her in to have a look at your big
problem and to fix it? Or would you like her to not do
RALPH We absolutely welcome Maries involvement. And if I can just bring you back to the first point I raised, which is the first review that were doing, the internal system and processes review, thats done in conjunction with Marie and her team.
PAUL So when are we going to get to a point where theres no more breaches?
RALPH Oh, I wish it was tomorrow. I know it wont be. The key thing is to declare for ACC that no breaches is our objective.
PAUL Its amazing, isnt it? Its incompetent, isnt
RALPH Well, I think, again if I can bring it back to the absolute scale-
PAUL Im sorry, it doesnt happen in Work and Income. I havent heard anything about anybody in a letter from the Education Department. Do you know what I mean?
RALPH I do. I understand that the emphasis is on us now.
PAUL And youre dealing with people with personal injuries
and all kinds of personal things, and youre flapping them around
all round the country.
RALPH The point is were dealing with 1.7 million claims plus existing customers every year. Thats the most important thing. Yes, some breaches have occurred, but relatively speaking, Ill just bring you back. Say there were 10 or 20 or 30 or 40 breaches - Im not saying there are, but say there was - in relation to 143,000 claims per month.
PAUL Yes, no, look, Im sure thats a big workload. 130,000 in April alone. Is ACC going to be accountable?
RALPH ACC is accountable.
PAUL Are you going to be accountable? Are you
RALPH A corporation as large and as complex as ACC must have clear leadership, it must have clear responsibilities and accountabilities, and the buck stops with me.
PAUL At what point would you fall on the sword?
RALPH ACC is a very complex environment. Weve talked about breaches largely this morning, weve talked a bit about the scale and scope of ACC, but think about ACC in an absolute term. Were talking about $30 billion worth of liabilities, $20 billion worth of assets, $2.6 billion in payments every year to individuals in New Zealand, 1 billion remuneration payments. Its a complex organisation. Yes, Im responsible for it, but privacy is one part of it.
PAUL I have to leave it there. Ralph, thank you very
much. Ralph Stewart, chief executive of ACC, thank you very
much for coming in.
RALPH Thanks, Paul.