But Dr Nigel Stanger, a lecturer at the university’s information science department, whose research interests include data security and privacy, said the breach seemed an easily fixed "one-off lapse".
He was commenting after the Otago Daily Times confirmed the personal details of a sexual abuse survivor had been disclosed by the royal commission to an unrelated party.
The breach occurred when the survivor, who made a submission on the royal commission’s draft terms of reference, was sent an email acknowledgement from the commission.
The acknowledgement was inadvertently sent to another party with the same first name, disclosing the victim’s name and email address to the unrelated party.
A royal commission spokeswoman confirmed the breach and said it was being treated "very seriously".
It was believed to be a "one-off" incident which occurred in May, but was only discovered and disclosed to the victim on Wednesday, she said.
Details of the victim’s submission were not revealed by the breach, which occurred as a result of "human error", she said.
The victim had received an apology and no other survivors’ personal details had been disclosed, she said.
The commission’s internal processes would be tightened as a result, she said.
"We are now looking into how this happened and will be putting steps in place to ensure this cannot happen again."
Dr Stanger said the mistake was serious but did not point to a systemic issue.
However, it was a "slight concern" the royal commission was using names as an identifier, when "it only takes a small lapse in attention for this kind of privacy leak to occur".
"This is why most organisations use unique numbers or codes instead, but even these aren’t foolproof."
The commission spokeswoman said a new client management system had been introduced since the mistaken disclosure, as the commission geared up to begin its work next year.
Liz Tonks, a spokeswoman for the Network of Survivors in Faith-based Institutions and their Supporters, said she was concerned by the breach, which had left the victim "seriously distressed".
The survivor told the ODT he would be "taking this further due to the nature of the subject".
"As a survivor I have no confidence within the [royal commission] with any information that I have given them and to any that I would give in the future.
"This has had a severe impact on me. I did not sleep last night and I’m having panic attacks. This has now put all survivors in a position of mistrust towards the [royal commission]."
