Senior ACC manager Philip Murch knew of a potentially major breach of the privacy of more than 6000 claimants for three months but failed to do enough about it, says chief executive Ralph Stewart, who last night apologised for the blunder.
But Mr Stewart and ACC chairman John Judge have defended Mr Murch and say he will keep his job for now.
Mr Stewart yesterday confirmed reports that last August an ACC case manager accidentally emailed a spreadsheet with information about other clients to a long-term claimant.
About 9000 records were sent relating to about 6000 individuals giving information including their names and claim numbers.
Mr Stewart said there was no personal information about the clients or details about their claims in the email.
But he later accepted that the fact it showed 147 of those identified had made sensitive claims, including claims over sexual abuse and assaults, was in itself personal information.
"I can now confirm that the information has been destroyed and is no longer on the hard drive of the computer of the client who received it.''
Mr Stewart later told the NZ Herald that assurance rested on an affidavit signed by the woman in which she said she removed the information from her computer and had not copied it or forwarded it to others.
ACC was working to contact affected claimants to advise them of the breach and confirm that their information was now protected.
Mr Murch, ACC's national manager of Recover Independent Services, first learned of the potential breach during a routine meeting with the claimant in December.
He sent "a strongly worded letter'' to her the next day asking for her to return the information but she refused.
He then tried to identify the information that had been sent but even in spite of knowing who her primary case manager was, was unable to.
"We didn't do enough at that point,'' Mr Stewart said last night.
"These are difficult cases because many people make allegations to us that they are in receipt of confidential information. We investigate when we have specific information. In this case, we wish we had done more.
"We do need to talk to [Mr Murch] and review exactly what happened but I'm not [suggesting] he loses his job.''
Mr Stewart dismissed suggestions the breach had been covered up at high levels within the corporation.
Labour's ACC spokesman, Andrew Little, said the breach was a "material'' issue that should have been raised when Mr Stewart and Mr Judge appeared before a parliamentary committee last month.
That it hadn't suggested "an attempt to conceal what is a material piece of information on ACC''.
Mr Stewart said he did not know whether Mr Murch had let his immediate superiors know about the potential breach but he became aware of the problem only last Friday when faced with questions from a reporter.
Those questions were couched in such a way that they did not give an indication of the seriousness of the potential breach, but Mr Stewart accepted that he should have informed ACC Minister Judith Collins, who only learned of it yesterday morning.
Mr Stewart himself didn't know the nature of the leak until reading the newspapers on Monday.
Ms Collins would not comment until she had a report from Mr Stewart.
Privacy Commissioner Marie Shroff said she was taking the breach seriously and she had asked ACC for a formal response to the incident.
"We've indicated to ACC that this is a `please explain' situation,'' she said. "This ... is serious if it's proved to be correct because it involves extremely sensitive personal information.''
Ms Shroff said she could launch an investigation if she received a complaint about the breach, but could also launch her own inquiry.
- Adam Bennett and Amelia Romanos
