Skip to main content

Tuia 250 website privacy breach reviewer appointed

Media release: 30 August 2019

Doug Craig has been appointed to conduct the independent review into the privacy breach on the Tuia – Encounters 250 website, Manatū Taonga Ministry for Culture and Heritage Tumu Whakarae Chief Executive Bernadette Cavanagh said today.

 “The breach involved compromising the personal details of people who applied to the Tuia 250 Voyage Trainee programme and includes images of passports, driver’s licences, birth certificates and other forms of identification stored on the website,” Bernadette Cavanagh said.

“Doug Craig is the director of consultancy RDC Group. He has more than 20 years’ experience as a senior public service executive in both New Zealand and Australia, previously serving as Deputy Commissioner of the State Services Commission.

“This review will give us a comprehensive understanding of the cause of the breach and make recommendations to prevent a situation like this happening again.

“The focus of the review will be on the process followed to procure the design and hosting of the Tuia 250 website on an external site.

“We need to find out whether the Ministry adhered to its internal policies, to applicable government policies and good practice guidance when we undertook the procurement process.

“I expect the review to be complete by mid-October.

“A copy of the final report will be provided to the Government Chief Digital Officer, the Government Chief Information Security Officer, and the State Services Commissioner. I will ensure the final report is publicly released as soon as practical.

“Again I extend my sincere apologies to all those affected by this breach and acknowledge this is completely unacceptable. 

“While this review will not undo what happened it will provide us with the means to ensure we have the right processes in place,” Bernadette Cavanagh said.


The terms of reference for the review are available here:

The media release about the breach is available here:

The questions and answers about the breach are available here:

Notes to Editor

  • Some 302 people have been affected by the breach. These people applied for the Tuia 250 Voyage Trainee programme through the website.
  • The types of documents which were breached include images of passports, driver’s licences, birth certificates and other forms of identification stored on the website.
  • We are working with other government agencies to support the people affected by the privacy breach, including by organising replacement documents free of charge.
  • The Tuia - Encounters 250 national commemoration is a programme of events, education and reflection that celebrates Aotearoa New Zealand’s Pacific voyaging heritage and acknowledges the first onshore encounters between Māori and Pākehā in 1769-70.
  • The Voyage Trainee programme gives New Zealanders the opportunity to sail aboard the vessels in the Tuia 250 Voyage during October to December of this year.

Updated on 30th August 2019