Firearms Safety Authority privacy breach

Firearms Safety Authority (FSA) can confirm that earlier this afternoon it’s Auckland District Office sent an email to 147 recipients that revealed the email address of the recipients to fellow licence holders.

Statement of Supt. Richard (RJ) Wilson – FSA Director of Operations:

‘This incident is being treated seriously by FSA, who have lodged this as a privacy breach and will be notifying the Office of the Privacy Commissioner.

‘The email itself was a generic message asking the recipient to update their address, and did not contain any individual information about recipients other than the email address that was visible. The email was not sent to any members of the wider public and only went to the group of licence holders.

‘FSA confirms that on this issue being identified internally it immediately ceased emailing groups, and it sent a follow-up email to the 147 recipients asking them to delete the previously sent message.

‘A rapid review has determined that the privacy breach came about from human error, when the email addresses were incorrectly pasted into the ‘cc’ (carbon copy) address field, rather than the ‘bcc’ (blind carbon copy) address field.

‘The Authority stresses that the event was not related in any way to information held securely in its systems, and did not come about from any breach of its systems, but rather from human error.

FSA will be making contact with all the affected recipients this afternoon, explaining the nature of the privacy breach, how it came about. FSA sincerely apologises to all those affected by this event.

FSA has also begun a rapid review of its processes around the sending large batches of email, and will be strengthening its processes to avoid future events like this.

Image credit: Cottonbro Studios