EQC Redux

If EQC can mistakenly send out a spreadsheet containing most of the relevant details on most of the Christchurch earthquake claims, why are they unable to provide those same details to homeowners who request them?

News reports yesterday said that the EQC data breach included only addresses and claim numbers. I had a hard time thinking of potential exploits using that data until I started thinking of the homeowner as the mark instead of EQC. But non-instrumental privacy concerns seemed pretty trivial. 

Today we learned a bit more.

Here's The Press:

The row first erupted on Friday after an EQC senior staffer sent an email with the Excel data attachment to Christchurch businessman and persistent EQC critic Bryan Staples.

He deleted the information and signed a statutory declaration that he did not copy it.

Staples, who owns Earthquake Service Ltd, went public yesterday saying he wanted EQC to disclose the information to the individual householders.

"This is stuff everyone has a right to know," he said.

...

Staples said he was not the only person to see the email which listed the household's claim number, asbestos rating, EQC tolerance approval, which aspects of the claim were on hold, land information, whether the address was awaiting assessments, engineer's report, the EQC supervisor, the contractor's name and quote, and EQC's value of damage estimate.

...

Staples also said he looked up the information for one of his clients on the list for whom his company had done repair work, costing $55,000.

EQC had said $55,000 was too much and had cash settled for $30,000 with the homeowner. But the spreadsheet showed EQC has allocated $59,000 for repairs.

Now that's a bit different from addresses and claim numbers.

If this were released for our house, I still would have only instrumental privacy concerns rather than intrinsic ones: I'd worry that somebody might start sending in fraudulent claims on our number and try redirecting payment to their own account, but it wouldn't bother me otherwise. We're opt-out, so we're not in the .xls file.

I know other folks put more value on particular aspects of privacy and might have intrinsic privacy worries about these details being released. I go entirely the other way here: this stuff should have to be attached to the LIM for all houses in Christchurch so that future buyers can tell what repair work was ordered and what repair work was done. It'll harm those who take the cash settlement, don't undertake the repairs, and don't fully disclose to potential buyers. Boo-hoo.*

But if there's a single spreadsheet out there with all this information on it, why in seven hells does this happen:

Since the Christchurch earthquakes, EQC has been inundated with OIA requests, as homeowners have resorted to statutory mechanisms in the face of bullshit from officials. Their response? Don't answer anything for five months

Frustrated Cantabrians hunting for information on their broken homes have swamped EQC with thousands of Official Information Act requests, pushing the 20-day response deadline out to an unprecedented five months.

Christchurch homeowners say waiting almost half a year for crucial information on their properties is "inexcusable" and the chief ombudsman says the current waiting list is "not satisfactory".

[...]

[Andrea Laws] filed her first request in early August 2012 and said she received only part of the information in mid-September.

EQC refused to send Laws any more information for months until she complained to the ombudsman, she said.

"They really didn't want to do the OIA. I had to ask them two or three times where my response was and when it came through there was email correspondence that said: ‘Do not provide the claimant with information or time frames'," she said.

This is unlawful and it is unacceptable. On the first front, the OIA requires a response " as soon as reasonably practicable, and in any case not later than 20 working days" after the request is received. While the twenty-day limit can be extended, that cna only happen if it is for or requires searching a large volume of information, or if required by consultations with other agencies. Being flooded with requests and just not feeling like doing them is not an excuse. Any agency faced with such a situation should be hiring extra staff to cope, not ignoring requests.

It looks like answering at least some of these OIA requests would just require 5 minutes in an .xls file. Say five minutes to extract the data, five minutes to clip it into a reply email: one EQC agent could be answering 400 of these a day.

There are potentially innocuous explanations for the discrepancy between the cash settlement Bryan Staples cites and EQC's cost estimate: it's not implausible that EQC budgets include padding in case the repairs are more substantial than expected, and that the cash settlement did reflect the real damage. Or it could be that they're just screwing down costs.

Here's an interview with Bryan Staples.

What the heck is EQC doing if it can't get basic information out to homeowners, but has it all sitting in a darned Excel file?

At our little opt-out, EQC continues trying to screw down cost estimates provided by our builder. Hopefully they'll soon come to some agreement.

Update: Here's Chris Hutching at The NBR (gated) making a similar point.

As a government department, EQC simply is not accountable in the way a private company would be.

I agree. But the private insurers have hardly been providing stellar customer service either.

* You can get around this, for now, if you're an honest seller, by keeping all the files and making them available to potential buyers. But in 10 years time, there are going to be a lot of people on-selling earthquake-damaged homes that they purchased after the quakes and who will claim that the earthquake paperwork was lost. Get it on the LIM.