Taxpayers forked out $50,000 to pay for the inquiry into leaked COVID-19 patient details - and that's not including the salary of the disgraced National MP who passed the data to the press.
National MP Hamish Walker has admitted he leaked confidential data to some media outlets to try and defend himself against accusations of racism - but an investigation has found the Ministry of Health could have guarded it better.
"Their actions were not justified or reasonable," Michael Heron QC, who led the State Services Commission investigation into the leaked data, said on Thursday.
The investigation confirmed that ex-National Party president Michelle Boag and Walker were the source of the leak, and Heron described it as having motivations that were "political".
Health Minister Chris Hipkins described it as "disgraceful".
"This was a disgraceful and grubby act carried out by two National Party members for political purposes," he said on Thursday.
National leader Judith Collins said she agreed with the findings.
"It's a very big lesson to people that you can't play politics with other people's private medical data."
It was all spurred by Walker sending out a press release about returning Kiwis, only mentioning they were coming from India, Pakistan and Korea. It was labelled "racist" by Megan Woods, the minister in charge of the managed isolation facilities.
Trying to prove he wasn't racist, Walker leaked the list to three media organisations.
He told the investigation, "I accept that my judgement was impaired due to the pressure and distress of being labelled a racist."
Heron could not say if Walker thought the information would prove that he wasn't racist.
Walker is refusing to do interviews and hasn't been seen since the leak and won't return to Parliament. But he's still drawing down a taxpayer salary.
Between the day he resigned and the election, taxpayers are paying him $29,000. He gets a three month redundancy pay-out too, worth $36,000.
Collins insists Walker is doing good work in his electorate.
"He's getting out and about and he's reporting directly to me on what he's doing so I'm satisfied he's doing his job."
Walker is not the only one being paid to stay away. Former National Todd Muller still hasn't returned to Parliament, nor has Labour's Iain Lees Galloway both costing taxpayers $400 each every single day.
Ex-National MP Andrew Falloon isn't collecting a salary anymore because he resigned completely.
Then there's the inquiry into the data breach - it cost the taxpayer $50,000.
The Government said it was still worth it because it showed the Ministry of Health could have done better too. The information wasn't encrypted and wasn't password protected.
"That isn't optimal," Heron said.
Hipkins said it's difficult to guard against people who intentionally want to find a weakness.
"If someone deliberately and maliciously wants to release information no system can be 100 percent guarded against that."
The Ministry of Health has now changed its processes. It's no longer sending this data to anyone. If New Zealand's COVID-19-free community status changes and the data needs to be shared, the Ministry of Health will password-protect it.
But as the Health Minister and the head of the investigation pointed out, passwords only go so far. Ultimately, there is no system in the world with a security fix or a moral-check for malicious political leaking.
