Authority weighs in on confidentiality breaches with no proven misuse or financial gain
Four Inland Revenue staff who accessed a single taxpayer's file in October 2025 have been refused interim reinstatement after their summary dismissals.
The Employment Relations Authority, in four parallel preliminary determinations issued on 29 April 2026, declined to put Gina Thompson, Bimlesh Sharma, Smita Nalawade and Punipuao Fatu back on the payroll while their unjustified dismissal claims proceed to substantive hearings.
The cases all trace back to the same afternoon. On 24 October 2025, a Domain Specialist in Complaints Management sent an email to Team Leads requesting they advise their teams that Complaints Management was case-managing a situation relating to an individual, referred to as Taxpayer A. Taxpayer A's full name and IRD number were included in the email to enable staff to identify him should they receive contact. The email instructed: "Please do not engage with Taxpayer A."
Each of the four employees accessed Taxpayer A's account that day, though the timing and circumstances differed. Each admitted the access during the investigation but gave a different explanation, and their accounts have not yet been tested in evidence.
Nalawade, who had almost three years' service, accessed the account at 2.32 p.m. — one minute after her Team Lead forwarded the Domain Specialist's email with "FYI everyone" — and exited at 2.36 p.m. She said she wanted to check whether Taxpayer A was a customer she had previously dealt with and whether she needed to follow up on previous actions.
Thompson, with six years' service, accessed at 2.46 p.m. — two minutes after receiving her Team Lead's forwarded email, which itself stated: "This is a reminder that you are not to access this account unless you receive a call from this customer." She said she was checking whether she had previously worked on the account and whether an international banner applied, and whether a trace had been sent to Services Australia, so she would be prepared if a call came through.
Fatu, who had 36 years' service, accessed the account at 3.45 p.m. — after her Team Lead had already sent a 2.54 p.m. Teams message reminding staff not to access accounts without a business reason. She said she was concerned she may have spoken to Taxpayer A previously and transferred him to the child support line, and wanted to check whether she had used the wrong process.
Sharma, an Acting Team Lead two days into a new role in the Families segment, accessed at 2.45 p.m. and exited at 3.21 p.m., navigating through multiple screens. He said he was orienting himself to the context of the case and preparing to answer questions from his team.
None of the four flagged the access to a leader, even after follow-up communications were issued. Whether the original communications were sufficiently clear remains in dispute, with the applicants arguing they were ambiguous.
IRD's Integrity and Internal Assurance Team picked up the activity through active monitoring of its START database. After investigation meetings in late November and early December 2025, Group Lead Christopher Thomson concluded each had committed serious misconduct. Nalawade and Fatu were dismissed on 19 December 2025, Sharma on 22 December 2025, and Thompson on 23 December 2025. The applicants dispute that conclusion and maintain their dismissals were unjustified.
Authority Member Eleanor Robinson found each applicant cleared the low bar of having an arguable case for unjustified dismissal. But that was as far as it went at this stage. In every case, she ruled the applicants had no more than a weak arguable case for permanent reinstatement, the balance of convenience favoured IRD, and the overall justice of the matter sat with declining interim relief. Because the affidavit evidence remains untested, her findings are provisional and may change once the claims have been fully investigated and all witnesses examined.
A central thread running through all four determinations was IRD's argument that mentoring or supervised return would not be workable. As the agency put it, employees in these roles access taxpayer accounts continuously throughout each day, and mentoring would require appointing a person to monitor what they were accessing at all times.
The applicants pointed to alleged disparity of treatment, claiming other staff who accessed Taxpayer A's account were treated differently. IRD's response, accepted at this preliminary stage, was that other individuals who accessed the account proactively reported their access to their Team Lead as soon as they realised they should not have done so, while these four did not. That factual contest is yet to be resolved.
Sharma's case carries an extra wrinkle: his lawyers argued IRD's decision was inconsistent with another employee who received a final warning for misconduct in substantially similar circumstances with no material differences. That dispute is yet to be tested.
The cases highlight how seriously regulators may view confidentiality breaches in information-sensitive workplaces, even where there is no allegation of misuse, sharing, or financial gain. They also signal the weight employers can place on an employee's failure to self-disclose a mistake. Length of service, including Fatu's 36 years, did not tip the scales at this interim stage.
Substantive investigations for Nalawade and Thompson are set down for October with an agreed timetable, while case management conferences will progress the Fatu and Sharma matters to substantive investigation.
