mrdrifter: This seems to have grown to the point where there should be prosecutions for breaches of the Privacy Act at a minimum retaining PII well past the point it's required let alone failing to keep it secure.
Perhaps the financial regulators ( FMA, RBNZ) might be able to illuminate us on why the NZ clients data was allowed to be transferred to OZ in the first place, and how NZ privacy law was being adhered to...
Then there is the reputation damage to Kiwibank, who has been farming out its personal loan business, because that is obviously something to hard for a publicly NZ owned bank to do...