Xero breached whistleblower confidentiality in Sir Rod Drury complaint
Accounting software company Xero has apologised to a former employee after mistakenly revealing her identity to then-chief executive Sir Rod Drury during an internal investigation into allegations of unwanted sexual advances.
According to a report by Stuff, former employee Ally Naylor first raised concerns publicly in March after Drury received the supreme honour at the New Zealander of the Year awards. Drury has denied the allegations, describing them as “unfounded” and saying the pair had a brief “consensual” relationship, a characterisation Naylor disputes.
Earlier this month, Drury stepped down from the award, stating he did not want the matter to undermine the integrity of the honours process “before the relevant investigations and proper processes have been completed,” as quoted by Stuff.
Naylor worked at Xero as a junior employee during the mid-2010s. She alleged Drury invited her to his apartment for work-related meetings on several occasions, where she said he made repeated unwanted advances.
When resigning from the company in November 2017, Naylor filed a complaint through Xero’s whistleblower system and requested strict confidentiality.
“Rod is a very powerful man in New Zealand and the business community is small. My career at Xero has come to an end but I still need to find new employment,” she wrote at the time, Stuff has quoted.
Following questions from Stuff earlier this year, Xero appointed Maria Dew KC to conduct an independent review into how the company handled the complaint. The review remains ongoing.
However, before the review was completed, Xero acknowledged it had breached Naylor’s confidentiality.
A spokesperson for the company said that while reviewing material connected to the 2017 investigation, “we found an inadvertent error in a single draft document which was not identified at the time,” as quoted by Stuff.
“We deeply regret that this occurred and have apologised for the error made at the time.”
Documents released to Naylor under the Privacy Act revealed repeated assurances from Xero staff that her identity would remain protected throughout the process.
One internal email stated: “The report doesn’t identify you and we have taken care to protect your identity and maintain confidentiality,” as reported by Stuff.
According to file notes, Naylor initially considered making a formal complaint but was advised that such a process would require her identity to be disclosed. She instead chose to use the company’s protected whistleblower process.
“She wants the Board to understand more broadly about the situation, and leave with a clear conscience that she has done everything possible, as she thinks HR hasn’t been acting,” internal notes stated, as reported by Stuff.
According to Stuff, in her complaint, Naylor detailed allegations of inappropriate conduct, writing that Drury “said he liked my vibe, and kissed me on the mouth. He also began to feel underneath my breasts”.
She alleged the behaviour occurred on about five occasions and said fear for her career stopped her from reporting it sooner.
“I was too scared to make a complaint”.
Naylor concluded by requesting anonymity, writing: “For obvious reasons, I would not like my name to be used,” Stuff has quoted.
The investigation’s terms of reference showed it aimed to determine “whether or not Mr Drury engaged in the type of conduct” alleged and whether company leadership and HR responded appropriately.
The investigation report noted Naylor had “sought an assurance of confidentiality from the outset and said strongly she does not wish to be identified to Mr Drury as the person who has complained”.
Naylor said she was shocked to later discover her name had been left in a draft document shared with Drury.
“My name had been left in the report that was given to Rod at the time of the investigation,” she said, as quoted by Stuff.
According to Naylor, her understanding was that staff had replaced most references to her name with “the complainant” but missed one instance.
“They then forgot to replace one of those [instances] of my name with the word ‘complainant’.”
“What gets more serious than having your name left in a document when somebody has said they are treating it confidentially?” she said.
“In such an important situation like this where the power imbalance is so great, what is fundamentally more serious than that?”, Stuff has quoted.
Naylor said learning Drury knew her identity throughout the process had been deeply upsetting.
“It is exceptionally upsetting to learn that there was such a failure in process. It’s a violation of trust and faith that I had put in people, in a very vulnerable situation,” as quoted by Stuff.
Her lawyer Michael Timmins criticised the handling of the matter, saying: “Whilst it was inadvertent, it suggests a really sloppy process.”
“You can't have your cake and eat it too. If you approach an investigation from one perspective, but then undermine it, then it then really creates a flawed result, and that's what we've seen here,” Stuff has quoted.
Naylor also expressed disappointment over the way the apology was delivered.
“It’s not even a face-to-face apology, not even a phone call apology,” she said. “It’s an apology from a lawyer to a lawyer. Is it too much to expect a face-to-face apology for such a breach of trust?”
A spokesperson for Drury declined to comment on the privacy breach.
According to Stuff, the report also noted that two other women have accused Drury of making unwanted advances. One former Xero employee alleged he had “kissed me up against the wall”, while former private chef Megan Ruddle claimed he repeatedly kissed her while she was working for him.
Drury has denied those claims, saying: “Any other relationships I had over that period were consensual and mutual” and describing Ruddle’s allegations as “unfounded”, as quoted by Stuff.
Accounting software company Xero has apologised to a former employee after mistakenly revealing her identity to then-chief executive Sir Rod Drury during an internal investigation into allegations of unwanted sexual advances.
According to a report by Stuff, former employee Ally Naylor first raised...
Accounting software company Xero has apologised to a former employee after mistakenly revealing her identity to then-chief executive Sir Rod Drury during an internal investigation into allegations of unwanted sexual advances.
According to a report by Stuff, former employee Ally Naylor first raised concerns publicly in March after Drury received the supreme honour at the New Zealander of the Year awards. Drury has denied the allegations, describing them as “unfounded” and saying the pair had a brief “consensual” relationship, a characterisation Naylor disputes.
Earlier this month, Drury stepped down from the award, stating he did not want the matter to undermine the integrity of the honours process “before the relevant investigations and proper processes have been completed,” as quoted by Stuff.
Naylor worked at Xero as a junior employee during the mid-2010s. She alleged Drury invited her to his apartment for work-related meetings on several occasions, where she said he made repeated unwanted advances.
When resigning from the company in November 2017, Naylor filed a complaint through Xero’s whistleblower system and requested strict confidentiality.
“Rod is a very powerful man in New Zealand and the business community is small. My career at Xero has come to an end but I still need to find new employment,” she wrote at the time, Stuff has quoted.
Following questions from Stuff earlier this year, Xero appointed Maria Dew KC to conduct an independent review into how the company handled the complaint. The review remains ongoing.
However, before the review was completed, Xero acknowledged it had breached Naylor’s confidentiality.
A spokesperson for the company said that while reviewing material connected to the 2017 investigation, “we found an inadvertent error in a single draft document which was not identified at the time,” as quoted by Stuff.
“We deeply regret that this occurred and have apologised for the error made at the time.”
Documents released to Naylor under the Privacy Act revealed repeated assurances from Xero staff that her identity would remain protected throughout the process.
One internal email stated: “The report doesn’t identify you and we have taken care to protect your identity and maintain confidentiality,” as reported by Stuff.
According to file notes, Naylor initially considered making a formal complaint but was advised that such a process would require her identity to be disclosed. She instead chose to use the company’s protected whistleblower process.
“She wants the Board to understand more broadly about the situation, and leave with a clear conscience that she has done everything possible, as she thinks HR hasn’t been acting,” internal notes stated, as reported by Stuff.
According to Stuff, in her complaint, Naylor detailed allegations of inappropriate conduct, writing that Drury “said he liked my vibe, and kissed me on the mouth. He also began to feel underneath my breasts”.
She alleged the behaviour occurred on about five occasions and said fear for her career stopped her from reporting it sooner.
“I was too scared to make a complaint”.
Naylor concluded by requesting anonymity, writing: “For obvious reasons, I would not like my name to be used,” Stuff has quoted.
The investigation’s terms of reference showed it aimed to determine “whether or not Mr Drury engaged in the type of conduct” alleged and whether company leadership and HR responded appropriately.
The investigation report noted Naylor had “sought an assurance of confidentiality from the outset and said strongly she does not wish to be identified to Mr Drury as the person who has complained”.
Naylor said she was shocked to later discover her name had been left in a draft document shared with Drury.
“My name had been left in the report that was given to Rod at the time of the investigation,” she said, as quoted by Stuff.
According to Naylor, her understanding was that staff had replaced most references to her name with “the complainant” but missed one instance.
“They then forgot to replace one of those [instances] of my name with the word ‘complainant’.”
“What gets more serious than having your name left in a document when somebody has said they are treating it confidentially?” she said.
“In such an important situation like this where the power imbalance is so great, what is fundamentally more serious than that?”, Stuff has quoted.
Naylor said learning Drury knew her identity throughout the process had been deeply upsetting.
“It is exceptionally upsetting to learn that there was such a failure in process. It’s a violation of trust and faith that I had put in people, in a very vulnerable situation,” as quoted by Stuff.
Her lawyer Michael Timmins criticised the handling of the matter, saying: “Whilst it was inadvertent, it suggests a really sloppy process.”
“You can't have your cake and eat it too. If you approach an investigation from one perspective, but then undermine it, then it then really creates a flawed result, and that's what we've seen here,” Stuff has quoted.
Naylor also expressed disappointment over the way the apology was delivered.
“It’s not even a face-to-face apology, not even a phone call apology,” she said. “It’s an apology from a lawyer to a lawyer. Is it too much to expect a face-to-face apology for such a breach of trust?”
A spokesperson for Drury declined to comment on the privacy breach.
According to Stuff, the report also noted that two other women have accused Drury of making unwanted advances. One former Xero employee alleged he had “kissed me up against the wall”, while former private chef Megan Ruddle claimed he repeatedly kissed her while she was working for him.
Drury has denied those claims, saying: “Any other relationships I had over that period were consensual and mutual” and describing Ruddle’s allegations as “unfounded”, as quoted by Stuff.









Leave a Comment