A flaw in a reporting tool exposed New Zealand payroll data in September. Most business sites run code nobody checks, and the Privacy Act makes it your problem.