The Council for Civil Liberties says the government failed to robustly assess the privacy impacts of the data and statistics bill before it was introduced to Parliament.

This comes after the Chief Ombudsman and a former head of the Department of Statistics (Stats NZ) both voiced significant concerns about the bill.

The council has made an Official Information Act (OIA) request to find out why a privacy impact assessment wasn’t undertaken for the bill – a requirement under cabinet guidelines for any policy development that affects personal information.

Cynical

On the final day the OIA response was due, Stats NZ advised it was extending the time limit for the response to consult stakeholders named in the requested documents.

Council spokesperson Thomas Beagle is upset that the new deadline of May 12, would be too late for the information to be considered by the select committee which is due to make its report by May 9.

He told BusinessDesk: “It's hard not to be cynical about the thing but it seems they have chosen a date, and they said, ‘Oh, we'll get it back to a couple of days after the select committee reports rather than before it’.”

A spokesperson for Stats NZ told BusinessDesk the OIA allows agencies to extend time limits for requests but is considering whether a partial response can be provided to the council while the necessary consultations are undertaken.

They failed to respond to BusinessDesk’s request for details about who is being consulted and when they were contacted.

Data grab

The regulatory impact assessment on the bill states it would remove “all legislative barriers that unnecessarily restrict sharing administrative data with Stats NZ”.

Beagle said ordinary people should be concerned about the bill’s impacts on privacy as it would allow the government to collect more data from more places and provide it to more people than before, all without people’s consent.

“It's a big government data grab and I don't think they've thought through all the issues involved.”

Beagle said this will include very personal data, such as hospital records, which will be handed over to Stats NZ.

“This is obviously very personal data, and they're changing the way they use it, and they're changing the way they're going to publish it and make it available.

“It seems pretty obvious there could be a significant impact on privacy.”

Return to sender

Len Cook ran Stats NZ in the 1990s before being appointed to the equivalent role in the UK. He advised the select committee to send the bill back to the government for a thorough rewrite.

He told BusinessDesk there are very big privacy issues that span the public sector and we need to be very careful in how we allow agencies to share data across the different functions of government such as compliance, enforcement, surveillance, producing statistics and delivering services.

“These are all very different domains of government, and we tend to keep them quite separate.”

Cook says the bill doesn't clearly delineate between the very different reasons why the government collects information and is concerned about the way it allows the government statistician (ie the head of Stats NZ) to delegate all of their legal powers to chief executives of other agencies.

“The bill itself doesn’t tell us that they would treat the head of the SIS as differently from the head of police differently from the head of a service delivery agency like MSD.”

Cook said Australia has taken a more robust approach with its recent Data Availability and Transparency Act, placing limits on data sharing across the different domains of government.

“The Australian act assumes that data sharing is a very complex array of issues that exists not only for producing statistics, but for improving services, and surveillance, policing, etc.

“That's why I think it's got much better-articulated principles and checks and balances than the New Zealand legislation.”

Cook said the bill assumes that because there is high trust in the government statistician, and government statisticians haven't let us down so far, that trust will still be justified with a much wider and more complex job.

“Is it right for the government statistician to be the chief data steward if, in fact, it involves a lot more things outside the normal brief of the government statistician?”

‘Broadly comfortable’

A spokesperson for the Office of the Privacy Commissioner told BusinessDesk that a privacy impact assessment should be undertaken during the policy process, but it does not require one in order to form a view on proposed legislation.

The spokesperson said the office was “broadly comfortable” with the adequacy of the safeguards in the bill.

Statistics minister, David Clark, told BusinessDesk he was advised Stats NZ decided to not undertake a privacy impact assessment “because the bill maintains the confidentiality and privacy requirements of the 1975 act, whilst modernising it for the digital age”.

However, the Office of the Privacy Commissioner engaged with the policy development process that led to its introduction. 

“Having contributed to this policy process, OPC had no significant concerns about the bill as introduced.”

The minister also said his office had not yet been consulted on the council’s OIA request.