Briefing on the Data and Statistics Bill

Published July 23, 2022 · Updated February 12, 2023

The New Zealand Council for Civil Liberties is opposed to the Data and Statistics Bill and wants it withdrawn. Once in a generation law reform, on a topic that needs all-party support to have credibility, should be developed collaboratively to ensure public confidence. The Bill does not need to pass now, so public consultation should take place on a draft Bill.

The bottom line is that this Bill dangerously conflates collection and use of data for the purpose of official statistics with collecting and sharing data for unspecified research.

While amendments described in this briefing can be made to the Bill to remove this second purpose and limit it to Statistics New Zealand’s statistics functions, overall it would be safer to withdraw this Bill and re-start the work by splitting the two purposes into separate legislation.

The Council believes legislation for this second purpose, possibly drawing on the Australian Data Availability and Transparency Act 2022, must be developed in an open and inclusive manner, including public consultation on an exposure draft of the Bill prior to its introduction to the House.

A briefing for the Committee of the whole House stage of a Bill would normally focus on specific amendments. The Council does make suggestions for how the Bill might be amended later in this briefing note. But since this is the first time we have written to all MPs we wanted to explain the Council’s overall concerns to begin with. The Council is happy to meet with any Member who would like to discuss the issues raised in this briefing note. Please contact our Chair, Thomas Beagle.

Download a PDF copy of this briefing.

The big picture
Privacy and public trust
Data Collection
Data Sharing
Governance and ethics
Census offence
Open government and public participation
Conclusion

1. The big picture

All official statistics legislation is about trading off people’s privacy (and companies’ commercially sensitive information) against the broader public good of well-informed decision making.

The Council supports the goal of statistics legislation that enables informed public policy making and service design, and the allocation of resources and services where they are most needed. High quality official statistics are important to everyone. Civil society groups use them to highlight areas of unmet need or opportunities. Businesses rely on them to make investment decisions, and banks and credit rating agencies rely on them to assess economic and financial risks. And political parties use them when developing alternative policy proposals.

Getting the trade-off right between privacy and high quality official statistics is critical. If it isn’t done well, people and businesses will not trust government to respect their privacy and they will be reluctant to provide accurate data. Less – or poorer quality – data will be collected, affecting the reliability of the statistics. The result will be poor quality policy and funding decisions by government, bad investment decisions by business, and worse economic and social outcomes.

The Data and Statistics Bill introduced by the government is bad and unbalanced legislation that gets the trade-off wrong. This is because the Bill is not just about collection of data for the production of official statistics, but – through overly complex and muddled drafting – brings in a second and fundamentally different purpose of gathering and sharing data to enable deliberately undefined ‘research’, governed only by small numbers of officials with no external ethics input.

It will result in Statistics New Zealand becoming what might be described as a ‘data laundry’: a place where the limited and specific purposes that government departments must have for collecting personal information can be washed away, so that this information can be re-used for unspecified ‘research’ purposes at a later date.

This will lead to a loss of public (and business) trust, and in circumstances where provision of data is voluntary, the impacts noted above will result. Consequently, the Bill risks creating a situation where the state compensates for people’s reluctance to provide it with data by awarding itself ever-increasing powers to compel the supply of information and data. Fundamentally, the Bill’s broad-brush approach to collecting and sharing data takes the discredited approach led by Facebook, Google, Amazon and Microsoft, of seeking to gather as much data from New Zealand people and businesses as possible. It is predicated on the mistaken belief that it is possible to derive reliable information from their interactions with all the different facets of government if only enough of this data is collected. Companies feed this data into algorithms used not only to predict how people will behave but to shape what other information they encounter online. This approach has been described as ‘Surveillance Capitalism’ by Professor Shoshana Zuboff, and it is used not just to provide suggestions on what people may want to buy, but to shape their behaviour and actions.¹ The behaviour that Zuboff has demonstrated companies undertake is clearly analogous to government use of behavioural economics, or ‘nudge theory’.

Members on all sides of the House need to ask themselves whether, in emulating the approaches of companies that have been found to have used deeply questionable methods, both to derive profit from people’s interactions and enable political manipulation of the public, the public are more or less likely to entrust government with accurate information about themselves in future.

The Bill rests on the false and dangerous belief that more state-collected knowledge of the public is always better, which is false and dangerous. The history of the last century has taught us what is possible when governments collect so much data on people that it enables governments to implement discriminatory law and control according to people’s ethnicity, religion, and political beliefs – Germany under both the Nazis and the Stasi, South Africa, Israel, Rwanda, Myanmar, and China.

When governments use their powers to demand the supply of personal data, ‘How should we protect this?’ is actually only the third question it should ask itself. ‘Should we collect this?’ is only the second question. The first question we should ask is ‘What would the worst people do if they got hold of this?’. We’re about to witness this in relation to those US states that have criminalised abortion and plan to use data to monitor pregnancies, for example.

MPs need to step back from glib jargon such as ‘data is the fuel for innovation’ and ask themselves what kind of state power over people will be enabled by this Bill, and if they are comfortable with this, not just for today, but for decades to come with different governments having this power at their disposal. The Council is clear: this Bill is bad, and history will not judge its supporters kindly.

2. Privacy and public trust

Privacy is the foundation of personal dignity and autonomy. If we cannot control what others know about us, we lose control over how they may act towards us. Privacy is therefore at the root of people’s individual liberty, especially in relation to the state, but also in relation to private organisations.

The Privacy Act 2020 is meant to be the framework for the collection and use of personal information. The changes were widely consulted on and the resulting compromises are an important part of New Zealand’s un-entrenched constitution. The new Data and Statistics Bill shows no regard for the Privacy Act or its principles, sucking in data from multiple sources for undefined ‘research’, even where it was explicitly collected for another purpose.

As the Acting Privacy Commissioner said, the Bill should more carefully spell out the relationship between the Bill and the Privacy Act. The select committee did not act on this. The Commissioner also noted that, unlike the Act, the Bill fails to allow for redress when people are harmed by the release of personal information, and recommended that in this circumstance that the Bill should provide a right for individuals to complain to the Privacy Commissioner. Again, this was ignored by the select committee.

If people do not trust what will happen to the data they provide, they may choose not to provide accurate data, or any data at all. This was highlighted in the first reading debate by Mr Ian McKelvie:

“If you look at the way we collect statistics, or data, it’s most important that we do that in a manner that those people providing the information can trust, because if they don’t trust it, they won’t fill the information in correctly…We’ve got to be very careful, when collecting and when deciding what to collect, that we collect information that is not going to, firstly, put people off supplying the correct information, that’s not going to frighten people or—not frighten, that’s a bad word—but not going to, I guess, disincentivise people from participating in society in New Zealand, that’s not going to disincentivise people from investing in New Zealand.”
Data and Statistics Bill, First Reading, 9 November 2021

Surveys of public trust in government handling of personal data

The Privacy Commissioner has, for several years, commissioned surveys of the public about their views on privacy and data sharing.

In the 2016 survey, 62% said “We should not share data as the risks to people’s privacy and security outweighs the benefits”.²

In the 2020 survey, 61% of the public said they were concerned about “Government agencies sharing your personal information without your permission”, of whom 36% were ‘very concerned’.³

Only 28% of respondents to the 2020 survey agreed with the statement “I trust that anonymised data cannot be traced back to me”, and only 26% agreed that “I feel in control of how my personal information is used by government.”

‘De-identification’, not anonymisation

First, I will show that ‘not identifiable’ is no longer an effective proxy for ‘will suffer no privacy harm’.⁴
Anna Johnston

In an attempt to reassure people, Statistics NZ points to personal data being ‘de-identified’, but MPs should be aware that this is a weaker standard than ‘anonymised’. MPs may decide that the lack of people’s consent for re-use, broad scope of collection, and weak incentives to comply with disclosure limits might be mitigated by Stats’ claim that the Bill incorporates safeguards against identification and release. However, repeated use of the term ‘reasonable’ coupled with definitions that imply a point in time rather than regular review make this problematic too.

There are two reasons why anonymisation (or de-identification) does not work in practice. First, as more facts are included in a record – for example date of birth, broad location, and gender – their combination with other facts makes it increasingly easy to narrow candidates to a single person or small group. It has been shown in research by the former US Federal Trade Commission’s Chief Technology Officer for example that “87% of the U.S. population can be uniquely re-identified based on five-digit ZIP code, gender, and date of birth.”⁵ New Zealand census meshblocks, typically used in research here, are smaller and make re-identification even simpler. Even using meshblock data and religion to identify which streets have higher presences of particular groups, such as Muslims, could be dangerous in the wrong hands.⁶

Second, data sets can be combined with existing public data, sometimes in unexpected ways. For example, in 2019 the Australian state of Victoria released an anonymised set of data from Myki public transport cards. Researchers were able use a Tweet made by Victorian MP Anthony Carbine about catching a train to obtain his entire travel history.⁷ Similar approaches have been used to de-anonymise medical records in the Australian Medicare system,⁸ and locate US service personnel and base locations.⁹

Efforts to unravel ‘de-identification’ of New Zealander’s personal data will only increase and become easier over time. This arises from two further issues:

New and improved techniques to de-anonymise / re-identify datasets continue to be discovered. The consequence is that datasets that were once thought to be reasonably anonymised will become unreasonably and unpredictably vulnerable to re-identification in the future.
Constantly increasing computational power. When the Statistics Act 1975 was passed, about 6 million transistors could fit on a microprocessor. Today it’s around 114 billion. This computing power can then be increased further through networking computers together.

The combination of increased computing power and new techniques (loosely referred to as artificial intelligence) can be used to cross-reference and analyse data that was previously prohibitively expensive to do.

The key issues here are:

institutional imperatives (manifest in this Bill) encourage collecting unnecessary data in case it is useful later, making it easier to find combinations that pinpoint individuals
new datasets continue to be made public (deliberately via open data or inadvertently through security breaches) which can then be matched with existing ones
data once circulated cannot be withdrawn – there is always a copy somewhere and incentives to reproduce copies, and
reliance on ‘de-identification’ to protect privacy is unwise as computing techniques advance and computing power becomes cheaper and more accessible.

Further, the Bill provides for disclosure of sets of ‘de-identified’ microdata to other parties inside and outside government. The further away from Statistics NZ officials the data travels, the further it travels from their practices – and their ability to enforce New Zealand law. For example, Statistics NZ has previously granted the Sydney office of Ernst and Young permission to host one of its ‘data labs’ for access to the ‘Integrated Data Infrastructure’, which pools massive amounts of New Zealanders’ personal data, from the census and many other data sources. Clause 52 of the Bill will cement sharing the personal data of New Zealanders overseas, again outside the scope of our Privacy Act 2020.

The Council believes it is naïve to think that in practice people’s privacy rights will be upheld consistently outside of the country. We legislate privacy because we need to, and we should not create loopholes in the Privacy Act 2020 without honest debate on the reasons to do so. This Bill claims to enhance privacy but in reality it weakens it. That dishonesty alone is sufficient reason to remove all of the clauses from this Bill that infringe privacy in the name of ‘research’.

3. Data Collection

Part 3 of the Bill deals with collecting data. Data may be collected not just by the Government Statistician, but by other Chief Executives to whom the Government Statistician has delegated their powers. (We deal with this dangerous delegation power in part 5 of this briefing note.)

Data is not just collected for the purposes of producing official statistics, but also for unspecified ‘research’ purposes (cl 22(c)). The data can be collected from “any individual, public sector agency, or organisation” if the Statistician (or their delegate) considers it “desirable”.

The switch to ‘administrative data’

Clause 22 accelerates and entrenches the shift from data collection that uses formally designed surveys and the census to using ‘administrative’ data.

Administrative data is gathered by government agencies in the course of normal service interactions, for example when a hospital provides health care to a person, or a person applies for a benefit, a permit or a consent. Our every interaction with a government agency can result in the associated data being pooled together in tools like the centralised ‘Integrated Data Infrastructure’. By enabling connections to be drawn between disparate datasets, this Bill undermines everyone’s privacy in the name of ‘research’.

In public statements, the Minister has relied on the safeguards currently established by policies at Statistics New Zealand to deflect criticism of this Bill. The Council suggests that it is highly inappropriate for this Bill to legislate the powers of the Integrated Data Infrastructure without legislating any of those safeguards.

As former Government Statistician Len Cook has noted in his submissions on the Bill (1, 2), administrative data is typically less useful for informing policy work because, while it meets the minimum needs of the current policies and practices of the agency, it lacks the perspective and context of members of the public or business. As Cook has written:

Those countries that have the most reliance on administrative records for official statistics generally have wide ranging administrative registers for addresses and personal details. Such registers require continued compliance by citizens with registration processes that are rarely seen or accepted in Westminster systems.

Administrative data also inevitably suffers from statistical bias as some people interact more with government than others. When the distribution of these interactions is influenced by racism or other forms of systemic biases, it risks embedding these prejudices into the statistical data that is used to inform government decision making.

Our well-designed census and other surveys produced by Statistics NZ are intelligent solutions to a set of difficult problems inherent to data collection. Administrative data may or may not be less expensive to collect, but it will certainly be of lower value. A single misguided policy based on this lower quality data could eclipse the possible reduction in collection costs, in addition to harming our community.

Data collected for ‘research’, not official statistics

Throughout this Bill the term ‘research’ is used, which is not defined in the interpretation clause. It is important to understand the distinction between data gathered for ‘research’ and data gathered for the production of ‘official statistics’. In relation to ‘official statistics’, the combination of clauses 22(c)(i) and 47(2) continue the approach in the 1975 Act.

Subpart 2 of Part 3 of the Bill governs ‘requests’ for data made by the Government Statistician (or their delegates) for the purpose of producing official statistics. The clauses – as amended by the select committee – provide procedures that the Council believes are sound, with the caveat that clause 26(2) needs to be amended to add the words “for the purpose of producing official statistics” at the end of the sub-clause.

However, the same protections do not apply for data collected by Statistics New Zealand from people, public sector agencies or private organisations for ‘research’. Subpart 3 of Part 3 (clauses 32 and 33) provide far less protection.

Here’s how it will work:

Clause 22(c) says data can be collected by the Government Statistician (or their delegates under cl 17) “if the Statistician considers the data is… desirable for research under Part 5, by collection from any individual, public sector agency, or organisation by agreement with the Statistician, without a request having been made under section 23 or 26, or by collection by the Statistician under any arrangement that the Statistician may think fit, including observation and publicly available sources.” (emphasis added)
Clause 32 authorises an individual, public sector agency, or organisation to provide data to the Statistician (or their delegate) for the production of research unless other legislation “expressly prevents the provision of the data” or the provision of the data would be contrary to any “instrument, trust, rule of law (other than in legislation), or an order of a court.”
Clause 33 provides that if the data that the Statistician (or any agency chief executive to whom they’ve delegated their powers) wants for ‘research’ is to be collected from an individual or a private sector organisation, the individual or organisation can impose conditions on access to the data. However, if the data for ‘research’ is collected from a public sector agency, then clause 33(4) is clear that no conditions on access to the data can be specified by the agency: even if the agency wants to protect the privacy of the members of the public, it is forbidden from doing so.

Given the powers of delegation under section 17, this means the heads of the Security Intelligence Service, GCSB, Police and NZ Defence Force can all be given the power to collect whatever data they like on New Zealanders from any government agency. None of the safeguards around the procedures for warrants under the Intelligence and Security Act 2017 apply. Nor do any of the protections in the Privacy Act apply.

If the same agencies want to get data from a private sector organisation, like a bank, Give-A-Little, phone company, internet service provider, private hospital, or insurance company, those companies can specify conditions on who can access it besides the Statistician or their delegate, but not on the Statistician or their delegate’s access to it. Even if the Government Statistician does not delegate their powers to these agencies under clause 17 of the Bill, the agencies can still request access to the data held by Stats NZ under the regime set out in Part 5 of the Bill. It will be a brave Government Statistician that refuses a request from the NZSIS.

Clause 6 of the Bill defines ‘data’ simply: “data includes information”. This definition suggests that the data that agencies can compel other government departments to provide for ‘research’ does not have to exist solely as a defined and structured dataset, but can be any information held by it, however loosely.

Data that was gathered by an agency for one limited purpose – and which was provided by members of the public on the understanding that is all that it would be used for – will be available for any research Stats NZ or another agency chief executive to whom the Statistician’s powers have been delegated considers ‘desirable’. There will be no obligation on the agency that receives the transferred data to delete it after the ‘research’ has been completed.

Clause 42 sets out the requirements for people working with data Stats NZ holds to ‘complete a certificate of confidentiality’ before undertaking research. However, as drafted it is unclear that it applies to employees of agencies headed by a chief executive to whom the Government Statistician has delegated their powers under clause 17. While there may be an assumption that all the research will be undertaken via the framework for accessing data set out in Part 5 of the Bill, it does not appear that this is mandatory if the powers are delegated to an agency chief executive under clause 17.

Overall, the effect is to override the Privacy Act, and allow information to be shared, or used for purposes other than those for which it was originally collected. The Bill completely sidesteps information sharing arrangements under the Privacy Act.

Data gathering by amendment or repeal of other legislation

As noted above, clause 32 authorises public sector agencies and private organisations to provide data to the Statistician (or their delegate) for the production of research unless other legislation “expressly prevents the provision of the data”. Many existing statutory provisions against sharing data with others are repealed or amended in Schedule 2 of the Bill. Examples of the problems in Schedule 2 include:

The Education and Training Act 2020 (following the Education Act 1989) restricts the use of national Student Numbers to education providers for educational purposes. The data is considered so sensitive that intelligence agencies cannot access it without a warrant approved by the Minister and the Commissioner of Security Warrants.

Removal of these protections is both a colossal data-grab by Statistics New Zealand to enable more data to be entered into the Integrated Data Infrastructure, and a breaking of multiple promises that Parliament has made to the public that information would only be used for limited purposes. This breach of trust will have a negative impact on multiple public sector agencies and should not be permitted. The Council recommends that Schedule 2 is limited to provision of this data only for statistical purposes, not for ‘research’.

What can MPs do about this?

Short of the Bill being withdrawn altogether (as we and former Government Statistician Len Cook have recommended), it should be amended to restrict it to being a Bill about official statistics only, not data collection and sharing for ‘research’. Separate legislation, along the lines of the Australian Data Availability and Transparency Act 2022 could then be developed to create a framework for more safely collecting and using data for limited research purposes.

To achieve this, the Bill should be amended to:

Delete the words “or desirable for research under Part 5,” from clause 22(c).
Insert the words “for the purpose of producing official statistics” and the end of clause 26(2).
Delete Part 3 subpart 3 (clauses 32 and 33).
Delete the words “or research” from all the Acts amended in Schedule 2 and the Tax Administration Act in Schedule 4.
Tidy up the other clauses needing consequential amendments as a result of removing data collection “for research”.
Insert a new clause before clause 39 stating “Data collected or supplied to the Government Statistician under this Act shall only be used for statistical purposes.”

The new clause would effectively reinsert section 37(1) of the Statistics Act 1975, which is compliant with the UN Fundamental Principles of Official Statistics. Principle 6 states that

Individual data collected by statistical agencies for statistical compilation, whether they refer to natural or legal persons, are to be strictly confidential and used exclusively for statistical purposes.¹⁰
UN Fundamental Principles of Official Statistics. Principle 6

Section 37(1) of the 1975 Act respects this Principle, stating

Information furnished to the Statistician under this Act shall only be used for statistical purposes.

Clause 39(1) of the Bill does not respect or comply with Principle 6:

The Statistician must take all reasonable steps to ensure that the Statistician does not publish or otherwise disclose data in a form that could reasonably be expected to identify any individual or organisation.

The 1975 Act restricts use of data to ‘statistical purposes.’ The Bill only restricts ‘disclosure’. There is a wide gulf between the two, and this looser wording is a deliberate part of the Bill’s muddying of the waters between data gathered for ‘research’ and for ‘official statistics’. (Through clauses 22(c)(i) and 47(2)(a) data gathered for ‘research’ can be converted into official statistics.)

4. Data Sharing

Part 5 of the Bill creates a new regime governing access to data for ‘research’. Since the Council recommends deletion of the powers to collect data for ‘research’, this part of the Bill should be deleted entirely, and a new Bill developed to govern this. Again, we draw Members’ attention to the stark contrast between this confusing Bill and the principled Australian Data Availability and Transparency Act 2022. Members’ attention is also drawn to the minutes of a meeting held with the NZSIS on 4 August 2020 attended by the Government Statistician and the Prime Minister’s Chief Science Advisor.¹¹ At this meeting NZSIS said, “To maintain social license, we are balancing our investments in new data access and analytical capabilities with work to build trust in NZSIS as a responsible custodian of public data.”

Paragraph 12 of the NZSIS note states:

Rebecca [Kitteridge] referred to conversations she has had with our Minister about the benefit to be had from her and/or him speaking in public about our increasing use of data, and asked whether our guests felt we should wait until we have a more robust ethics framework in place. It wasn’t felt this was necessary – the entire NZ government approach to data ethics has been about transparency and warming the public up gradually to where we are at – none of our government mechanisms to address data issues and ethics were operating in a mature capacity yet. Public engagement on the issues and the work that is underway is important, and when one government agency speaks, it will benefit all of government.
(emphasis added)

In other words, Statistics NZ told the NZSIS that government agencies have been – and still are – consciously engaged in an exercise to manipulate and shape public opinion. We were shocked when we read these notes, and think this manipulation is destructive of public trust in the Government Statistician and Statistics New Zealand. We trust Members will be too, and aware that if they pass this Bill into law, they will be giving the green light to sharing New Zealanders’ data with intelligence agencies without any need for a ministerial warrant. Ask yourselves, is this conducive to trust in government and a free and liberal democracy? What will happen if an illiberal or populist government is elected that wants to misuse these powers?

The Council notes that in his submission on the Bill, the Chief Ombudsman also recommended the removal of Part 5 of the Bill. This is because it creates a regime for access to data entirely outside the Official Information Act, which is the cornerstone for our information access rights. Not only does Part 5 create a separate regime for access, it places it under the control of the Government Statistician (or any chief executive to whom the powers have been delegated), with no right of appeal to the Ombudsman under the OIA, only the Ombudsmen Act.

Clause 48(2) of the Bill enables the Government Statistician to impose conditions on the “publication or disclosure of the results of the research”. This censorship provision is again subject to the Ombudsmen’s review under the Ombudsmen Act. But the Ombudsmen would not, as they have done under section 28(1)(c) of the OIA, be able to tell the Statistician that the imposition of any conditions on use, publication and communication is only acceptable if good reason exists for withholding the information under sections 6, 7 or 9 of the OIA. The Ombudsmen could suggest those tests are reasonable, but could not issue the kind of recommendation that, under the OIA, would be de facto binding on Statistics New Zealand.

Worse still, if the person seeking access to the data under clause 48 is a public sector agency, the clause 54(1)(b) obligation on the researcher to comply with the conditions imposed by the Government Statistician under clause 48(2) means that effectively the Statistician can create grounds for a section 18(c)(i) refusal of requests under the OIA for the research results.

The Council also notes that the clause 54(1)(d) obligation on researchers to publish or otherwise disclose the results of their research and their methodologies can be circumvented “if a request for that data could be refused under section 18 of the Official Information Act 1982 (other than for the reason set out in section 18(d) of that Act)” – see clause 54(4). This is confusing as clause 54(1)(d) is about publishing results and methodologies, but the restriction applies to “data”. It looks like the government wants to shut down the possibility of people obtaining the government research on which policy recommendations are based if the research results contain data obtained from Stats NZ. The Bill provides public sector agencies with a new way to withhold information dealing with policy formulation or evaluation. Such secrecy is unacceptable.

The Government may argue that we should be reassured by several clauses in the Bill making provision for publication of information that is apparently intended to facilitate transparency and accountability for the use of data for ‘research’ and official statistics. These are in clauses 46(3), 53(1), 54(1)(d), and 56(5).

In each case their effectiveness is undermined by sub-clauses permitting the carefully specified detailed data to be published “in summary form”. Provisions that are meant to provide not just accountability but assurance of the benign use of the wide data-sharing powers, are thereby fundamentally weakened.

If access to granular data is good enough for the public sector, disclosure of granular information about that access and what has been done with it is an entirely justifiable quid pro quo.

What can MPs do about this?

The safest approach, which will prevent widescale access to personal data for undefined ‘research’ is to delete the entirety of Part 5 of the Bill, and begin work to co-design a different, privacy protecting, regime for access to microdata for research purposes. This work could be a commitment in New Zealand’s next National Action Plan as a member of the international Open Government Partnership.

If Part 5 is not entirely removed, the Council recommends the following amendments to guarantee publication of detailed information about the operation of the data sharing regime:

Delete sub-clauses 46(4), 53(2), 54(3) and 56(6).
Amend clause 53 to require monthly online publication of the data it presently prescribes, and to add after paragraph (b) a new paragraph specifying that the duration of accessing the data must be published, and further new paragraph after paragraph (e) specifying that the manner in which the research is to be used must also be published.

5. Governance and ethics

Ministers and supporters of the Bill have said that new legislation is necessary to provide a regime that is ‘fit for purpose’. However, in 1975 when the current Statistics Act was passed, Parliament was aware of the potential for data matching and sharing to be harmful to civil liberties. Parliament acted on those concerns and imposed strict limits in the Wanganui Computer Centre Act 1976.

Crucially, the Wanganui Computer Centre Act required the creation of a policy baord to govern it with non-government representation from both the NZ Computer Society and the Law Society.

The present Bill is not even as mature as this rudimentary measure from 1976. It vests all discretion in a single government official, who will only have to account for themselves through summary reports of the decisions they take. The Privacy Commissioner will have no role in overseeing the data-sharing decisions of this official, who will be in a position to let the intelligence agencies, police and military – as well as private sector consultancies – have access to New Zealanders’ data.

As if this concentration of highly dangerous power in the hands of one person wasn’t bad enough, clause 17 of the Bill enables the Government Statistician to delegate “any of the Statistician’s functions or powers under this Act” (with the exception of needing approval from either the Minister or Public Service Commissioner to delegate powers they have delegated to the Statistician). Those powers or functions may be sub-delegated to any public servant, including contractors, with the prior written approval of the Government Statistician, as provided by clause 2 of Schedule 4 of the Public Service Act 2020.

As Len Cook has pointed out, such a wide-ranging power of delegation is enormously risky, and unheard of elsewhere. It is worth reproducing his concerns at length:

The Minister of Statistics David Clark has managed to avoid the public scrutiny of the constitutional implications of the Data and Statistics Bill despite transparency being a proper expectation for such change by citizens in a democratic society.

The bill presented to Parliament by the minister waters down the role of the government statistician through the simple means of enabling the role to be delegated to unspecified persons or organisations without any further legislative oversight or qualification. Nowhere else in the world have changes of this sort been made.

…

Regardless of the political predisposition of ministers of the day, we need trustworthy official statistics to have confidence in how we measure progress or lack of on economic, environmental and social concerns.

It is the independence of the government statistician in the use of the confidential information provided to government only for statistical use that underpins trust in official statistics. No policy, service or compliance organisation that I am aware of has maintained without question a consistent reputation for being as responsible, scientific and transparent, for as long as the government statistician has.

The bill makes the government statistician a close partner of the policy, enforcement, surveillance and operational agencies of government through overseeing data sharing on an unspecified scale. It reverses the long-standing constitutional checks that distance the government statistician from policy advocacy or justifying the operational delivery of policies. In providing such agencies with the powers of the government statistician, as statistical clones, concerns of the public legitimacy of statistical functions critical to trust in government may lead to a loss of the trust we need to have in the role.¹²
New law could undermine confidence in official statistics, Len Cook, Stuff, 23 June 2022

What can MPs do about this?

There is no power of delegation in the Statistics Act 1975. The Council, Len Cook, and Sir Geoffrey Palmer agree that clause 17 of the Bill should be deleted.¹³

In addition, if the provisions on data collection for research are not deleted and Part 5 of the Bill is also not removed, then the Council recommends a new clause is inserted to create a Data Collection and Access Governance Board with non-government representation from the Law Society, Privacy Commissioner’s office, Ombudsman, Institute for IT Professionals, the Māori Data Sovereignty Network, and four people with an academic background in ethics.

The functions of the Board should be to consider all applications for collection of administrative data from public sector agencies, private organisations and individuals, as well all requests to access the data for ‘research’. The collection or sharing should only take place with Board approval. Further issues to be considered with regard to the Board’s functions can be drawn from Chapter 4 of the Australian Data Availability and Transparency Act 2022, which establishes a National Data Commissioner (distinct from Australia’s Privacy Commissioner) and a National Data Advisory Council. The relevant part of the Act can be read here: https://www.legislation.gov.au/Details/C2022A00011

The Bill should also have a clause inserted to require proactive publication of the agenda and papers for the governance board two weeks in advance of each meeting, and publication of the minutes within two weeks after each meeting, in order to facilitate public participation and accountability.

6. Census offence

The Bill continues from the 1975 Act the approach that failing to provide a census return is an offence. The Bill provides for this in clause 76, subclause (2) of which also continues the section 25(3) prohibition of claiming as a defence that neither a copy of, nor details of how to access and respond to, a request from the Statistician to provide a census return was received. The penalty upon conviction has quadrupled though, from $500 to $2,000.

However, while the fact that this is a strict liability offence has not changed, there has been a significant change in the wording. Section 25(1) of the 1975 Act expresses the duty on the member of the public thus:

A person who for any reason has not received either a schedule relating to a census of population and dwellings, or a means to access an electronic schedule, must obtain either a schedule, or a means to access an electronic schedule, in accordance with the details published by the Statistician of how to obtain a schedule.
[emphasis added]

This implies that Statistics New Zealand is responsible – if not subject to an actual duty – for ensuring people receive a census schedule that they must complete and return to Statistics New Zealand.

Clause 34 of the Bill does not reproduce this responsibility either explicitly or implicitly. This is likely to be because Statistics New Zealand would like to shift everyone to filling out the census form online. Instead, there is a much vaguer obligation in clause 34(4)(b) to publish the information about how to obtain and respond to the census request “by any other additional means the Statistician considers sufficient for notifying the public of New Zealand.”

The Council is not reassured that this clause 34(4)(b) is comparable to the expectation people can have under the 1975 Act that Statistics New Zealand will deliver a census schedule to them, or that it is a sufficient obligation on the Statistician. In particular, it is concerned that there is no general duty in the Bill on the Statistician or Statistics New Zealand to ensure that requests for information are made in formats and methods that people with different communication needs can use.

This aspect of the Bill was made worse by the select committee, which added a new sub-clause 5A stating:

(5A) In order to make a request under section 23 to an individual as part of the census, it is sufficient for the Statistician to publish under subsection (4) the information specified in subsection (5)(c)(i).

In other words, the Government Statistician simply has to publish information on a website about how a person may access a request to complete a census return, or obtain a copy of the request, and use ‘any other additional means the Statistician considers sufficient for notifying the public of New Zealand’.

MPs will shortly debate a petition from the Citizens Advice Bureau about tackling digital exclusion. But the Data and Statistics Bill does nothing concrete to ensure that the Statistician must provide people without internet access and access to a computer with the means to comply with their legal obligation. Are people expected to complete a census return on a mobile phone with pay-as-you-go data? Will people with limited literacy or learning difficulties be penalised if they can’t access or complete a census return?

What can MPs do about this?

The Council believes the Bill should be amended to create a duty on the Statistician to both communicate directly to each household that a census return is required, and to provide locally relevant information about where and when people can access a computer, internet connection and assistance needed to complete the census online, or how to obtain a paper copy of the census form. The Bill should be amended to:

Inserting a new paragraph (aa) between clause 34(4)(a) and 34(4)(b) with the following –
“by either delivering to each and every dwelling place a printed notice in all relevant languages and in appropriate forms for people with different communication requirements;”
Adding to clause 34(5), after ‘census’ “including the nearest place that, for no cost, they can access a computer, internet connection, and any necessary assistance needed to respond to a request made by the Statistician under section 23 as part of the census”.
Inserting a new sub-clause after clause 71(1) stating “The authorised person must revoke the infringement notice if the Statistician cannot prove beyond reasonable doubt that the person received the information required by section 34(4)(aa).”
Deleting the word “not” from clause 76(2), so that it is a defence to the offence of failing to complete a census return that the person was not provided with a copy of the census form or details of how to access and respond to a request to fill it in online. If the Statistician is complying with their duties under section 17 of the Public Records Act 2005 (to create and maintain records of their operations), he or she will be able to provide a court with proof that the form or information about how to complete the form was provided to the person charged with the offence.

7. Open government and public participation

There is no evidence that those developing this Bill have paid any regard to the Public Service Principles set out in section 12 of the Public Service Act 2020 in general, and the statutory duty on the Government Statistician to ‘foster a culture of open government’ in particular.

Open government is not simply about proactive publication of information or disclosure of information in response to a request. It is also about public participation in policy development, government decision making and evaluations, to name a few areas. The Council notes that the April 2019 Summary of submissions on 2018 consultation published by Statistics New Zealand describes the results of an opinion poll conducted on “what people thought were the most important outcomes for the new legislation”.¹⁴ The poll found that 65.3% of people supported the outcome of “The public can have a say on important changes to the data collected for official statistics.”

The Council welcomes clause 36 of the version of the Bill reported back from the select committee, which obliges the Government Statistician to “consult the public generally” about “the manner of taking, and the data to be collected in” each census. It is pleased that a similar duty was added to clause 20 by the select committee. That provision concerns the preparation of “a draft multi-year data and statistical programme”.

However, Schedule 6 of the Public Service Act 2020 requires government departments to provide a “long-term insights briefing” (LTIB) to their Minister at least once every three years. Crucially, chief executives are also required to consult the public both on the subject matter to be included in the briefing, and on a draft of the briefing. In other words, the provision of a long-term insights briefing requires two stages of consultation by a department.

Similarly, the Council notes that clause 90 of the Bill empowers the Statistician to set written standards on several aspects of official statistics, collecting and managing data, and access to data under Part 5 of the Bill. The Council welcomes new clause 91A added by the select committee to require consultation with people the Statistician “thinks appropriate”, but this could easily be interpreted narrowly. It recommends that the Statistician consult the public, and again considers it should be a two-stage process like LTIBs, requiring the Government Statistician to consult the public on (a) proposals for all written standards, and (b) on the final draft of each standard.

Serious problems regarding data collection have arisen because affected people have not been included in the decision-making process on where money is spent to collect data.

Members of the Council’s committee have participated in workshops organised by Statistics New Zealand to review the government’s Data Strategy. In the course of one of these workshops, an official from a government department explained that information on child poverty affecting a particular ethnic group could not be provided to DPMC officials assisting the Prime Minister with that portfolio because insufficient data was collected to permit provision of the kind of granular data gathered by Statistics New Zealand through its surveys. The consequence of this is that policies that are appropriate for that ethnic group are much harder to successfully develop.

A solution to this problem is to increase the number of people surveyed, so that all population-weighted cohorts are of a sufficient size that granular data can be safely provided to policy analysts without risk of re-identification.

In another example of policy and service delivery being compromised through the absence of data being collected, the Council notes that parents of children with disabilities have found it impossible to obtain data from the Ministry of Education on ORS funding because the Ministry does not collect the data.

The Council understands that Statistics New Zealand supports an interdepartmental data investment committee which makes decisions on what data to collect. We believe that conformance to:

the spirit of the OIA’s public participation purpose,
the statutory duty on departmental Chief Executives under the Public Service Act to “foster a culture of open government”, and
New Zealand’s commitment to the Open Government Partnership’s Declaration

requires a means of public and community participation in the data investment committee, as well as a duty on Statistics New Zealand to proactively publish the agenda, minutes and papers of the committee.

What can MPs do about this?

The Council believes the Bill should be amended as follows:

Clause 20 be amended to require the Government Statistician to consult the public on (a) the proposals for inclusion in the multi-year data and statistical programme, and (b) the penultimate draft of the programme, before it is submitted to the Minister for approval under clause 18(3).
Clause 91A be amended to require the Government Statistician to consult the public on (a) proposals for all written standards, and (b) on the final draft of each standard.
A new clause following clause 21, to provide for public participation in decisions on what and where investments are made on what data to collect, through membership of the relevant decision-making body, and that the clause require publication of the agenda, minutes and papers of this decision-making body. That public participation should be done using accessible formats and processes.

8. Conclusion

As noted, the Council thinks this is dangerous and poorly drafted legislation. It enables state surveillance through wide data gathering and sharing powers, delegation, with poor oversight and governance. It will destroy the reputations of Statistics New Zealand and the Government Statistician as trusted and independent stewards of our official statistics regime, both domestically and internationally. It will result in people declining to provide data to departments wherever possible, or providing inaccurate data. Trust in the public service and government’s handling of personal data will suffer over time.

The Bill should be withdrawn and a new process begun to openly co-create new legislation both on official statistics and on collection and sharing of data for other purposes. This has to include, at a minimum, public consultation on an exposure draft of the proposed legislation.

If the Bill is not withdrawn, the amendments proposed by the Council in this briefing to Parts 3 and 5 of the Bill would restrict it to an update of the Statistics Act. Separate legislation could then be developed to provide for an Aotearoa New Zealand equivalent to Australia’s Data Availability and Transparency Act 2022.

Briefing on the Data and Statistics Bill

Contents

1. The big picture

2. Privacy and public trust

Surveys of public trust in government handling of personal data

‘De-identification’, not anonymisation

The key issues here are:

3. Data Collection

The switch to ‘administrative data’

Data collected for ‘research’, not official statistics

Data gathering by amendment or repeal of other legislation

What can MPs do about this?

4. Data Sharing

What can MPs do about this?

5. Governance and ethics

What can MPs do about this?

6. Census offence

What can MPs do about this?

7. Open government and public participation

What can MPs do about this?

8. Conclusion

Further reading

Meeting dates for 2024

Submissions

Articles

Blog Posts

News

Useful Links

NZCCL Mastodon Posts