The NZ Council for Civil Liberties is pleased that the Office of the Privacy Commissioner (OPC) has reacted to public pressure and made a late submission highlighting problems with the Data and Statistics Bill. 

In doing so, the Privacy Commissioner joins the Ombudsman, and the former Government Statistician Len Cook, in highlighting serious flaws in the Bill. NZCCL and Mr Cook have both called for the entire Bill to be withdrawn, and the Ombudsman has called for part 5 of the Bill to be scrapped.

The combination of no Privacy Impact Assessment by Statistics NZ (contrary to the Cabinet-backed Legislation Guidelines) and no submission to the select committee from the OPC was a matter of deep concern, given the serious privacy issues raised by a Bill that will empower Statistics NZ to collect and share personal data from everybody’s interactions with every government agency, without the permission of those whom the data is about.

The submission from the Privacy Commissioner (who was previously Government Statistician themselves) seems to have been made grudgingly. It starts by talking about how the Office of the Privacy Commissioner didn’t think they needed to do a submission because they were involved during the development of the Bill, but has since reacted to public pressure in order to produce a submission. However the content of the submission shows that they too have significant concerns.

The OPC confirms NZCCL’s view that the Bill overrides the Privacy Act 2020, saying “To the extent that the Bill clearly authorises personal information to be collected, held, used and disclosed, it will override restrictions in the information privacy principles in the Privacy Act.”

The Privacy Commissioner then makes a number of suggestions for significant changes to improve the Bill. These include:

• Calling out the removal of the requirement in the 1975 Statistics Act that “Information furnished to the Statistician under this Act shall only be used for statistical purposes”. They believe that the Bill would benefit from a commitment to only allow data to be used for “statistics and research”. NZCCL further calls for the Bill to follow the 1975 Act and United Nations Fundamental Principles of Official Statistics and restrict use to ‘statistical purposes’.
• The OPC clearly opposes the provisions allowing the Statistician to delegate their functions or powers to others, saying it is “not clear why such broad provision has been made”. This matches concerns raised both in our submission and that of former Chief Statistician Len Cook.
• They note that the Government Statistician – a government official – is the sole arbiter of requests for access to research data but expect that the Statistician would consult with others. However the OPC goes further and recommends the creation of a formal research ethics committee to assist the Statistician in these decisions. The Ombudsman’s submission called for the entirety of this part of the Bill to be scrapped, questioning why an alternative to the OIA should be created. NZCCL highlighted that the governance regime for access to people’s data will be weaker than the 1976 Wanganui Computer Centre Act.
• They reject the idea that the Statistician should be able to request data that is “desirable” for the production of official statistics or for research purposes, especially when this may include compulsion, saying that it should be limited to where it is “necessary”.
• The Privacy Commissioner believes the Bill should more carefully spell out the relationship between the Bill and the Privacy Act. They also note that, unlike the Act, the Bill fails to allow for redress when people are harmed by the release of personal information, and recommend that in this circumstance that the Bill should provide a right for individuals to complain to the Privacy Commissioner.

While the Privacy Commissioner downplays the Bill overall, NZCCL thinks the amendments recommended are significant points that align with those raised by us and others. 

Chairperson of the Council, Thomas Beagle, says, “The Privacy Commissioner’s own 2020 survey of the public shows that 61% of the public are concerned about government agencies sharing personal information without their permission, and only 28% agreed with the statement that ‘I trust that anonymised data cannot be traced back to me.’ Only 1 in 4 people said they ‘feel in control of how my personal information is used by government’.”

Mr Beagle said, “The Select Committee must take these views into account and send the Bill back for a rewrite as we recommend. As the Ombudsman, former Government Statistician and now the Privacy Commissioner have made clear, significant changes are needed to the entire architecture of the proposals. A decision to proceed with the Bill in the face of these serious concerns would signal not just that the government is abandoning its desire for public support for the proposals, but that it does not care about the trustworthiness of our official statistics system.”

Further reading

• What’s wrong with the Data and Statistics Bill
• Guest Post: Data & Statistics Bill Should Be Withdrawn