NZ Council for Civil Liberties

Supplementary Submission: Data and Statistics Bill

Published · Updated

Our oral submission to the Governance and Administration Select Committee asked some important questions including “Where is the Privacy Impact Assessment?” and “Why is Statistics talking about the NZ govt ‘warming up the public gradually’ to further data sharing?” . The Committee asked us to put these points in a supplementary written submission.

1 Privacy Impact Assessment – missing in action

As Committee members will be aware, the Legislation Design and Advisory Committee produces Cabinet-endorsed standards for the design and drafting of Bills, that are published as the Legislation Guidelines.1Legislation Guidelines, Legislation Design and Advisory Committee, 2021. Accessed from: http://www.ldac.org.nz/guidelines/

Chapter 8 of the Guidelines concerns privacy, and dealing with information about people. It opens with the following statement that is directly relevant to the Data and Statistics Bill:

The unnecessary collection, misuse or perceived misuse, or unauthorised disclosure of personal information erodes the community’s trust in the Government and other institutions, and can make it harder to collect information in the future.

The chapter continues:

If new policy is being developed that proposes the handling of personal information (that is, information about a person that either identifies or is capable of identifying that person), officials must first consider whether the proposed action is governed by the Privacy Act 2020… The two key concepts in the Act are purpose and transparency. If the personal information is already held by a public body for another purpose, officials must consider whether the proposed use falls within the purposes for which the personal information was originally collected, and whether those purposes have been communicated to the individuals concerned, before developing legislation that permits a new use or disclosure of that information. 

Any policy development that affects personal information should include a Privacy Impact Assessment at an early stage to assess the extent of the impact on privacy and how that impact can be managed in the policy development process. 

Section 8.3 of the Guidelines begins:

New legislation should only provide authority for personal information sharing where the sharing cannot be undertaken using one of the existing mechanisms in the Privacy Act 2020 (for example, an approved information sharing agreement), or where using those mechanisms is not sufficient for the policy purpose. 

The government’s approach

It appears to the Council that a key purpose of this Bill is to provide statutory authority to override the protections for gathering, processing and use of people’s information that the Privacy Act 2020 was enacted to provide. It seems the government wants to avoid having to create ‘approved information sharing agreements’ under the Privacy Act, presumably because it finds burdensome the transparency and accountability its own Act requires to provide minimal safeguards and assurance to the public.

The Bill seeks to entrench a culture of gathering and sharing administrative data for undefined ‘research’ purposes.2Information privacy principle 4, paragraph 4(e). Privacy Act 2020. It seems to the Council that the government is likely to adopt a very limited approach to the Privacy Act’s principle of transparency about the use of personal data.

We believe that, in future, when people are required to provide personal information to government departments in order to obtain services or goods they will simply be told that in addition to the information being gathered by the department for its own limited purposes, it is also being gathered for the purpose of ‘research’. People might be informed that this research may not just be carried out by the department gathering the information, but also by other government departments, but we doubt they will be explicitly told that the information may be passed to the Police and the NZ Security Intelligence Service, or academics and private sector organisations.

The government may argue that the law permits agencies to not tell people that their data will be used for research purposes. However, if Statistics NZ, and the government more broadly, adopt this approach, they will be consciously contradicting their own repeated claims of wanting to build public trust in data sharing through ‘transparency’.

Surveys of public trust in government handling of personal data

The Privacy Commissioner has, for several years, commissioned surveys of the public about their views on privacy and data sharing.

In the 2016 survey, 62% said “We should not share data as the risks to people’s privacy and security outweighs the benefits”.3Privacy survey 2016, Privacy Commissioner. Accessed from: https://privacy.org.nz/publications/surveys/privacy-survey-2016/

In the 2020 survey, 61% of the public said they were concerned about “Government agencies sharing your personal information without your permission”, of whom 36% were ‘very concerned’.4Privacy survey 2020, Privacy Commissioner. Accessed from: https://privacy.org.nz/publications/surveys/privacy-survey-2020/

Only 28% of respondents to the 2020 survey agreed with the statement “I trust that anonymised data cannot be traced back to me”, and only 26% agreed that “I feel in control of how my personal information is used by government.”

Effects of the government’s approach

As noted in our written submission, riding roughshod over protections for people’s data is likely to end badly, not simply with a lack of trust and unwillingness to provide accurate information undermining the reliability of government data, but also trust in government as a whole. Precisely the point identified by the Legislation Design and Advisory Committee at the start of its advice on legislation affecting personal information.

As noted in our oral submission, Statistics NZ has not published a Privacy Impact Assessment for this Bill, which clearly, and fundamentally, concerns the gathering, use and sharing of personal information by government agencies. This is clearly both contrary to the Cabinet-endorsed LDAC Guidelines and no accident.

The Council urges the Committee to seek, and publish, an explanation from the Government Statistician as to why this is the case, and to require the department to commission an independent Privacy Impact Assessment. Members of the whole House need to have this available to them when considering the Bill, should it proceed to subsequent stages.

2 Manufactured ‘social licence’ for data sharing

In our oral submission to the Committee we drew members’ attention to information that had been disclosed by the NZ Security Intelligence Service in response to an Official Information Act (OIA) request.

The Security Intelligence Service was asked for advice it had received on ‘ethical data analytics’ from Statistics NZ, the Prime Minister’s Chief Science Advisor and the Privacy Commissioner.5The OIA request to, and response from, NZSIS can be read here.

The response from the NZSIS on 27 January 2022 enclosed the Service’s record of two meetings, held on 15 May 2020 and 4 August 2020.

The 4 August 2020 meeting was attended by the Government Statistician and the Prime Minister’s Chief Science Advisor. At this meeting NZSIS said its work required it to “access and analyse more data than ever before”. The Service’s note continues, “To maintain social license, we are balancing our investments in new data access and analytical capabilities with work to build trust in NZSIS as a responsible custodian of public data.”

Paragraph 12 of the NZSIS note states:

Rebecca [Kitteridge] referred to conversations she has had with our Minister about the benefit to be had from her and/or him speaking in public about our increasing use of data, and asked whether our guests felt we should wait until we have a more robust ethics framework in place. It wasn’t felt this was necessary – the entire NZ government approach to data ethics has been about transparency and warming the public up gradually to where we are at – none of our government mechanisms to address data issues and ethics were operating in a mature capacity yet. Public engagement on the issues and the work that is underway is important, and when one government agency speaks, it will benefit all of government.

(emphasis added)

In other words, Statistics NZ told the NZSIS that government agencies have been – and still are – consciously engaged in an exercise to manipulate and shape public opinion. We were shocked when we read these notes, and we trust the Committee will be too.

Objective of ‘warming up’ the public to data sharing

Given the views of the public towards data sharing established by the Privacy Commissioner’s surveys (see above), the objective of this ‘warming up’ of the public, is presumably get people to accept weakened protections for their personal information, and widespread sharing of their information. Not only across government departments that develop policy and services for the public, but with the state’s most powerful and secretive agencies, the police, Customs, the Defence Force, NZ Security Intelligence Service and the Government Communications Security Bureau.

This ‘warming up’ of the public to create the ‘social license’ for mass data sharing has been led by Statistics NZ through the Data Futures Forum and the Data Futures Partnership, under its former Chief Executive, who is now the Acting Privacy Commissioner. The Council recommends that MPs explore whether this perceived conflict explains why the Privacy Commissioner has made no submission to the Committee on this Bill, by asking the Acting Commissioner to appear before them.

Implications of the NZSIS disclosure

The 2015 Cabinet paper that proposed creation of the Data Futures Partnership noted that

Public trust in the data-use ecosystem is tenuous, and once lost, trust can be hard to restore.6A New Zealand Data Futures Partnership, Ministers of Finance and Statistics, August 2015. Accessed from: https://www.stats.govt.nz/assets/Uploads/Retirement-of-archive-website-project-files/Corporate/Cabinet-paper-A-New-Zealand-Data-Futures-Partnership/nz-data-futures-partnership-cabinet-paper-redacted.pdf

Or as the LDAC put it in their Guidelines:

The unnecessary collection, misuse or perceived misuse, or unauthorised disclosure of personal information erodes the community’s trust in the Government and other institutions, and can make it harder to collect information in the future 

Members of Parliament need to be clear about the implications of these disclosures.

They show that the philosophy of a Bill that seeks to entrench within government the approach to exploitation of personal data that Google, Facebook and Amazon profited from (in spite of the low levels of trust in those companies use of personal data) is driven not by public consent, but by government agencies consciously and deliberately setting out to manipulate the public into accepting the creation of these dangerous and far-reaching powers.

They show that the Government Statistician, whose core job is to retain public trust in the confidential handling of their data so that they respond to censuses and surveys, was discussing with the head of the country’s domestic intelligence agency how they could access New Zealanders’ personal data. The Statistician has apparently told the NZSIS how – by speaking in public about this data sharing – it could contribute to ‘social license’ for sharing personal data for all agencies.

We think this conduct is inimical to public trust in Statistics New Zealand, and shows the true face of what this Bill is intended to enable. Saving money on statistically robust surveys by using administrative data instead appears to be closely tied to side-stepping international standards on confidentiality and our own Privacy Act. Is this the kind of society Members want to create? What use could be made of these powers were a leader with populist disregard for social and legal norms to be elected?

The Data and Statistics Bill should not proceed

Members need to be fully conscious that if they allow the Bill to proceed, they will be ignoring the advice of the Len Cook, someone who is not only New Zealand’s former Government Statistician, but also the National Statistician for the UK. They will also be ignoring the advice of Parliament’s own Ombudsman that Part 5 of the Bill should be cut out of the Bill.

The public will hold MPs accountable for endorsing and creating a regime that not only flouts the UN’s Principles on official statistics, but which will lead to increasing distrust of government agencies. At a time when politicians and academics are rightly worried about social cohesion in the face of the many hard choices governments will have to make in the future, is that distrust something that Parliament should be actively creating?

Privacy is the foundation of personal autonomy and dignity. Without it, many of our other civil liberties and rights cannot safely be enjoyed. Our privacy should be safeguarded by the Privacy Principles set out in the Privacy Act and adherence to the UN’s Fundamental Principles of Official Statistics, not overridden in the name of glib phrases like ‘data driven innovation’, let alone ‘cost saving’.

The Council strongly recommends that the Committee urgently call the Government Statistician to appear before it, so that they can be asked about this work to manufacture consent.

The Council also recommends that the Committee invite Mr Cook back to give further testimony, since the 5 minutes accorded him fails to do justice to his experience and the value he could provide to the Committee.

3 Statistics NZ fails to be ‘transparent’

Statistics NZ has made much of the idea that ‘transparency’ will lead to public confidence in the handling of information about them. Our main law on transparency is the Official Information Act. The Council draws to the Committee’s attention that prior to its oral submission to the Committee on 16 February, the Council had made an OIA request to Statistics New Zealand.

In the NZSIS note of the meeting held on 15 May 2020, Statistics NZ informed the NZSIS that it “had done some work with Customs New Zealand and written a discussion paper regarding the dimensions of security vs. transparency.” The Council made an urgent request to Statistics NZ for a copy of this paper on 8 February 2022, to inform its oral submission to the Committee.7The Council’s OIA request can be read here: https://fyi.org.nz/request/18491-stats-nz-discussion-paper-regarding-the-dimensions-of-security-vs-transparency At the time of writing, the department has not responded to this request, either urgently or at all. This is now well outside the 20 working day time limit for responses required by the OIA.

It is difficult to reconcile this failure to supply a single, easily retrievable document, with the statement in the notes of the August 2020 meeting that “the entire NZ government approach to data ethics has been about transparency”. Instead, it suggests to the Council that the frequency with which the words ‘transparency’ and ‘trust’ are used by Statistics NZ are in inverse proportion to how the public should regard it.

4 ‘Surveillance capitalism’ – a brief introduction

During our oral submission, we referred to the Bill as embedding what Harvard Professor Shoshanna Zuboff has described as ‘surveillance capitalism’. We recommend her book The Age of Surveillance Capitalism,8The audio book can be borrowed from Wellington City Library here: https://wcl.overdrive.com/media/3063955 but a quick and easy introduction to the concept and implications can be gathered from listening to a recording of her discussion with Cambridge University Professor of Politics, David Runciman, here: https://tinyurl.com/databillNZ