Today’s release of two reports into the protection of personal information show agencies must be better at privacy, says Privacy Commissioner Michael Webster.

The Inquiry into how government agencies protected personal information for the 2023 Census and COVID-19 vaccination programme (the PSC Inquiry) and the Independent investigation and assurance review of allegations of misuse of 2023 Census information (the Stats NZ report), show the protection of personal information needs to be treated as a priority.

Several matters have now been referred to the Office of the Privacy Commissioner (these are detailed below).

Privacy Commissioner Michael Webster said he is carefully reviewing the referrals raised in the two reports. That work will be done in the context the Privacy Act and the need to ensure individuals’ rights to privacy is protected and respected.

"New Zealanders need to be confident that when they do activities, like filling in their Census form, or giving over information for medical services, that their information is collected, used, and shared as the law outlines it should be," says Mr Webster.

"The Privacy Act is very clear that agencies collecting personal information need to keep it safe and treat it with care. This responsibility extends to the use of third-party service providers.

Agencies need to be confident that personal information is protected wherever and whatever organisation is handling it."

The Office of the Privacy Commissioner has recently issued guidance to help agencies working with third-party providers understand their responsibilities.

Mr Webster said he was encouraged to see that work on a new information sharing standard is underway, supporting the information stewardship framework at the core of the Privacy Act.

"Its important people can trust that their information is treated with care. In our 2024 Privacy Survey the percentage of people who said they are "more concerned" about privacy issues over the last few years has increased to 55%, a 14% increase from two years ago. New Zealanders were clear in their response to these concerns:

• 80% want more control and choice over the collection and use of their personal information.
• 63% said protecting their personal information is a major concern in their lives.
• around two-thirds of New Zealanders are concerned about businesses or government organisations sharing their personal information without telling them.

"Good privacy is an essential part of providing services and doing business in a digital economy. Today’s findings should be a reminder to government organisations that good privacy practices aren’t an optional extra but are fundamental to the work they do," says the Commissioner.

A number of questions have now been referred to the Privacy Commissioner by the PSC Inquiry:

• Whether systems and controls were appropriate for personal data following its transmission by Te Whatu Ora, the Ministry of Health and Stats NZ to service providers
• Whether there were appropriate means in place for these public agencies to be confident that their service providers were meeting their contractual privacy requirements
• Whether personal information was collected or used by Manurewa Marae for unauthorised purposes
• Whether separation of personal data from Census data was maintained at Manurewa Marae, and whether privacy statements were adequate to inform people about the use of their information.

A further matter has been referred to the Privacy Commissioner by the Stats NZ report about the collection and management of personal information and confidential census data.

While the review of the referrals takes place, the Office will not be making any further comment.

© Scoop Media