Author: MIL-OSI Publisher

Source:

18 Feb 2025, 15:15

Today’s release of two reports into the protection of personal information show agencies must be better at privacy, says Privacy Commissioner Michael Webster.

The Inquiry into how government agencies protected personal information for the 2023 Census and COVID-19 vaccination programme (the PSC Inquiry) and the Independent investigation and assurance review of allegations of misuse of 2023 Census information (the Stats NZ report), show the protection of personal information needs to be treated as a priority.

Several matters have now been referred to the Office of the Privacy Commissioner (these are detailed below).

Privacy Commissioner Michael Webster said he is carefully reviewing the referrals raised in the two reports. That work will be done in the context of the Privacy Act and the need to ensure individuals’ rights to privacy is protected and respected.

“New Zealanders need to be confident that when they do activities, like filling in their Census form, or giving over information for medical services, that their information is collected, used, and shared as the law outlines it should be,” says Mr Webster.

“The Privacy Act is very clear that agencies collecting personal information need to keep it safe and treat it with care. This responsibility extends to the use of third-party service providers. 

Agencies need to be confident that personal information is protected wherever and whatever organisation is handling it.”

The Office of the Privacy Commissioner has recently issued guidance to help agencies working with third-party providers understand their responsibilities.

Mr Webster said he was encouraged to see that work on a new information sharing standard is underway, supporting the information stewardship framework at the core of the Privacy Act.

“Its important people can trust that their information is treated with care. In our 2024 Privacy Survey the percentage of people who said they are “more concerned” about privacy issues over the last few years has increased to 55%, a 14% increase from two years ago. New Zealanders were clear in their response to these concerns:

• 80% want more control and choice over the collection and use of their personal information.
• 63% said protecting their personal information is a major concern in their lives.
• around two-thirds of New Zealanders are concerned about businesses or government organisations sharing their personal information without telling them.

“Good privacy is an essential part of providing services and doing business in a digital economy. Today’s findings should be a reminder to government organisations that good privacy practices aren’t an optional extra but are fundamental to the work they do,” says the Commissioner.

A number of questions have now been referred to the Privacy Commissioner by the PSC Inquiry:

• Whether systems and controls were appropriate for personal data following its transmission by Te Whatu Ora, the Ministry of Health and Stats NZ to service providers
• Whether there were appropriate means in place for these public agencies to be confident that their service providers were meeting their contractual privacy requirements
• Whether personal information was collected or used by Manurewa Marae for unauthorised purposes
• Whether separation of personal data from Census data was maintained at Manurewa Marae, and whether privacy statements were adequate to inform people about the use of their information.

A further matter has been referred to the Privacy Commissioner by the Stats NZ report about the collection and management of personal information and confidential census data.

While the review of the referrals takes place, the Office will not be making any further comment.

Source:

12 Feb 2025, 10:00

The hunt to land a flat over summer shouldn’t come at the expense of people’s privacy rights, warns Privacy Commissioner Michael Webster.

“There’s often a lot of pressure on people, especially students, to find a flat quickly, which risks privacy shortcuts being taken and that can put both tenants and landlords at risk.

Tenants should be aware they have privacy rights when applying for a flat and that landlords have obligations under the Privacy Act, Mr Webster says.

“Tenants are often desperate to find a flat, so they might disclose a whole lot of personal information that isn’t legally required. Essentially, they’re giving others power over their own details and that isn’t a great strategy.”

The desire to get a tenant quickly could also lead some landlords to take privacy shortcuts, which puts people at risk.

“The majority of landlords care about their tenants’ privacy, but there can be a lot of factors to weigh up when considering applications and it can be tempting to over collect personal information and to get details that aren’t legally allowed. It can also mean they can end up with a large amount of information with no way to manage or store it safely.

“Landlords need to know what information they can legally collect, and when. They also need to make sure personal information collected during the rental application process is kept secure and is not disclosed without authorisation.”

“Personal information has value and is protected under the Privacy Act at all stages of the rental process. It’s important shortcuts aren’t taken to fill a flat and that only the necessary personal information is supplied and only when its needed.”

Personal characteristics, including relationship status, age, gender identity and employment status are protected under the Human Rights Act. Things like spending habits, experience of family violence, employment history and social media URLS are protected under other Acts.

To help educate landlords and tenants OPC had updated its guidance for the rental sector to help make sure that privacy is respected throughout the application process.

Read our updated privacy guidance for tenants and landlords.

Source:

The Reserve Bank of New Zealand – Te Pūtea Matua (RBNZ) has released its first voluntary Climate-related Disclosure – Ngā Whakapuaki e Pā ana ki te Āhuarangi for FY2023/24, outlining our progress in understanding, monitoring, and managing climate-related risks.

Source:

By Michael Webster, Privacy Commissioner.

This article was first published in The Post.

OPINION: Should you have to disclose to your insurance company if you’ve taken a genetic test and learnt you have the gene for a medical condition? Should they be able to require you to test?

Without adequate safeguards, a person’s genetic test could be used by an insurer to assume things about them and their whānau, including future children. This could affect insurance cover for people before they’re even born.

If insurance companies require predictive testing to be done before they insure an individual, the results could show a greater risk of a condition developing later in life, but that condition may never actually develop.

But the risk factor means people could be refused cover, or subject to exclusions or higher premiums. This risk could also result in fewer people getting tested or participating in genetic trials, leading to poorer health outcomes.

You might say, for some types of insurance, I already need to disclose a pre-existing medical condition anyway, so what’s the issue? Genetic information is not just highly sensitive personal information about you. It is you. But it also reveals information about people who are related to you – past, present and future.

There is a big difference between disclosing your own personal medical history and disclosing the information of family and relatives for insurance purposes.

What’s more, a person’s medical history shows specific current and past diagnoses and treatments based on assessments by health professionals. Compare this to predictive testing which can tell an insurer what conditions a person may have, but also what their likelihood of developing a condition in the future may be.

Clearly, protections need to be put in place to empower consumer choice and to prevent discrimination in insurance cover based on a person’s predictive genetic information.

The key point relating to privacy and human rights is, it’s the choice of the individual to have this testing done and to share any information it reveals as they choose. They will, hopefully, have made an informed decision to be tested in consultation with a health professional.

The collection, use, disclosure and storage of genetic information are all subject to the Privacy Act. But the act cannot stop insurers from requiring genetic tests are taken or disclosed as a condition of their insurance cover.

Most OECD countries have protections against genetic discrimination; in New Zealand, there have been submissions made to Parliament and recommended changes to the Contracts of Insurance Bill.

I support adding specific targeted protections to manage the privacy risks of using genetic tests in the insurance context. This includes prohibiting insurance companies from requiring an individual to take a genetic test or disclose genetic test results.

There is also merit in exploring amendments to the Privacy Act or stand-alone legislation to better protect against genetic discrimination while providing the safe privacy enhancing use of genetic testing, which could help benefit New Zealanders.

Emerging technologies like genetic testing have great potential and my office supports their use when it’s done safely and in a way that ensures adequate protection of personal privacy.

Predictive genetic testing clearly has a place in New Zealand’s future, but this should be balanced with the right safeguards protecting individual choice about whether to be genetically tested or not.

Back

Source:

This summary was written by Rachel Levinson-Waldman, who served with OPC as a 2024 Ian Axford Fellow in Public Policy.

Read her in-depth report.

What is social media monitoring?

Social media monitoring in this context means just about any use of social media that isn’t for public education or outreach. It covers government agencies and public servants obtaining information about individuals or groups for law enforcement, intelligence, public safety, criminal investigations, regulatory enforcement, risk or threat assessment, or fraud detection.

What are the different ways that government agencies might access social media?

1. Broadly, there are five categories. Most agencies don’t use every one of these, and some may use methods that vary somewhat.
   Google or other general web searches that turn up publicly-available social media information – for instance, a public Facebook profile.
2. Searches on social media sites for people, groups, hashtags, etc. Depending on the needs of the agency and the potential risk to employees, that could be through an account visibly affiliated with the agency or an alias (an account showing a different name and identity from the person operating it). Mostly this activity doesn’t involve interacting directly with other people on the platform, but in some situations could involve viewing or joining a group.
3. Connecting directly with people on social media, via messaging, “likes”, etc. This typically involves the use of an alias account.
4. Using third party tools for data collection and analysis.
5. Taking over an account with the consent of the individual. This appears to be used mostly – perhaps solely – by Police and is carried out through specific forms that enable either temporary or permanent takeover. Note: the forms are included in the appendices of Rachel’s report.

What agencies in Aotearoa New Zealand use social media and do they have policies in place?

Has the government said anything about developing and publishing policies on social media monitoring?

Yes. A 2017 joint report, by the Law Commission and Ministry of Justice, recommended that heads of enforcement agencies be required to issue policy statements addressing social media monitoring. In 2018, the Public Service Commission released model standards requiring agencies to establish a policy framework for information collection, which would also support the publication of policies addressing use of social media.

What does it matter if the government is looking at social media? Isn’t it just dog pictures and whatever people have chosen to put online?

Use of social media by government agencies to make decisions about investigations, prosecutions, risk monitoring, welfare benefits and other activities brings a variety of potential risks. 

• Social media data can help create a surprisingly comprehensive picture of a person or group. Social media platforms host vast quantities of data from posts to likes to pictures, as well as a wealth of information about people’s friends, family, and other networks. Social media also makes it much cheaper and easier to assemble this information than older, analogue methods of information collection.
• Social media can be difficult to interpret. It’s highly dependent on cultural and language references, tone, in-group speak, and memes. Examples include British travellers who were barred from the United States after one tweeted out a joke that was misinterpreted and a high-ranking state official in the U.S. who lost his job after posting a picture from the rap group Public Enemy’s album that was interpreted as a threat to police. People also communicate in intentionally misleading ways on social media, as with white supremacist groups who use jokes to draw people in and try to obscure their intent.
• Social media monitoring can chill personal and political expression and other core democratic rights. As Dame Helen Winkelmann, now the chief justice of the New Zealand Supreme Court, has observed, privacy lies at the “heart of freedom of thought”. It is nearly impossible to dissent or to develop views outside the mainstream if you feel that you’re under surveillance. This risk is not merely hypothetical; there is a history both within New Zealand and around the world of state surveillance of activists and dissenters, and activists who identify as members of a marginalised group, including Māori and LGBTQ+, are at particular risk.
• There may be other impacts on marginalised or vulnerable groups. In addition to the targeting of activists, there’s a risk that governmental social media monitoring, even to detect threats, will be securitised. Muslim communities, for instance, have spoken out about the fact that security agencies were surveilling them prior to the Christchurch attacks rather than monitoring threats from white supremacists; LGBTQI+ groups have pushed back against coercive police activity; and Māori advocates have suggested (Tina Ngata, page 8) that the state is not equipped to provide protection through threat monitoring in light of its own history of harm to Māori. At same time, a significant amount of hate speech is directed against marginalised groups. This highlights the need for governmental agencies to act in close consultation with marginalised groups to determine what would most effectively support their safety, taking the groups’ lead as much as possible. Agencies should also pay close attention to the impact on tamariki and rangatahi, who are particularly vulnerable and are entitled to special protections under the Privacy Act.
• The increase of AI-driven tools supercharges many of these concerns, from facilitating lightning-fast data analysis that could create a holistic picture of an individual to being deployed in ways that – even inadvertently – are strongly biased against marginalised groups. These tools are typically developed using training data that is unlikely to adequately reflect the range of languages or cultural backgrounds in Aotearoa New Zealand. They often promise more than they can deliver. And it’s hard for AI to interpret nuance or context.
• Finally, the use of undercover social media accounts to engage directly with people poses special risks. A public servant could choose an online persona that has a different race, gender, or age from their real identity – something that would be impossible in person. They could even set up multiple personas, given enough time and technological capacity. This makes it particularly important that these practices are subject to stringent oversight and accountability measures. The 2017 joint report from the Law Commission and Ministry of Justice recommended that any agency undertaking covert operations – defined as an operation in which an enforcement officer develops a relationship with someone to obtain information – online or in person publish a policy statement and, in many circumstances, obtain a warrant.

Does New Zealand law prohibit social media monitoring?

No. The main relevant laws are the Bill of Rights Act 1990, the Search and Surveillance Act 2012, and the Privacy Act 2020. They all contain important safeguards but also leave critical gaps.

• The Bill of Rights Act 1990 provides important protections for democratic and human rights and prohibits unreasonable searches and seizures, but it does not mention privacy and it can be overridden by other laws.
• The Search and Surveillance Act 2012 governs Police’s search and surveillance authority and, by extension, agents of other enforcement agencies. However, it does not address social media, and in their 2017 joint report, the Law Commission and Ministry of Justice concluded that it had “not kept pace with developments in technology”. The report recommended that the Act be amended to require heads of enforcement agencies to issue policy statements addressing social media monitoring.
• The Privacy Act 2020 requires that government agencies and private parties collecting personal information must have a lawful purpose for doing so and the collection must be necessary for that purpose. “Personal information” includes publicly available information, including on social media. But the Act has several carve-outs for publicly available information, and the 2017 joint report concluded that “we do not consider the principles in the Privacy Act provide sufficient protection against unjustified public surveillance”.

Do the major social media platforms have any relevant policies?

Yes. Facebook’s terms and conditions prohibit any user – including police officers and other law enforcement agents – from having an account under a false name. In addition, Facebook and Instagram (which are both owned by Meta), along with Twitter, all prohibit the use of their customer data for surveillance.

Other information

Back