6 Jun 2024

Privacy Commissioner seeks more detail on possible census data breach at marae

5:08 pm on 6 June 2024
No caption

File pic Photo: RNZ / Dom Thomas

The Office of the Privacy Commissioner is considering a possible response to a potential privacy breach at Manurewa Marae during the 2023 General Election.

Stats NZ has begun a review into claims the marae used individual census data to help Te Pāti Māori's campaign, which the party strongly denies.

Te Pāti Māori president John Tamihere has called for anyone to produce "hard evidence" and described "unsubstantiated sources" as unhelpful.

The Sunday Star Times was the first to report the accounts of ex-marae workers who collected census forms last year.

They claim private data from the forms was photocopied and entered into a database which they believe was then used to target voters in the Tāmaki Makaurau electorate.

In a statement on Wednesday, Stats NZ chief executive Mark Sowden said Doug Craig of the RDC Group had been appointed to investigate the allegations.

In a statement today, the Privacy Commissioner's Office said given the public interest, it was asking various government agencies for further information.

It said this information will then help decide on the commissioner's next steps.

The office said the claim touched on sensitive personal information provided in the context of assured trust and confidentiality.

Prime Minister Christopher Luxon, speaking from Fiji, said the coalition would be having conversations about how the matter should be handled, including the possibility of a public inquiry or getting the auditor-general involved.

"At the moment there is an investigation going on, we'll give it some thought as to whether there's anything further that's needed. We haven't got a position on that and we haven't made a decision on that and we'll continue to monitor it pretty closely.

"They're pretty serious allegations, it is appropriate that we'll work out that they are investigated properly at whatever level that may need to be at - and who does that, to be determined - but ultimately let's let this investigation go through at this point.

"I think the police have been informed, let them go through their process."

Public Services Minister Nicola Willis said in a statement there were now several government agencies conducting separate lines of enquiry.

"We are considering whether any further action may be needed and are taking advice on our options."

Further allegations suggest the complaints around breaches of privacy were raised with government agencies, but no action was taken. Employment advocate Allan Halse represents a group of ex-marae staff and a whistleblower at the Ministry of Social Development and told RNZ the whistleblower had raised concerns with MSD from the outset.

"All of it could have been avoided," Halse said. "If the authorities, when they learned what was taking place, had acted, they could've prevented this from continuing."

The Taxpayers Union lobby group's executive director Jordan Williams called on the Privacy Commissioner to conduct a formal investigation, saying they were concerned about the allegations government agencies knew about the complaints but did not act.

Williams said the agencies were not in a position to be running the investigations themselves and the issue deserved formal scrutiny because of the type of data.

"Because this relates to Census data, it is the most sensitive information that the government should be ensuring is protected."

"We say it's appropriate for the Privacy Commisioner, who unlike any of these agencies has the power to compel witnesses, to require infromation to be provided from third parties. We say it's time for him to open a formal investigation."

Separately, the Labour Party in November laid a complaint with the Electoral Commission against Te Pāti Māori, over text messages sent by a number Labour believed was managed by Waipareira Trust.

Tamihere - as well as being Te Pāti Māori's president - is also the Trust's chief executive.

Labour's complaint raised concerns about the lack of an authorisation statement in the messages, possible misuse of public funds, and the possible use of private data intended for health services for promotion of a political party.

"This is relevant because that shortcode has been previously used to send people government information about COVID vaccinations and other matters ... this may also involve misuse of public funds given to Waipareira trust for developing this service."

The Electoral Commission referred the complaint about a lack of authorisation to police.

Tamihere said the party had not been contacted about it.

Get the RNZ app

for ad-free news and current affairs