Privacy Commissioner's report criticises MSD collection of individual client level data

The Privacy Commissioner has published his report examining the Ministry of Social Development's (MSD) requirement for NGOs to provide individual client level data (ICLD).

The Commissioner has criticised MSD's approach as "excessive and inconsistent with the privacy principles," highlighting three major privacy risks:

• Individuals may choose to stay away from seeking help at all – leading to worse outcomes for individuals and society as a whole
• Individuals may choose to provide incorrect information in order to preserve their privacy – leading to inaccurate or useless data for analysis
• NGOs may allow those clients who are reluctant to have their sensitive information given to MSD to access services without providing their personal information – leading to reduced funding and risks to NGOs' long-term viability and the 'invisibility' to the system of a significant cohort of individuals in need of support.

The Commissioner's report is based on an inquiry initiated in January, including a survey of affected NGOs which received 548 responses.

The report states the purpose of collecting individual client level data (ICLD) is unclear and the process was poorly developed. There are four recommendations in the report:

• MSD should consider alternative methods for accomplishing its goals, such as having the information collated and analysed by Statistics New Zealand.
• MSD must ensure its information collection practices do not deter vulnerable individuals from receiving necessary help. MSD should consider how it can meet its policy objectives in ways that infringe less on personal privacy and reduce the risk of unintended adverse consequences for New Zealand’s most vulnerable people.
• MSD must ensure that its purposes for collecting, holding, using and disclosing information are specific, relevant to its functions and clearly conveyed, and the information collected is necessary to achieve these purposes.
• MSD must ensure that its security procedures for holding, using and disclosing ICLD are robust, well-documented and transparent.

‍

Updates

ComVoices welcomed the Privacy Commissioner’s report and endorsed the recommendations. Spokesperson Trevor McGlinchey said:

It is very important the families and individuals seeking support from community service providers can trust that their rights to privacy will not be breached and that no harm or misuse could result in the use of their personal information. This encourages early access to support and allows vulnerable families to grow into independence rather than being forced to hide their problems for fear that this information will be used against them or publicly shared. Earlier, more direct engagement with providers of social services could have prevented the current situation arising.

ComVoices followed up with a further statement about the Minister's response:

While there is some relief that after the failure of MSD’s private data portal, Minister Tolley has put the reporting of clients’ private data on hold for a few months, NGOs are very frustrated with the Minister’s response to the Privacy Commissioner’s report on the collection of individual Client Data. The determination to push ahead with MSD collecting this sensitive data in the face of the Privacy Commissioners Report and the failure of the MSD information portal demonstrate that we should be holding off on implementing this process and a more effective way of demonstrating the value of social services should be developed.

... We are now in the very difficult position of being expected to sign MSD contracts that are out of step with the Privacy Commissioner’s findings. It is difficult to see how we can do this in good faith and we have real concerns about the liability we might be opening ourselves up to.

ComVoices has previously written two Issues Papers and letters to the Ministers setting out their concerns and proposed ways forward.

A number of organisations have also spoken out in support of the Privacy Commissioner's Report and critical of the Government's plans to collect ICLD, including:

• ‍National Beneficiary Advocacy Consultancy Group‍
• National Network of Stopping Violence Services‍
• New Zealand Psychological Society‍
• New Zealand Association of Counsellors‍
• New Zealand Labour Party

‍

Privacy breach and IT system shut down

Minister Anne Tolley announced that the IT system for collecting ICLD will be shut down after a potential privacy breach was discovered. Minister Tolley said:

"The system was shut down last night as a result. To date, 136 providers have been invited to upload client level data into the DIA shared portal, only 10 providers have uploaded information so far. I've asked officials for advice on the next steps which will involve using a different IT platform that will be robustly tested."

Update

An article in the April 2017 edition of Kete Kupu, a newsletter from the New Zealand Council of Christian Social Services, analyses information on the collection of ICLD they received from MSD under an Official Information Act request. The article Intrusive Data Collection Justification Looks Thin and Dubious by Garth Nolond-Foreman states:

“Based on the documents released, it seems the department has fallen into the trap of many novice researchers – it appears as if it is planning on collecting as much information as it can, ‘just in case’! While understandable, with the current government’s recent discovery of Big Data, this is an expensive newbie mistake, which is also considered by many to be unethical – especially when it is a party with power over your life collecting the data. Personally, I would like MSD (and all government agencies) to subject themselves to a simple discipline of only collecting information they can collate, analyse and feedback to those that provide it within, say, six months – even 12 months would be better than nothing.

The OIA papers also give the appearance of a basic confusion and conflation of three important but different processes: monitoring, evaluation and research. Rather than spending a fortune on collecting and analysing quite a lot of very ‘thin’ data (gender, age, ethnicity), it is often much more effective to gather rich and deeper insights from well-constructed research – like the Dunedin Multidisciplinary Health & Development Study. As well as not requiring mass citizen surveillance, such research can ensure greater reliability and validity. Elsewhere MSD even argue that all this extra monitoring will reduce the need for evaluations. It is bizarre to expect an individual local service to ‘prove’ its approach works. This requires properly constructed research on a much larger scale. Mixing evaluation with monitoring also risks corrupting data with perverse incentives. To over-simplify: monitoring can tell us ‘what’; evaluation has the potential to add ‘how’; and good research can begin to answer the elusive ‘why’ questions.”

‍

Background information

See these previous NZFVC news stories:

• ‍Temporary reprieve for sexual violence services on individual client level data‍
• Research project investigates people’s views of data linkage‍
• Consultations on more proposed government agency information sharing‍
• Government continues work on integrated data and "social investment"‍
• Concerns and public meeting on NGOs and provision of individual client level data‍
• ComVoices paper highlights issues with govt requiring individual client level data‍
• MSD to require individual client level data from community agencies