Are there really clear checks & balances for our private Census information?

What is your perspective?

J.R.Bruning

Mar 8, 2023

On the surface, the 2023 census only mildly deviates from the 2018 census.

However, if the public consider that they do not trust the government with their personal data anymore, I do consider their concerns have merit.

What has changed?

The census form tells us that

The information you provide will be kept confidential by Stats NZ and is protected by the Data and Statistics Act 2022.

This Data and Statistics Bill gaily skipped through readings, to receive Royal Assent in August 2022, just in time for the 2023 Census. However, important concerns raised by experts were dismissed, and these concerns when raised by select committee (such as to amend Clause 17) in the Data and Statistics Act 2022 seemed to go nowhere.

The Data and Statistics Act 2022 replaced the Statistics Act 1975.

Only 50 submissions were sent in to the Select Committee. Expert submitters raised serious concerns, including the Privacy Commissioner and Len Cook, NZ Government Statistician (1992-2000) and UK National Statistician (2000-2005).

These two experts summarise the issues better than I can, so I please ask that you consider them, and then think whether they were sufficiently addressed by the Select Committee and by the Hon David Clarke, reproduced as Hansard.

As only 50 people sent in comments, one would think the issues raised by the Commissioner and Cook would be addressed in detail.

I’ve searched through the Commentary (Report) by the Governance and Administration Committee on the Data and Statistics Bill (following consultation) and Hansard to understand the degree to which the concerns made by the Privacy Commissioner and Cook were considered.

I don’t believe the Privacy Commissioner and Cook were given the scrutiny they deserved, and that the Clark largely brushed off concerns with assurances everything was covered.

But I’m not sure because – in particular - the amendments proposed by the Privacy Commissioner were ignored, and they appear to my eye, spectacularly relevant.

Below I will outline the major concerns of the Privacy Commissioner and Len Cook, followed by any references to them in the Select Committee Commentary, and then in Hansard.

The Hon David Clark was the Minister in charge. Clark of course, was also the Minister in charge of the Digital Identity Services Trust Framework Bill which was introduced in August 2021, which doesn’t seem to have meaningful back end restrictions on the sharing of data once agencies are signed on. This also includes the Real Me identity system.

I consider that Clark had a much greater understanding of the implications of weak legislation which fundamentally is related to the Digital Identity Services Trust Framework Bill.

Clark has not raised these loophole issues, rather you can see that concerns, for example by the Privacy Commissioner were largely dismissed by the Minister.

I think this is a very big problem that needs to be addressed, and that Clark’s involvement in the construction of legislation and a consequent potential for erosion of privacy in back-end government information exchange – a failure to put in place accountability and transparency mechanisms – of legal mechanisms that might protect privacy and the public interest…

… and prevent abuse of power by the State.

Jan Tinetti was the Minister for Internal Affairs from 2020-2023, it is interesting that she wasn’t the responsible Minister in charge of the Digital Identity Services Trust Framework Bill – Clark was. Now we can see that the Hon Ginny Andersen is MP in charge as it passes through the stages.

The Digital Identity Services Trust Framework Bill is yet to become an Act. But I suggest, if this Bill goes through as it is, in combination with the Data and Statistics Act 2022 – government staff, and contracted companies providing services in the information management field, basically are given carte blanche. If this is not a free-for-all at the back end, I don’t know what is.

As I discussed last year:

The sharing of the biometric and digital data of citizens is operational across New Zealand government agencies and permitted by the Privacy Act 2020. Webbed networks of digital information sharing are already occurring in New Zealand through approved information sharing agreements (ASIAs) across government platforms. ASIAs have increased since the start of the pandemic. It’s the backend sharing of data that ordinary Kiwis don’t see.
The DIA’s resources and operations have expanded considerably in the years 2011-2022. In 2011, total appropriations were $268,239,000. In 2022 the budget sits at $1,223,005,000. The DIA annual income has increased by a billion.

Clark was Minister for the Digital Economy and Communications and Minister of Statistics, and Minister of Commerce and Consumer Affairs until 2023. In these powerful positions he’s overseen an enormous amount of legislation that has put in place the capacity for the sharing of civilian data across government, without regulatory oversight and mechanisms for insiders to appeal when they see abuse of privacy inside government.

Once they leave a Ministerial portfolio, they handball Official Information Act requests from the time they were in power, to the new Minister.

There do not seem to be clear restrictions on the Department of Internal Affairs to access census information that is tied to an identifier.

In the Hansard comments below, I ask readers to consider whether Clark addressed the deep concerns of the Privacy Commissioner and Cook. I wonder if Clark is assuring the Committee members the provisions are in place, but when we go back to the Bill, the clear line of sight provisions aren’t really there.

There are substantial fines for a failure to comply and complete the 2023 Census:

Privacy Commissioner’s Submission to the Governance and Administration Committee on the Data and Statistics Bill (81-1)

Additional privacy protections that could be considered (page 5)
20. While I support the Bill and believe it includes appropriate protections for personal information, there are additional protections the Committee could consider in response to concerns that have been raised about the Bill.
Interaction with the Privacy Act
21. As discussed above, I assume that the Privacy Act will continue to apply except to the extent that the Bill clearly authorises personal information to be collected, held, used or disclosed. However, to avoid doubt, it could be helpful for the Bill to expressly set out the relationship between the Bill and the Privacy Act.
22. In addition, I note that the Bill does not deal with situations in which individuals may suffer harm, of the kinds set out in section 69(2)(b) of the Privacy Act, as a result of breaches of the requirements of the Bill. The Bill provides for offences relating to the obligation to protect data. However, it does not provide for redress to individuals affected by a failure to meet obligations to protect data.
23. The Committee could consider whether the Bill should provide for a right for individuals to make a complaint to the Privacy Commissioner in relation to a breach of obligations to protect data under the Bill, where the breach relates to personal information as defined in the Privacy Act.
Delegation of the Statistician’s functions or powers
24. Clause 17 of the Bill provides that the Statistician may delegate any of the Statistician’s functions or powers, in accordance with the provisions of the Public Service Act 2020 relating to the delegation of functions and powers of public service chief executives. It is not clear why such broad provision has been made for delegation of the Statistician’s functions and powers, and the Committee may wish to ask officials for further information about the purpose of this provision.
25. In addition, clauses 25 and 26 provide for the Statistician to authorise a public sector agency to request data on the Statistician’s behalf. This is also a type of delegation of the
Statistician’s powers.
26. I recognise that anyone acting under delegation or authorisation from the Statistician would be subject to the same legal obligations that apply to the Statistician. However, such a person would not necessarily come from the same strong culture of confidentiality as is found within Stats NZ. There is a risk, however small, that a person acting under delegation would perform the Statistician’s functions in ways that do not sufficiently protect the privacy and confidentiality of data.
27. I therefore propose as a safeguard that the Bill should require the Statistician, before delegating functions, powers or authorities to any agency outside Stats NZ, to be satisfied that the agency has the capability to perform the functions or powers safely and responsibly. Further, I propose that the Bill provide for the Statistician to develop an assurance framework for assessing an agency’s capability in relation to delegation of functions or powers, and that the Statistician must consult the Privacy Commissioner about the assurance framework.
Limitation on the purposes for which information may be used
28. It is my strong expectation and understanding that any information collected under authority provided by the Bill will be used only for statistical and research purposes. It would be entirely inappropriate to use such information, where it relates to identifiable individuals, for operational, compliance or enforcement purposes (even if these purposes were considered beneficial to the individuals concerned).
29. In my view, the Bill’s provisions, taken as a whole, do protect against use of information collected under the Bill for purposes other than the production of statistics and the undertaking of research. However, there is no single provision that clearly states this purpose limitation, in contrast to the 1975 Act, which states that ‘Information furnished to the Statistician under this Act shall only be used for statistical purposes’.( Statistics Act 1975, s 37(1).)
30. I would support the inclusion in the Bill of a stand-alone provision restricting the purposes for which data collected under the Bill may be used to statistical and research purposes. I do not propose defining the terms ‘statistical’ or ‘research’, which are also undefined in the statistical and research exception in the Privacy Act. I believe the terms ‘statistical’ and ‘statistics’ are well understood in New Zealand and internationally. The term ‘research’ is admittedly broader, but could be clarified in part by research standards issued by the Statistician under clause 90(1)(d).
31. I also note that the ‘Five Safes’ framework that governs research access to the IDI specifically states that such data ‘cannot be used for individual case management, such as making a decision about a specific person or family’. The Committee could consider whether a similar restriction (suitably broadened beyond case management to any decision-making about identifiable individuals) should be included in the Bill.
32. As a more general comment, the Bill’s explanatory note comments that the Billincorporates aspects of best practice frameworks, including the ‘Five Safes’ and Ngā Tikanga Paihere (Stats NZ’s framework for ethical and culturally appropriate data use). However, there may still be elements of those frameworks that could be incorporated into the Bill to strengthen its privacy and ethical protections. For example, Stats NZ has developed the practice, applauded by overseas privacy regulators as best practice, of undertaking and publishing a privacy impact assessment when new data is added to the IDI.
Applying the ‘public interest’ test to research requests
33. Clause 48 of the Bill gives the Statistician sole discretion to authorise or decline access for research to data held by Stats NZ, and to impose conditions on such access. A key consideration in deciding whether to grant access is the public interest test in clause 49. The public interest test ensures consideration of matters that are important from a privacy perspective, including whether the proposed access to information (which could include access to information about identifiable individuals) is justified, the nature and extent of any risk posed by access, and the purpose for which the data was originally collected.
34. In exercising this discretion, I would expect the Statistician to take advice from experts in data ethics, tikanga Māori, privacy and other relevant areas of expertise. It could be helpful for the Bill to provide for the creation of a research ethics committee to advise the Statistician on decision-making under clause 48, particularly (but not exclusively) in relation to the application of the public interest test. The Bill could also provide in general terms for the composition of such a committee. Such a committee should also provide advice to chief executives of other departments that the Statistician has determined may authorise access for research purposes under clause 55.
Strengthening some wording in the Bill’s requirements
35. It may be possible to tighten up some of the wording in the Bill to be more protective, particularly where the current wording might be seen as weakening requirements in the 1975 Act. I make two specific suggestions, on which the Committee may wish to seek advice from officials.
36. First, the Bill refers in a number of places to the Statistician obtaining information that is ‘necessary or desirable’ for the production of official statistics, or ‘desirable’ for research purposes.( See clauses 22(c), 23(1)(b), 25(1), 57(1) and 58(1).) I propose that the test should be stronger than simple desirability of collecting information, and that the words ‘necessary or desirable’ and ‘desirable’ be replaced by ‘necessary’. A necessity test would be particularly appropriate where a data request is not voluntary, and especially in relation to the power of entry and inspection under clauses 57 and 58.
37. Second, clause 39 provides that the Statistician ‘must take all reasonable steps to ensure that the Statistician does not publish or otherwise disclose data in a form that could reasonably be expected to identify any individual or organisation.’ Equivalent wording also appears elsewhere in the Bill. By contrast, section 37(4) of the 1975 Act requires the Statistician to ensure that statistical information is published ‘in such a manner as to prevent any particulars published from being identifiable by any person (other than the person by whom those particulars were supplied)’.
38. The wording in the 1975 Act with regard to non-identifiability is arguably stronger than that in the Bill, and the Committee could consider whether the wording in the Bill could be strengthened. However, the Committee should be aware that the wording in the Bill closely mirrors that in the statistical and research exceptions in the Privacy Act. The Committee could also consider whether it may be more appropriate to provide greater specificity about how statistical information should be made non-identifiable through Standards issued by the Statistician under clause 90 of the Bill.
(The Privacy Commissioner has previously recommended that the Privacy Act should include stronger protections against re-identification of personal information that has been de-identified for statistical and research purposes: Privacy Commissioner’s submission on the Privacy Bill to the Justice and Electoral Committee, 31 May 2018, pp 22-25 and rec A.4.)
Conclusion
39. I support the Bill’s objectives of modernising data and statistics legislation while continuing to provide safeguards for information collected for statistical purposes and to ensure transparency about the use of such information. I believe the Bill already contains important safeguards that have the effect of protecting privacy of personal information. I also expect Stats NZ to continue to engage with OPC about implementation of the Bill, if it is enacted.
40. However, to respond to concerns that have been raised about the Bill and help to ensure continued public trust in the collection and use of data for official statistics and research, I propose the following additional safeguards for the Committee’s consideration as possible amendments to the Bill:
• Clarify the Bill’s relationship with the Privacy Act and provide for individuals to complain to the Privacy Commissioner about failure to meet obligations to protect data under the Bill, where such data is personal information.
• Require the Statistician, before delegating functions, powers or authorities to any agency outside Stats NZ, to be satisfied that the agency has the capability to perform the functions or powers safely and responsibly. Further require the Statistician, in consultation with the Privacy Commissioner, to develop an assurance framework for assessing such capability.
• Restrict the purposes for which data collected under the Bill may be used to statistical and research purposes, and provide that information collected under the Bill cannot be used to make decisions about specific identifiable individuals.
• Provide for the creation of a research ethics committee to advise the Statistician on the exercise of the Statistician’s discretion to authorise access to data for research (especially in relation to the public interest test for such access).
• Replace references in the Bill to a ‘necessary or desirable’ or ‘desirable’ test for obtaining information with ‘necessary’, particularly where it is mandatory to provide information and in relation to powers of entry and inspection. Also consider whether the Bill’s wording on non-identifiability of information should be strengthened.
Len Cook, NZ Government Statistician (1992-2000) and UK National Statistician (2000-2005)
Len Cook is very clear in just how bad the Bill was:
As such, the Data and Statistics Bill has unidentified implications that would bring significant risks for trust in government and for official statistics. The authority, statutory protections and the legacy of public trust in Statistics New Zealand has been a longstanding component in the independent oversight of the economic and social conditions in our society. The implications on this are not apparent from the explanatory note or Ministerial speeches. The changes are likely to compromise the level of public co-operation in official statistical collections and hence in the accuracy of statistics based on these collections, including the Census and the labour force survey.
Cook considered that the Data and Statistics Bill:
a) Fails to recognise the extent of constitutional differences between collecting and retaining custody of data for official statistical purposes and for other uses
b) Fails to define what it means by data sharing, custodianship and responsibilities in an exacting manner
c) Fails to recognise the need for clear regulatory arrangements to oversee sharing and to assess institutional arrangements for sharing public sector data and establish roles relevant to the effective and trustworthy management of data sharing. (In Australia - National Data Commissioner and National Data Advisory Council)
d) Fails to recognise the incompatibility of the Government Statistician being also the Chief Data Steward and the impact on trust in official statistics.
e) Fails to adequately identify what purposes of data sharing should be precluded and fails to recognise the severity of the consequences of data sharing outside that permitted by the law, in terms of consequential penalties.
f) Fails to leave the final decision about data sharing to the original custodian (NB Australian Data Availability and Transparency Act 2022, Clause 25 “This Act does not require, or authorise any person to require, a data custodian to share public sector data”.
g) Fails to provide a statutory authority, akin to the Australian National Data Commissioner, to oversee the monitoring and compliance with the Data and Statistics Bill. There are potential conflicts in the Government Statistician overseeing practices of Statistics New Zealand as well as agencies that range from Security Intelligence to Social Development. The Commissioner in Australia is also assisted by the advice of the National Data Advisory Council.
h) Fails to recognise significant differences in the uses and purposes for data sharing in an operationally clear way between operating agencies in different domains of government and its likely public acceptance. The Privacy Act 2021 recognises different classes of agencies or purposes for information sharing but does not identify such groupings explicitly as the Australian Act does.

SELECT COMMITTEE FINAL COMMENTARY/REPORT

The Select Committee did not discuss the comments of Len Cook, and the Committee briefly referred to one of the concerns expressed by the Privacy Commissioner.

Comments with relation to the Privacy Commissioner:

Delegation of the functions or powers of the Statistician (page 4)
Clause 17 would enable the Statistician to delegate any of their functions under this, or any other, legislation (except for the powers to issue compliance or infringement notices). The Privacy Commissioner suggested that the Statistician should need to be satisfied that another agency had the capability to perform the functions or powers safely and responsibly before functions or powers were delegated to them. The Privacy Commissioner also proposed that the Statistician develop an assurance framework for assessing that capability.
We agree with the Privacy Commissioner that it is important that the Statistician has confidence that a delegate has the capability and culture to maintain privacy and confidentiality to the same standard as Stats NZ. We consider that the Statistician would be highly motivated to take care when considering possible delegations. This is because the Statistician would be responsible for any actions taken by a person acting under delegation. We do, however, recommend amending clause 17 to insert a requirement for the Statistician to publish information about relevant delegation, including their process in making the decision. We believe this would provide more transparency and accountability for the delegation of

Note: Section 17 was not amended following this recommendation.

HANSARD

A search for Privacy Commissioner in the Hansard Documents, revealed the extent of discussion on the Privacy Commissioner’s recommendations.

Data and Statistics Bill — Second Reading 17, May 2022
https://www.parliament.nz/en/pb/hansard-debates/rhr/combined/HansDeb_20220517_20220517_36
Hon MICHAEL WOODHOUSE (National) (remote):
The second element of the privacy issue that I want to raise is a very thoughtful submission from the Privacy Commissioner. Now, I'm sure, like all parliamentary colleagues, I have a very high degree of trust and confidence in the Privacy Commissioner, and when she provides advice we need to listen carefully. Albeit in supporting the bill, she nevertheless came up with a number of recommendations for the bill to be improved. We didn't make many of them, and so it was important to the committee that we were confident that the Privacy Commissioner was satisfied overall with the response to their submission. We were advised by officials that notwithstanding that only minor changes were made based on the recommendations of the commissioner's office, they were broadly satisfied with where Statistics New Zealand officials have got to. I hope that's right. I think it's really important that we listen carefully to the privacy elements. We're in a very, very unusual environment where people are fiercely protective of their privacy but paradoxically have no problem in open-source social media, for example, revealing quite a bit about their lives. But nevertheless, they still have a right to privacy, particularly when it comes to the State collection of information.
CHRIS PENK (National—Kaipara ki Mahurangi): But, of course, that's a heavy caveat, and it's been pleasing to hear that the select committee has taken seriously the submission of the Privacy Commissioner and noted certain ways in which it's appropriate for the data to be able to move between different agencies—and in one case, actually not a Government agency so much as the courts.
Data and Statistics Bill — In Committee—Part 1 27, July 2022
https://www.parliament.nz/en/pb/hansard-debates/rhr/combined/HansDeb_20220727_20220727_46
Hon Dr DAVID CLARK (Minister of Statistics): To support transparency, the bill requires the Statistician to publish information about delegations outside of Stats NZ, including what informed of any such decision. I note that these requirements were added in response to the Privacy Commissioner's late submission at the select committee. Like the Act it replaces, the bill only allows Stats NZ to collect data for official statistics and research. To be clear, the Statistician can only make mandatory requests for data for official statistics, not for research. It doesn't expand the scope of information-gathering powers across Government. In New Zealand, sharing of personal information between Government agencies is regulated through agency legislation or agreed information-sharing agreements and information-matching programmes under the Privacy Act.
Data and Statistics Bill — In Committee—Part 2 27 July 2022
https://www.parliament.nz/en/pb/hansard-debates/rhr/combined/HansDeb_20220727_20220728_08
JOSEPH MOONEY (National—Southland): Thank you very much, Mr Chair. Minister, I want to just dig in a little bit more to clause 17 and just ask the Minister to comment on some of the concerns raised by a number of commentators, including the New Zealand Council for Civil Liberties. So clause 17 in the bill enables the Government Statistician to delegate any of the Statistician's functions or powers under this Act, with the exception of needing approval from either the Minister or the Public Service Commissioner. Those powers or functions may be sub-delegated to any public servant, including contractors, with prior written approval of the Government Statistician. Now, a former Government Statistician—Len Cook—pointed out that such a wide-ranging power of delegation is enormously risky and unheard of elsewhere, and the New Zealand Council for Civil Liberties has included his concerns at length, and I'll just invite the Minister to respond to those.
Hon Dr DAVID CLARK (Minister of Statistics): What I would note is that while the current Act doesn't contain this delegation in it, the Public Service Act applies anyway. So this is making it explicit that that power applies. It's also true that that has then enabled a clear explanation about the publishing of information of any delegations, to have transparency, and that was something that the Privacy Commissioner sought so that there would be transparency around any powers that were being delegated in this respect.
Hon Dr DAVID CLARK (Minister of Statistics): Thank you, Mr Chair. I think—and this is an important debate to have; I'll put that in front of my comments—that some of those claims from the Council for Civil Liberties are a bit of an overreach; to say there's been no public scrutiny of this. I have a great deal of faith in the members of the select committee that considered this, and the—
David Seymour: Too much!
Hon Dr DAVID CLARK: I think I hear members opposite arguing there's been too much consideration or publicity. But, you know, the chair of this committee, wearing another hat, and the member the Hon Michael Woodhouse, I'm aware, and other members of this House on this side, were part of a committee that fairly thoroughly considered this, received submissions from the likes of the folks the member's referencing, and reported this bill back with various amendments and protections to ensure that we can have confidence in the way any powers are exercised—or they allowed it to go through in the form that it was if they were confident.
Now, here we've got a whole set of expectations around any delegation. As I've said, in some ways it's a mirroring of the Public Service Act, and, in fact, it explicitly labels that here in clause 17, but it's also clear—and we've gone over the accountabilities thing a few times, and I'm happy to go over that again—and I think members have probably heard clearly the message that the Government Statistician is accountable for every decision that's made, so there's a clear sheet back to the Government Statistician, and that will mean that the Government Statistician will think very clearly and carefully, I would have thought, before delegating any powers. But then: "the delegation of functions or powers delegated to the Statistician by a Minister requires the prior written approval of that Minister". So there's a check there. And clause 17(1)(b) states, "the delegation of functions or powers delegated to the Statistician by the Public Service Commissioner requires the prior written approval of the Public Service Commissioner."
So we've got those. We've also got the expectation canvassed previously, where powers and functions are delegated, that that is transparently communicated and recorded, and that is part of the request and the expectation of the Privacy Commissioner. We have amended the bill to take account of that requirement, to make sure that we are providing transparency around these matters, and I think all of this is entirely appropriate. And it is the right debate to be having: have we got the balance right here? I think, you know, the official statistics that are produced are incredibly valuable for decision making and incredibly valuable for holding decision makers to account, and we need to have a robust ethical framework that surrounds it.
Data and Statistics Bill — In Committee—Part 3 27 July 2022
https://www.parliament.nz/en/pb/hansard-debates/rhr/combined/HansDeb_20220727_20220728_12
JOSEPH MOONEY (National—Southland): Thank you, Madam Chair. I just want to ask the Minister just to expand a little bit on the comments around the Privacy Commissioner and this bill. So I note that the acting Privacy Commissioner made the comment that the bill should more carefully spell out the relation between the bill and the Privacy Act. I'm just wondering what the Minister's views are on how that's expressed in this bill—that relationship between the Privacy Act and this bill, and the collection powers in this bill. I also note that the commissioner suggested that this bill fails to allow for redress when people are harmed by the release of personal information, and recommended that in such a circumstance the bill should provide a right for individuals to complain to the Privacy Commissioner. I'm just interested in whether the Minister thinks that should be in this bill, or, if it shouldn't be, why not?
Hon Dr DAVID CLARK (Minister of Statistics): The right to complain to the Privacy Commissioner exists beyond this bill. So this bill does not restrict that. That right exists, and I think it's important to put that on the record for the House, so I thank the member for that question. In terms of incorporating advice from the Privacy Commissioner, along the way there was a close working relationship between the officials at Stats NZ and the Privacy Commissioner, and many of the aspects and things that are included in the bill come from that fruitful engagement and mirror, in fact, ways in which the Privacy Commissioner operates, and mirrors their legislation.
Data and Statistics Bill — In Committee—Part 5 27 July 2022
https://www.parliament.nz/en/pb/hansard-debates/rhr/combined/HansDeb_20220727_20220728_20
Hon MICHAEL WOODHOUSE (National): Thank you, Madam Chair. This is a really substantive part of this bill. We've been debating, in the committee, at length about the powers to collect data for research, and the Government's agreed to disagree that it is a mandatory requirement on request. What Part 5 does is set out the circumstances where the Statistician can authorise access to the data for research, to whom that can be provided, including people who are not New Zealanders, overseas individuals or organisations, be satisfied that the research is in the public interest, and that there are appropriate measures to protect privacy, confidentiality and security.
Now, most colleagues who are interested in this bill will have heard from the Council for Civil Liberties. While I don't agree with all of their conclusions about what this bill will do, I was minded in their briefing, in advance of the committee of the whole House, at the top of page 11, where it says Part 5 of the bill creates a new regime governing access to data for research. So it would be helpful for the committee, I think, if the Minister could advise the committee on the degree to which, if at all, the regime that we're considering under Part 5 differs from the Statistics Act 1975. I think it's important that we understand how we are broadening the access to research and whether or not that is going to lead to any greater risk of harm to individuals or organisations if the research part of the Statistician's role is broadened in the degree that the civil liberty organisation believes.
I would also note that they note in their submission that the Chief Ombudsman also recommended, as they did, the removal of Part 5 entirely. That was, really, the issue that Debbie Ngarewa-Packer's tabled amendment would do. I don't support that. I think, actually, research is really important in this context, but we've got to have a very, very robust framework for being able to protect data and protect individuals' identity. So, noting that as eminent an Officer of Parliament as the Chief Ombudsman was concerned enough to recommend the removal of Part 5, and also noting that there hasn't been actually that much change to Part 5 since the bill was introduced, can the Minister provide the committee with reassurance—well, firstly, a commentary about the degree to which this is a new regime and how it differs from the Statistics Act 1975, and a commentary also, perhaps, if he feels inclined, on calls for the removal of Part 5 entirely.
Hon Dr DAVID CLARK (Minister of Statistics): I thank the member Michael Woodhouse for his question. Part 5 is where we see a modernisation of the framework in the 1975 Act. The current Statistics Act does enable access to data for research; that's in section 37C. Earlier in the debate, I waved this report around, which I believe to be a really important report recently released about Māori business that has come about as a result of useful research. We do need to be able to have research for the betterment of our decision making.
Now, in saying it's a modernisation of the 1975 Act, it does so in allowing bona fide researchers to safely access data held by Stats NZ for research in the public interest. However, the 1975 Act's framework provided no guidance on the matters that the Statistician must consider before authorising access to data. It also did not reflect Māori interests or require transparency around research access. And, indeed, this part of the bill takes the research access framework from one clause to a whole part in the bill. It is, I think, quite clearly a strengthening of the research access framework and an appropriate strengthening of that access framework. The research access framework incorporates, in this bill, domestic and international best practice frameworks for appropriate and safe access, such as Ngā Tikanga Paihere and the Five Safes framework. It requires the Government Statistician to publish information about who is accessing data, how the data is being accessed, and for what purposes. It requires researchers to publish research results and methodologies. Now, just to be clear—and we've canvassed this before but I think it's worth putting on record again—access does not mean that researchers can hold and store the data themselves. Access occurs through a secure portal, and researchers can only access data that is relevant to their research.
Perhaps I'll just also relate the comments the Privacy Commissioner made. The Privacy Commissioner, in their submission to the committee, noted that they were satisfied that the bill contains adequate protections around the inappropriate use of personal information. They noted that the protections have included "a clear framework for access to data held by Stats NZ for research purposes (Part 5)"—this is a quote from them—"including that the Statistician, before authorising access to data for research, must: be satisfied the research is in the public interest (cl 49); be satisfied the research is to be carried out by an appropriate researcher, who will protect the privacy, confidentiality and security of the data (cl 50, especially cl 50(a)(iii)); be satisfied access to data is subject to appropriate measures to protect the privacy, confidentiality and security of data (cl 51); consider whether, if the researcher is an overseas person, the data will be protected by comparable safeguards to those in the bill (cl 52); and that the Statistician must publish information about access to data by researchers (cl 53); [and] a requirement that researchers must comply with obligations in relation to data accessed for research, including to take all reasonable steps to ensure that data is only disclosed in a form that could not reasonably be expected to identify individuals (cl 54, especially cl 54(1)(c))."
So I do think this represents a substantial strengthening of the Act, and an appropriate one, and I think it's important to spell that out. I thank the committee for its indulgence. Obviously, it's in the part, but I think it's worth putting on the record both the Privacy Commissioner's view that they're satisfied with this improved regime. I think the transparency is important, and, obviously, the safe dealing with the data that's provided, sometimes sensitive data, is imperative.