On Newshub Nation: Emma Jolliff interviews Privacy Commissioner John Edwards
Jolliff: The Privacy Commissioner says MSD’s powers to investigate have been taken too far. I asked him how serious the
breaches have been.
Edwards: That’s hard to rank them because everything is so contextual. I was really troubled by the breadth of the ministry’s
data collection in these cases, particularly of text message content. In most law enforcement contexts, you wouldn’t be
able to get that information without a warrant issued by some judicial officer — that means an independent person has to
look at the case that you’re making for getting access to it, they have to decide whether what you’re seeking is
proportionate to the need, and then issue the instruction. These are just demands issued by some clerk or bureaucrat or
investigator without adequate checks and balances, in my view. And especially given the sensitive nature of that
information, in ranks pretty highly.
In simple terms, how do you see that MSD has breached the law?
By simply ignoring the statutory requirement to seek the information from the beneficiary first, unless doing that would
prejudice the maintenance of the law. That’s the headline story. Beneath that, there are a number of instances in which
I think the ministry has just lost track of the kind of developing jurisprudence that governs these things. Getting 10
years worth of banking records to investigate one year worth of benefit entitlement us just completely disproportionate.
We’ve got to keep recalibrating those enforcement techniques against what we know is legally acceptable in terms of the
Bill of Rights Act, you know — the right to be free from unreasonable search and seizure.
Do you see that MSD has accepted that its breached the law?
I’m happy that the ministry has accepte my report. I’m happy that the Chief Executive has assured me that they are going
to implement all the recommendations, and they have conceded that the actions that they’ve taken have been unlawful.
MSD justified its collection of personal information about beneficiaries from third parties by saying clients wouldn’t
volunteer information, and it was just quicker to go to the third parties. What do you say to that?
Well, that’s not the law, and it also presupposes that the only reason you notify the beneficiary first is to get access
to the information. I mean, a beneficiary probably can’t delivery up 10 years of banking information, but what it does
do is it informs them that those inquiries are being made. It gives them the opportunity to exercise some autonomy over
that.
Could MSD identify any cases where evidence tampering occurred because a client was approached before a third party?
Not as far as I’m aware.
The Privacy Commissioner’s office expressed concerns to MSD about collection of information as far back as 1998, yet
they carried on with the practice. This just suggests that they are disregarding the requests of your office, doesn’t
it?
Back in 1998 the reference in our report was to the inadequacy of the record-keeping in the ministry because one of the
things that was difficult in our investigation is that they simply didn’t have good records. They couldn’t tell us how
many times they were issuing these notices, how many times they were going to a beneficiary first. We would ask, and we
would get one set of records, then we’d get a completely different version.
So it hasn’t improved despite your requests?
No, it hasn’t improved, and it needs to. And that’s one of our recommendations, and I’m pleased that the ministry have
said that they’re going to implement that. We need to have nationally consistent reporting of how these tools are used.
How important is that, and why is that?
Well, it’s really important, and, again, this is about the integrity of the public service. Everybody recognises that
beneficiaries have some duties to the ministry, to the government, in terms of their eligibility. The ministry also has
duties to act within the law and to demonstrate that it’s acting proportionally. If it is not complying with its
obligations, how can it, with any moral authority, expect anyone else to?
Your report also found the MSD had issued notices under Section 11, stating that they’d been approved by the Privacy
Commissioner. Was the misleading?
Well, utterly. It was wrong. It was misleading. I’m not able to speculate on the origins of that. I would very much
doubt somebody intended to mislead, but they’ve got the wrong end of the stick. We’ve called them out on it, and, to
their credit, they withdrew those.
So does this suggest that the Privacy Commission needs greater powers, do you feel?
I have made a call for greater powers, but in fact, when it comes to my monitoring of government agencies, I think that
the authority that we have is sufficient. I mean, you will come back to the ministry, as the Nation — as TV3 — in 12
months, and say, ‘Look, tell us what you’ve done to implement the Privacy Commissioner’s recommendations.’ And if they
haven’t, then you’ll hold them to account. That, I think, is really important.
You shouldn’t really want to rely on the fourth estate to do that, though. You should have your own powers, shouldn’t
you?
Well, you have a role. Other members of parliament and advocacy groups in the community have a role. They will all hold
them to account. I was very pleased to see the Minister reacting to our report, and saying, ‘Well, actually it’s great
that the ministry have said that they accept the recommendations, that they’re going to implement them, but I think we
need to have another look at the legislative underpinnings of this, and see whether there needs to be a law change.’
That’s really positive as well.
Some legal experts have suggested that beneficiaries could take legal action against MSD under the Bill of Rights. Would
you agree that that is an avenue that they could pursue, and should they be entitled to compensation?
Certainly if somebody felt that they had experienced significant humiliation or significant injury to feelings because
of breaches of the Privacy Act, they could bring a complain to my office. Now, because of the numbers involved in this
mismanagement by the ministry over many years, I’m recommending that if somebody does feel that they might’ve been
caught up with this, they first direct their inquiry to the Ministry of Social Development.
Can you remind us what those numbers were because you said that was something difficult to ascertain as well?
Starting point — about 15,000 cases.
MSD’s committed to ceasing their blanket policy, as you say, in approaching third parties for information, reviewing the
code of conduct, having their investigative practices independently assessed. Does that go far enough?
Look, I think that goes a long way. What we need to do here is to restore the integrity of the system, so that people
who are receiving benefits know that they have duties, know that they will be treated fairly and according to the law.
What concerns were raised by private sector agencies like the telcos over the information that they felt they were being
compelled to provide?
Those industry groups have felt really uncomfortable about this. They provide services to customers, and they don’t feel
like they should be snooping around in their private lives, but when they receive one of these notices from the
ministry, they are under a legal obligation to comply.
Have these people, these 15,000 or so, been denied a fundamental human right?
Well, everybody has the right to avoid arbitrary interferences with their liberty and their privacy. So, in some cases,
yes, they will have.
All right. Privacy Commissioner John Edwards. We’ll leave it there. Thank you.
Thank you, Emma.
Transcript provided by Able. www.able.co.nz