By Bonnie Flaws

Part three of a four part investigation by Bonnie Flaws. Read parts one and two.

• Data protections were watered down in the 2022 Data and Statistics Bill
• Stats NZ was also given new powers to acquire data not collected for statistical purposes from sources outside of government agencies
• An insider has revealed that Stats NZ hopes to acquire our spending data from banks and supermarkets
• The powers provided for in the Data and Statistics Act 2022 could extend to such data acquisition
• The Data and Statistics Act has faced criticism from several former Government Statisticians for the provision to delegate powers for data collection
• An explanation of terms can be found here

Former Government Statisticians disapprove of Stats’ new data collection powers

The above is an excerpt from a 2022 article that former Government Statistician Len Cook wrote about his concerns with the Data and Statistics Act 2022.

In an interview, he told me that the Act has two concerning aspects.

As I touched on in part two, provisions in the Bill enable extensive data-sharing across government agencies and unspecified non-government entities, which suggests data from the private sector and NGOs might be included. It might also put confidentiality of private data at risk.

Secondly, the Government Statisticians’ powers to collect data can be delegated to unspecified individuals and organisations without clear legislative oversight.

He was not the only one who was concerned.

One other former Government Statistician, Maurice Williamson, and a former Prime Minister Sir Geoffrey Palmer, also submitted on the bill at Select Committee stage, and all three opposed the provision to allow delegation of powers.

Cook says he would worry about any power that went beyond the traditional provision for the Government Statistician to carry out a statistics survey, because for that, the Minister is required to agree on the basis of public trust.

“To have a more willy nilly approach, that you can contact whoever you like for information, and I would hope that was not the intention, would be quite a very difficult thing to administer.”

And, he said, it would be “wrong”.

For example, to ask the Salvation Army for information about who is receiving food parcels. This is because “it’s not specified as a public statistical source, they don’t have any obligation to publish it and nor does the Government Statistician have any obligation, or should have, to obtain it.”

But when asked in a multi-part OIA request in April last year, whether Stats NZ had plans to use this power to acquire non-government data, the agency said it had no plans to seek it.

So then, why is it in the legislation?

The potential for ‘surveillance and enforcement’

According to Cook, the Statistical Register being built would have to be endorsed by the Privacy Commissioner, because it goes “way beyond” what is normally used in the production of statistics.

“One of the difficulties is that the current leaders of Stats want to turn it into the Government’s data warehouse. I would argue that the government data warehouse should be managed by the operational units of the crown and the Government Statistician should have access to any part of that data warehouse that he or she wants.”

This is because, at least hypothetically, if an agency developed a plan to validate a person’s benefits for example, they could have the ability to go back to the individual with an account of money still owed and ask for it back, he says.

“If you are going to do those things – surveillance and enforcement of public agency obligations to operate, then you can’t do that with a statistical office database. That would be totally against the law. It would require the law to change. And do we know how that law would be used if it did change?,” Cook says.

Stats’ existing data streams

Stats NZ already has access to various data streams – supermarket data sets (prices, sales turnovers, stock levels) are used to plot the Consumer Price Index and inflation data. Banks provide overseas debit transactions, assets, and liabilities. Telecommunications data is another stream, providing financial performance, business practices, and employment data.

The agency has also previously sourced cellphone tower data from some telecommunications companies, but does not currently receive this information.

An OIA response from Stats NZ said telecoms data provided estimates for the total number of mobile devices within range of cellphone towers at a given time. This has been used to estimate the flow and volume of people moving between different geographic areas throughout the day and over time. It was then applied as an input into tourism statistics across government, and to inform New Zealand’s Covid-19 response and post-Covid economic recovery.

These may be legitimate for statistical forecasting. But where does the agency and the law draw the line?

Revealed: Stats NZ wants your most personal data

Importantly, my source has revealed that former chief executive Mark Sowden, in well-attended internal meetings in 2023 and 2024, said that the agency was looking to enhance admin data over time by adding supermarket, telecoms and banking data streams to the IDI.

And in a 2024 meeting, Sowden was heard to say (and this has been verified): “Over time we may be able to get some income and expenditure data from banks as well. So, we would love to be able to do some stuff with data from banks, which will enable us to do more with admin data.”

This implies person-level data, because the IDI is a person database. That includes how much a person is earning and spending, and what they are spending it on. The phrase ‘over time’ suggests a slow erosion of privacy protections and social license.

And another observation based on these remarks: the mention of supermarket data would likely mean data collected from loyalty cards, because Stats already receives basic sales data.

This is something Auckland University data privacy law expert Gehan Gunasekara has examined and written about. According to a paper he co-authored, such loyalty programs collect vast amounts of data, including:

• Direct identifiers (name, address, email, phone number)
• Purchase history, product preferences, and shopping habits
• Demographic data (age, gender) and behavioural analytics
• Digital interaction data (website usage, cookies, device info)
• In-store surveillance (CCTV, facial recognition, license plates)

I believe most people would be uncomfortable with the government having this level of granular detail about their spending habits (and more) on file.

Insights from the loyalty card data may help businesses refine their offerings, but as Gunasekara’s research points out, they can also be used to manipulate consumer behaviour.

It’s hard not to conclude that both the Privacy Act and the Data & Statistics Act were updated from pervious legislation in a way that weakens the protections they once provided, allowing a project like the Statistical Register to at least be arguable under the law.

As we explored in part one of this investigation, the IDI is being upgraded into something called the Interim Person Spine (IPS) and will later be linked to business and location databases to form an overarching Statistical Register with a digital tag for each person that will track their data in real-time.

There is still far more data Stats NZ could potentially access – if they wanted to.

Endless data-sources

Data streams are everywhere, and surveillance technology is becoming more ubiquitous. This trend is going in only one direction. Why wouldn't governments want to avail themselves of it? It presents huge opportunity for control, through surveillance and enforcement powers, as well as ethically questionable use in behavioural nudging.

Last October Stats NZ confirmed that data from crime records was now being regularly transferred to the agency. Previously, a one-off transfer happened in 2018, to provide a snap-shot in time for researchers. Now, that data transfer is ongoing and integrated into the IDI.

In the UK, Freedom of Information requests have recently revealed that the Ministry of Justice is developing predictive software to identify people who might commit a murder in future, sometimes called precognition software. Remember the film Minority Report?

Well you might be shocked to learn that New Zealand beat them to it. The IDI has already been used to develop a “life-course risk model”, that by the end of 2016 was able to estimate “the number of offences and victimisations likely to be committed or experienced by each resident of New Zealand between now and the end of their life”.

Here are some other data streams that might be of interest to Stats NZ in future:

The New Zealand Transport Authority has a plan for putting tracking devices in every car to accurately measure, and charge for, an individual’s road use.

What about smart meters, now installed in nearly every home? Because the location statistical register appears to include electricity use data, according to OIA responses.

Or Police accessing numberplate data – something they are doing a lot more of, we’re told.

We’re also told by Asia Pacific AML that, “Government agencies are not authorised to access customer data that a business has collected under the Anti-Money Laundering/Counterterrorism Financing Act”, but are collecting it regardless. Could this make its way into the IDI?

And just last week, Justice Minister Paul Goldsmith publicly backed the use of facial recognition to tackle retail crime – despite the Pak n’ Save trial that took place last year still being under review from the Privacy Commissioner. In this particular case we’re talking biometric data – the ultimate unique identifier – your face.

Gunasekara points out that our privacy watchdogs are under-resourced and therefor failing in their ability to protect privacy and ensure data protection of personal information, which is concerning when one consider the government’s full steam ahead development of both a digital identity framework and a biometrics code.

I would also like to make mention of IRDs massive data breach last year (my own data was affected), when over a quarter of a million taxpayers’ data was handed to social media companies, completely un-hashed.

The Taxpayers Union has noted that “the very criticisms of Stats NZ about lack of processes and systems [in the Manurewa Maree scandal] are applicable to IRD. But the IRD breach was on a much larger scale and it appears laws were broken.”

They argue that like Mark Sowden, the IRD Commissioner’s job should also be on the line. But we have seen no accountability on that front.

The overall environment does not give me confidence that my data is safe now, let alone once Stats NZ has compiled it into a massive real-time database and given me a digital tag. This is especially true when privacy experts says identities can be re-established with only a few data points and some artificial intelligence.

Follow up questions were put to Stats NZ but they are now treating it as an OIA request and were not able to respond in time for publication. I will update readers with any response I receive in due course.

Part four will be published on Monday April 21.

Originally published on Byline Babylon.