“Rightly, the idea of our personal data being collected or passed on, without our permission, has a tendency to spark alarm in New Zealand. But the good news is that, when it comes to data analytics, we can achieve an astonishing amount without the need for personalised data..” (Professor Rhema Vaithianathan: data- the heavy lifting can be done blind, Dominion Post, 28 march 2017)

The Privacy Commissioner, John Edward’s report, Inquiry into MSD Collection of Client-Level Data from NGOs, has sent a strong message to the Ministry of Social Development to slow down and review the  Individual Client Level Data (ICLD) Policy, which requires NGOs to collect clients’ individual level data to receive government funding.

While the report supported the collection of information to demonstrate the “efficacy of any programme it funds”, it considered the blanket requirement for ICLD as “excessive and unnecessary” and could lead to serious unintended consequences (i.e deter individuals from using vital social services).

“There is a real risk that the new arrangement will deter some people who are most in need from seeking support or assistance. Not only could that put those people at further risk, and increase pressure on the NGOs, the ultimate result could be that those individuals become “invisible” to Government and policy makers,” said Mr Edwards.

The report identifies three main privacy risks:

  • Individuals may choose to stay away from seeking help at all – leading to worse outcomes for individuals and society as a whole
  • Individuals may choose to provide incorrect information in order to preserve their privacy – leading to inaccurate or useless data for analysis
  • NGOs may allow those clients who are reluctant to have their sensitive information given to MSD to access services without providing their personal information – leading to reduced funding and risks to NGOs’ long-term viability and the “invisibility” to the system of a significant cohort of individuals in need of support.

Define and scope the purpose for collection and future use of data

The Privacy Commissioner’s report also found that MSD had not clearly explained its purpose for requiring ICLD and what it will be used for, who will be disclosed to and types of future use of the data.

Recommendations

  • MSD should consider alternative methods for accomplishing its goals, such as having the information collated and analysed by Statistics New Zealand.
  • MSD must ensure its information collection practices do not deter vulnerable individuals from receiving necessary help. MSD should consider how it can meet its policy objectives in ways that infringe less on personal privacy and reduce the risk of unintended adverse consequences for New Zealand’s most vulnerable people.
  • MSD must ensure that its purposes for collecting, holding, using and disclosing information are specific, relevant to its functions and clearly conveyed, and the information collected is necessary to achieve these purposes.
  • MSD must ensure that its security procedures for holding, using and disclosing ICLD are robust, well-documented and transparent.
NGO Response

ComVoices – Trevor McGlinchey, ComVoices Spokesperson and NZCCSS Chief Executive, says the Privacy Commissioner’s report is welcomed by social service organisations, particularly the preferred option that MSD should consider alternative methods for accomplishing its goals.

MSD’s response

Client level data – Listen to Kathyrn Ryan interview MSD principal Advisor Peter Galvin on (ICLD) and hear his response to some robust questions on the “Big Warning Signs’ signalled both in the Privacy Commissioner’s report and by individual social service organisations.

Minister’s Response

New IT platform for ICLD – The IT platform at the centre of the latest data breach has been shut down and a new IT system will be developed in consultation with the Privacy Commissioner and the Government’s Information Officer.

Great news but in the face of technical problems and opposition by social service providers and privacy experts, what is the underlying rationale for pursuing the collection and sharing of individual client level data?

A recent interview with Minister Tolley’s clarifies the anonymised data can be used to assess the effectiveness of services but that the collection and sharing of ICLD (as opposed to anonymised data) is needed to reduce the duplication of services and to ensure people access services they need.

NZCCSS believes underlying assumptions about duplication of services need to be unpicked.

Wrap around services are not an indication of duplication – Clients may access more than one NGO service but this does not mean service duplication. Intensive family wrap around services requires a range of NGO service to be present, each with a specific role in contributing to the family’s wellbeing.

The Whānau ora model supports this cross boundary approach whereby a whānau can commission services from arrange of NGOS.

The social service context is not the same as a supermarket.  Human beings and families are far more complex than 5 bags of carrots delivered to the door.  An alternative solution is needed.

Minister Tolley has proven herself to be a great listen. It’s time to seek broader advice and read some alternative approaches.