Beneficiaries and Privacy Commissioner on MSD investigation breaches

Newshub Nation interviewed beneficiaries who had been investigated by MSD, and then Privacy Commissioner John Edwards on the breaches of law and what MSD will do now.

On Newshub Nation: Emma Jolliff interviews Privacy Commissioner John Edwards

Jolliff: The Privacy Commissioner says MSD’s powers to investigate have been taken too far. I asked him how serious the breaches have been.

Edwards: That’s hard to rank them because everything is so contextual. I was really troubled by the breadth of the ministry’s data collection in these cases, particularly of text message content. In most law enforcement contexts, you wouldn’t be able to get that information without a warrant issued by some judicial officer — that means an independent person has to look at the case that you’re making for getting access to it, they have to decide whether what you’re seeking is proportionate to the need, and then issue the instruction. These are just demands issued by some clerk or bureaucrat or investigator without adequate checks and balances, in my view. And especially given the sensitive nature of that information, in ranks pretty highly.

In simple terms, how do you see that MSD has breached the law?

By simply ignoring the statutory requirement to seek the information from the beneficiary first, unless doing that would prejudice the maintenance of the law. That’s the headline story. Beneath that, there are a number of instances in which I think the ministry has just lost track of the kind of developing jurisprudence that governs these things. Getting 10 years worth of banking records to investigate one year worth of benefit entitlement us just completely disproportionate. We’ve got to keep recalibrating those enforcement techniques against what we know is legally acceptable in terms of the Bill of Rights Act, you know — the right to be free from unreasonable search and seizure.

Do you see that MSD has accepted that its breached the law?

I’m happy that the ministry has accepte my report. I’m happy that the Chief Executive has assured me that they are going to implement all the recommendations, and they have conceded that the actions that they’ve taken have been unlawful.

MSD justified its collection of personal information about beneficiaries from third parties by saying clients wouldn’t volunteer information, and it was just quicker to go to the third parties. What do you say to that?

Well, that’s not the law, and it also presupposes that the only reason you notify the beneficiary first is to get access to the information. I mean, a beneficiary probably can’t delivery up 10 years of banking information, but what it does do is it informs them that those inquiries are being made. It gives them the opportunity to exercise some autonomy over that.

Could MSD identify any cases where evidence tampering occurred because a client was approached before a third party?

Not as far as I’m aware.

The Privacy Commissioner’s office expressed concerns to MSD about collection of information as far back as 1998, yet they carried on with the practice. This just suggests that they are disregarding the requests of your office, doesn’t it?

Back in 1998 the reference in our report was to the inadequacy of the record-keeping in the ministry because one of the things that was difficult in our investigation is that they simply didn’t have good records. They couldn’t tell us how many times they were issuing these notices, how many times they were going to a beneficiary first. We would ask, and we would get one set of records, then we’d get a completely different version.

So it hasn’t improved despite your requests?

No, it hasn’t improved, and it needs to. And that’s one of our recommendations, and I’m pleased that the ministry have said that they’re going to implement that. We need to have nationally consistent reporting of how these tools are used.

How important is that, and why is that?

Well, it’s really important, and, again, this is about the integrity of the public service. Everybody recognises that beneficiaries have some duties to the ministry, to the government, in terms of their eligibility. The ministry also has duties to act within the law and to demonstrate that it’s acting proportionally. If it is not complying with its obligations, how can it, with any moral authority, expect anyone else to?

Your report also found the MSD had issued notices under Section 11, stating that they’d been approved by the Privacy Commissioner. Was the misleading?

Well, utterly. It was wrong. It was misleading. I’m not able to speculate on the origins of that. I would very much doubt somebody intended to mislead, but they’ve got the wrong end of the stick. We’ve called them out on it, and, to their credit, they withdrew those.

So does this suggest that the Privacy Commission needs greater powers, do you feel?

I have made a call for greater powers, but in fact, when it comes to my monitoring of government agencies, I think that the authority that we have is sufficient. I mean, you will come back to the ministry, as the Nation — as TV3 — in 12 months, and say, ‘Look, tell us what you’ve done to implement the Privacy Commissioner’s recommendations.’ And if they haven’t, then you’ll hold them to account. That, I think, is really important.

You shouldn’t really want to rely on the fourth estate to do that, though. You should have your own powers, shouldn’t you?

Well, you have a role. Other members of parliament and advocacy groups in the community have a role. They will all hold them to account. I was very pleased to see the Minister reacting to our report, and saying, ‘Well, actually it’s great that the ministry have said that they accept the recommendations, that they’re going to implement them, but I think we need to have another look at the legislative underpinnings of this, and see whether there needs to be a law change.’ That’s really positive as well.

Some legal experts have suggested that beneficiaries could take legal action against MSD under the Bill of Rights. Would you agree that that is an avenue that they could pursue, and should they be entitled to compensation?

Certainly if somebody felt that they had experienced significant humiliation or significant injury to feelings because of breaches of the Privacy Act, they could bring a complain to my office. Now, because of the numbers involved in this mismanagement by the ministry over many years, I’m recommending that if somebody does feel that they might’ve been caught up with this, they first direct their inquiry to the Ministry of Social Development.

Can you remind us what those numbers were because you said that was something difficult to ascertain as well?

Starting point — about 15,000 cases.

MSD’s committed to ceasing their blanket policy, as you say, in approaching third parties for information, reviewing the code of conduct, having their investigative practices independently assessed. Does that go far enough?

Look, I think that goes a long way. What we need to do here is to restore the integrity of the system, so that people who are receiving benefits know that they have duties, know that they will be treated fairly and according to the law.

What concerns were raised by private sector agencies like the telcos over the information that they felt they were being compelled to provide?

Those industry groups have felt really uncomfortable about this. They provide services to customers, and they don’t feel like they should be snooping around in their private lives, but when they receive one of these notices from the ministry, they are under a legal obligation to comply.

Have these people, these 15,000 or so, been denied a fundamental human right?

Well, everybody has the right to avoid arbitrary interferences with their liberty and their privacy. So, in some cases, yes, they will have.

Transcript from Newshub Nation/Able/Scoop

13 Comments

  1. Geoffrey

     /  18th May 2019

    There is a lot of comment here about holding MSD to account. Has that process resulted in a single person being fired for giving the wrong advice or doing the wrong thing. Has anyone lost their bonus? It is all very well to acknowledge error but there has to be more to balance the equation. If J Bloggs, beneficiary broke the law in attempting to mislead MSD, there would real and painful consequences. The same should apply when MSD (or any other Government agency) deliberately breaks the law.

    • Blazer

       /  18th May 2019

      there is a law for the poor..and a seperate law for the…

    • Duker

       /  18th May 2019

      Rickard, a deputy commissioner of police is seconded to MSD…..well that explains it then…maybe the police could take him back , for major crime

      • Kitty Catkin

         /  18th May 2019

        You do realise that he was exonerated and Louise Nicholas shown to be a lying fantasist ?

        She was silly enough to put her fantasies on a website. One claim was that every time she walked home from school, a policeman would call her into the station, take her into the lunchroom and rape her on the table.

    • Kitty Catkin

       /  18th May 2019

      Geoffrey, do you know that people in MSD are given bonuses ?

  2. Geoffrey

     /  18th May 2019

    I suppose that is my cue to say, “oh yeah, forgot”. In this case though, I reckon it is time for the Privacy Commissioner to put a bit of stick about and not lamely plead for the Fourth Estate to do his job.

    • Kitty Catkin

       /  18th May 2019

      I have been trying to find out if Neighbourly can legally track the online use of members (that they do so is buried near the end of the long list of small print on their manifesto (for want of a better word) and asked the Privacy Commission. No reply so far. It is unbelievable that they can track what members do online; surely this is an invasion of privacy. I am no longer a member, I left when I was sent intrusive emails as a result of their sharing my information. The thought that they were also tracking people’s online activity was unpleasant. I do nothing untoward online, but that’s not the point.

      Dear Joe Blow

      Your Neighbourly membership is cancelled. We see that you visited the following websites on the dates given.

      Hot Babes of Honduras

      Randy Housewives Home Alone

      Naughty Nurses and Doctors.

      Yours faithfully

      Neighbourly

  3. “If J Bloggs, beneficiary broke the law in attempting to mislead MSD, there would real and painful consequences.”

    J Bloggs did mislead MSD and all that happened was the privacy commissioner wrung his hands about how a ‘decent’ society should respect thieves.

  4. Alan Wilkinson

     /  18th May 2019

    A friend had her NZ Super cancelled without any notice let alone consultation or investigation allegedly after a totally false allegation presumably from someone with malevolent intent.

    When she discovered it she was treated well and it was promptly and fully reinstated but it should never have happened. Sounds as though there is a policy of taking shortcuts to save staff time.

    • Kitty Catkin

       /  18th May 2019

      I heard once that in China people who make false allegations which are proved to be false are given the punishment that the other person would have had if the allegation was true and they were found guilty. What good idea. The person in this case would lose their own super.