Beneficiaries and Privacy Commissioner on MSD investigation breaches

Newshub Nation interviewed beneficiaries who had been investigated by MSD, and then Privacy Commissioner John Edwards on the breaches of law and what MSD will do now.

On Newshub Nation: Emma Jolliff interviews Privacy Commissioner John Edwards

Jolliff: The Privacy Commissioner says MSD’s powers to investigate have been taken too far. I asked him how serious the breaches have been.

Edwards: That’s hard to rank them because everything is so contextual. I was really troubled by the breadth of the ministry’s data collection in these cases, particularly of text message content. In most law enforcement contexts, you wouldn’t be able to get that information without a warrant issued by some judicial officer — that means an independent person has to look at the case that you’re making for getting access to it, they have to decide whether what you’re seeking is proportionate to the need, and then issue the instruction. These are just demands issued by some clerk or bureaucrat or investigator without adequate checks and balances, in my view. And especially given the sensitive nature of that information, in ranks pretty highly.

In simple terms, how do you see that MSD has breached the law?

By simply ignoring the statutory requirement to seek the information from the beneficiary first, unless doing that would prejudice the maintenance of the law. That’s the headline story. Beneath that, there are a number of instances in which I think the ministry has just lost track of the kind of developing jurisprudence that governs these things. Getting 10 years worth of banking records to investigate one year worth of benefit entitlement us just completely disproportionate. We’ve got to keep recalibrating those enforcement techniques against what we know is legally acceptable in terms of the Bill of Rights Act, you know — the right to be free from unreasonable search and seizure.

Do you see that MSD has accepted that its breached the law?

I’m happy that the ministry has accepte my report. I’m happy that the Chief Executive has assured me that they are going to implement all the recommendations, and they have conceded that the actions that they’ve taken have been unlawful.

MSD justified its collection of personal information about beneficiaries from third parties by saying clients wouldn’t volunteer information, and it was just quicker to go to the third parties. What do you say to that?

Well, that’s not the law, and it also presupposes that the only reason you notify the beneficiary first is to get access to the information. I mean, a beneficiary probably can’t delivery up 10 years of banking information, but what it does do is it informs them that those inquiries are being made. It gives them the opportunity to exercise some autonomy over that.

Could MSD identify any cases where evidence tampering occurred because a client was approached before a third party?

Not as far as I’m aware.

The Privacy Commissioner’s office expressed concerns to MSD about collection of information as far back as 1998, yet they carried on with the practice. This just suggests that they are disregarding the requests of your office, doesn’t it?

Back in 1998 the reference in our report was to the inadequacy of the record-keeping in the ministry because one of the things that was difficult in our investigation is that they simply didn’t have good records. They couldn’t tell us how many times they were issuing these notices, how many times they were going to a beneficiary first. We would ask, and we would get one set of records, then we’d get a completely different version.

So it hasn’t improved despite your requests?

No, it hasn’t improved, and it needs to. And that’s one of our recommendations, and I’m pleased that the ministry have said that they’re going to implement that. We need to have nationally consistent reporting of how these tools are used.

How important is that, and why is that?

Well, it’s really important, and, again, this is about the integrity of the public service. Everybody recognises that beneficiaries have some duties to the ministry, to the government, in terms of their eligibility. The ministry also has duties to act within the law and to demonstrate that it’s acting proportionally. If it is not complying with its obligations, how can it, with any moral authority, expect anyone else to?

Your report also found the MSD had issued notices under Section 11, stating that they’d been approved by the Privacy Commissioner. Was the misleading?

Well, utterly. It was wrong. It was misleading. I’m not able to speculate on the origins of that. I would very much doubt somebody intended to mislead, but they’ve got the wrong end of the stick. We’ve called them out on it, and, to their credit, they withdrew those.

So does this suggest that the Privacy Commission needs greater powers, do you feel?

I have made a call for greater powers, but in fact, when it comes to my monitoring of government agencies, I think that the authority that we have is sufficient. I mean, you will come back to the ministry, as the Nation — as TV3 — in 12 months, and say, ‘Look, tell us what you’ve done to implement the Privacy Commissioner’s recommendations.’ And if they haven’t, then you’ll hold them to account. That, I think, is really important.

You shouldn’t really want to rely on the fourth estate to do that, though. You should have your own powers, shouldn’t you?

Well, you have a role. Other members of parliament and advocacy groups in the community have a role. They will all hold them to account. I was very pleased to see the Minister reacting to our report, and saying, ‘Well, actually it’s great that the ministry have said that they accept the recommendations, that they’re going to implement them, but I think we need to have another look at the legislative underpinnings of this, and see whether there needs to be a law change.’ That’s really positive as well.

Some legal experts have suggested that beneficiaries could take legal action against MSD under the Bill of Rights. Would you agree that that is an avenue that they could pursue, and should they be entitled to compensation?

Certainly if somebody felt that they had experienced significant humiliation or significant injury to feelings because of breaches of the Privacy Act, they could bring a complain to my office. Now, because of the numbers involved in this mismanagement by the ministry over many years, I’m recommending that if somebody does feel that they might’ve been caught up with this, they first direct their inquiry to the Ministry of Social Development.

Can you remind us what those numbers were because you said that was something difficult to ascertain as well?

Starting point — about 15,000 cases.

MSD’s committed to ceasing their blanket policy, as you say, in approaching third parties for information, reviewing the code of conduct, having their investigative practices independently assessed. Does that go far enough?

Look, I think that goes a long way. What we need to do here is to restore the integrity of the system, so that people who are receiving benefits know that they have duties, know that they will be treated fairly and according to the law.

What concerns were raised by private sector agencies like the telcos over the information that they felt they were being compelled to provide?

Those industry groups have felt really uncomfortable about this. They provide services to customers, and they don’t feel like they should be snooping around in their private lives, but when they receive one of these notices from the ministry, they are under a legal obligation to comply.

Have these people, these 15,000 or so, been denied a fundamental human right?

Well, everybody has the right to avoid arbitrary interferences with their liberty and their privacy. So, in some cases, yes, they will have.

Transcript from Newshub Nation/Able/Scoop

Identity politics and dignity

‘Identity politics’ is a term that’s been increasingly used to criticise someone or something, but with the meaning being vague.

The Oxford definition is actually not very remarkable.

identity politics

A tendency for people of a particular religion, race, social background, etc., to form exclusive political alliances, moving away from traditional broad-based party politics.

The top definition at Urban Dictionary has a different take on it:

The act of believing that disagreeing with someone on certain ideologies equates to them disapproving a particular identity such as one’s race, sex, sexuality, religion, etc. rather than the ideology itself. Instead of focusing on the logical aspect of an idea or opinion, identity politics instead believes that a particular identity is opposing all people who belong to a particular identity.

This alternative seems closer to what I see as more common usage:

A dog whistle used by brocialists to attack any member of a minority group who gets above themselves by disagreeing with them.

Disabled lesbian: The flaws in state communism have been apparent to much of the left since long before the Soviet Union was ever founded. What do you think the Marx-Bakunin split was about?

Brocialist: Hey, quit your identity politics; we’re trying to talk about socialism here.

From The Spinoff article by NZ Privacy Commissioner John Edwards: Transgender self-identification: why it’s a human right”

What is “identity politics”? The term has come to be a slur, a shorthand encapsulating what is seen as the natural conclusion of another lazy and imprecise term, the much maligned ‘political correctness”. Identity politics is caricatured as a symptom of the decline of an increasingly fractured left, obsessed with smaller and smaller subgroupings of society, defined by some characteristic of race, gender, sexuality, disability or similar.

But that is only one side of what has become to be known as identity politics. Francis Fukuyama, in his 2018 book Identity – Contemporary Identity Politics and the Struggle for Recognition finds in the epithet also an explanation for the wave of rightwing Nationalism sweeping the world, from Hungary to Brazil, from the 2016 Brexit vote to the US presidential election of the same year.

The link is dignity, and the perception of the overlooked and disenfranchised, who, whether left or right, feel that their sense of identity is threatened. The subtitle to Fukuyama’s book is even more revealing: “The Demand For Dignity and the Politics of Resentment’.

The aspirations of marginalised gender or ethnic groupings have something in common with the overlooked and taken for granted Rust Belt Trump voters whose communities have been impoverished by economic decline, and ravaged by pain pills. Behind each is a cry for recognition and an equality of opportunity.

Dignity is something that’s missing from a lot of online discussion, especially when  terms like ‘identity politics’ are thrown around.

Journalist or not?

I referenced this recently but it’s worth a look at this full post last week by Privacy Commissioner John Edwards:

When is a journalist not a journalist?

Last week’s decision of Clifford J in the Wellington High Court found that in the context of the Evidence Act, Nicky Hager was a journalist in relation to the publication of Dirty Politics, and was therefore entitled to assert privilege under s.68 of the Evidence Act 2006.

The High Court decision to classify Hager as a journalist echoes my office’s decision to do the same, in a complaint made against him by blogger Cameron Slater. This is important because the Privacy Act only applies to agencies – and the definition of “agency” excludes “ in relation to its news activities, any news medium.”  Journalists working in their capacity in the news media do not come under my office’s remit.

However, if we accorded Hager the news media protection, why did we flip-flop in another case and deny it to journalist John Roughan?

We don’t usually make public comment on cases that we have investigated. But apparent inconsistencies in approach have been picked up by parties and questioned. Those questions are legitimate, and important, so I’m happy to try and explain, by discussing elements of the complaints to our office that have been placed into the public domain by the parties.

There are three other relevant cases, all with familiar parties:

Dotcom v Attorney-General

The Crown (being sued by Kim Dotcom) asked the Court to force Kim Dotcom to produce documents held by a journalist (David Fisher), who he’d fully co-operated with when Mr Fisher wrote the biography The Secret Life of Kim Dotcom. This is a process called discovery. Usually, one party can ask the other party to give up all relevant information that is within their control. If a third party has information relevant to the proceedings, there is a special process by which they can be compelled to produce information for the proceedings as well. This is called “third party discovery”.

The Crown argued that because Kim Dotcom had a right under the Privacy Act to access personal information held by an agency, any such information was within his control, and therefore he should exercise his right to procure and produce it.

David Fisher was, they said, an agency under the Privacy Act, and Kim Dotcom could get all the information held by him. The Court considered whether David Fisher was an agency, given he was a journalist, working for a major NZ daily newspaper, who had regularly written news articles about Kim Dotcom.

Then Chief High Court Judge, Justice Winkelmann concluded that in David Fisher’s capacity as an author of a book, he was not “news media” as the definition refers to “articles”, not “books”. The result seemed to be that Mr Fisher would not be subject to the Privacy Act for an article published in the New Zealand Herald, but if a collection of such articles were published as a book, he would be.

Cameron Slater v Nicky Hager

Nicky Hager received a hard drive from an unnamed source with a significant amount of personal correspondence to and from blogger Cameron Slater. He then used that information as source material for his 2014 book Dirty Politics.

Mr Slater made a complaint to my office that the means by which Mr Hager obtained his private communications, and then subsequently published them, breached his privacy

The matter the High Court was addressing in Dotcom v Attorney-General was based on an individual’s right of access (that is, information privacy principle 6). The question we faced in the Slater v Hager complaint was about the means by which an investigative journalist collected and disseminated information (that is information privacy principles 1-4, and 11), so there were differences in the basic facts of the case.

We, and others found the High Court decision in Dotcom troublesome from a number of perspectives, not the least being that it effectively puts my office in the position of having to form a view on what information parties are entitled to have access to for court proceedings, but I have no power to order the production of the information. If the Privacy Act is to be the means for providing third party discovery there will be significant delays in cases before the courts as parties come through my office, and then on to the Human Rights Review Tribunal before going back to the court hearing their dispute.

When lawyers find a precedent case inconvenient, they seek to “distinguish” it from the facts of other cases it might otherwise apply to.

In determining whether Mr Hager was ‘news media’ for the purposes of the publication of a book, my senior investigating officer decided the facts of the complaint were quite different from those in the Dotcom case. He was obliged to take into account s.14 of the Privacy Act which requires that in performing functions under the Act, we have to have due regard for the protection of important human rights and social interests that compete with privacy.

And he had to think about s.6 of the New Zealand Bill of Rights Act 1990 (NZBORA)  which provides “Wherever an enactment can be given a meaning that is consistent with the rights and freedoms contained in this Bill of Rights, that meaning shall be preferred to any other meaning“.

Section 14 of the NZBORA provides for “freedom of expression, including the freedom to seek, receive, and impart information and opinions of any kind in any form”.

And so we made the decision that the writing and publication of Dirty Politics was the collection and dissemination of news, by a journalist, and that as such we had no jurisdiction to consider a complaint that its publication or research that lead to it, was a breach of the Privacy Act.

Roughan v Prime Minister John Key

So if Nicky Hager is a journalist when he writes a book, why isn’t John Roughan when he does?

Mr Roughan wrote a book about Prime Minister John Key.  Lawyers for Bradley Ambrose, the cameraman suing Mr Key for defamation as a result of the “teapot tapes” events asked the Prime Minister for discovery, including material held by his biographer John Roughan. They were asking him to exercise his right under the Privacy Act to access personal information about him, so it could be produced to the Court. Lawyers for the Prime Minister obliged and made the request of Mr Roughan, who refused on the basis that he was a journalist.

Here, we had a case that was “on all fours” with the earlier decision of Justice Winkelmann. A journalist working for New Zealand Herald writes a book about a well known individual who is a party to legal proceedings. I made the decision that as a statutory officer faced with a case with identical facts to those directly ruled on by a senior judicial officer, I was bound by that precedent. There was simply no “wiggle room”.

Privacy, freedom of press and the courts

A freely functioning press is vital to a healthy democracy. Press freedom, and freedom of expression are not absolute values, and are like other rights, subject to limitations. That’s why we have defamation laws, laws against incitement, and limits to protect  privacy.

This is also why Nicky Hager ultimately succeeded in his judicial review of a warrant to search his property for evidence that might identify the source of the information Hager used for his book Dirty Politics.

I agree with critics that consistency in the law and its application is an important value. With the Government committed to reform of the Privacy Act, it could be timely to take the opportunity to clarify the position of journalists, privacy, discovery and the Courts.

  • Privacy Commissioner John Edwards