Data and Statistics Bill

Members, we come now to Part 5. This is the debate on clauses 48 to 56, “Access to data for research”, and the question is that Part 5 stand part.

Thank you, Madam Chair. This is a really substantive part of this bill. We’ve been debating, in the committee, at length about the powers to collect data for research, and the Government’s agreed to disagree that it is a mandatory requirement on request. What Part 5 does is set out the circumstances where the Statistician can authorise access to the data for research, to whom that can be provided, including people who are not New Zealanders, overseas individuals or organisations, be satisfied that the research is in the public interest, and that there are appropriate measures to protect privacy, confidentiality and security.

Now, most colleagues who are interested in this bill will have heard from the Council for Civil Liberties. While I don’t agree with all of their conclusions about what this bill will do, I was minded in their briefing, in advance of the committee of the whole House, at the top of page 11, where it says Part 5 of the bill creates a new regime governing access to data for research. So it would be helpful for the committee, I think, if the Minister could advise the committee on the degree to which, if at all, the regime that we’re considering under Part 5 differs from the Statistics Act 1975. I think it’s important that we understand how we are broadening the access to research and whether or not that is going to lead to any greater risk of harm to individuals or organisations if the research part of the Statistician’s role is broadened in the degree that the civil liberty organisation believes.

I would also note that they note in their submission that the Chief Ombudsman also recommended, as they did, the removal of Part 5 entirely. That was, really, the issue that Debbie Ngarewa-Packer’s tabled amendment would do. I don’t support that. I think, actually, research is really important in this context, but we’ve got to have a very, very robust framework for being able to protect data and protect individuals’ identity. So, noting that as eminent an Officer of Parliament as the Chief Ombudsman was concerned enough to recommend the removal of Part 5, and also noting that there hasn’t been actually that much change to Part 5 since the bill was introduced, can the Minister provide the committee with reassurance—well, firstly, a commentary about the degree to which this is a new regime and how it differs from the Statistics Act 1975, and a commentary also, perhaps, if he feels inclined, on calls for the removal of Part 5 entirely.

I thank the member Michael Woodhouse for his question. Part 5 is where we see a modernisation of the framework in the 1975 Act. The current Statistics Act does enable access to data for research; that’s in section 37C. Earlier in the debate, I waved this report around, which I believe to be a really important report recently released about Māori business that has come about as a result of useful research. We do need to be able to have research for the betterment of our decision making.

Now, in saying it’s a modernisation of the 1975 Act, it does so in allowing bona fide researchers to safely access data held by Stats NZ for research in the public interest. However, the 1975 Act’s framework provided no guidance on the matters that the Statistician must consider before authorising access to data. It also did not reflect Māori interests or require transparency around research access. And, indeed, this part of the bill takes the research access framework from one clause to a whole part in the bill. It is, I think, quite clearly a strengthening of the research access framework and an appropriate strengthening of that access framework. The research access framework incorporates, in this bill, domestic and international best practice frameworks for appropriate and safe access, such as Ngā Tikanga Paihere and the Five Safes framework. It requires the Government Statistician to publish information about who is accessing data, how the data is being accessed, and for what purposes. It requires researchers to publish research results and methodologies. Now, just to be clear—and we’ve canvassed this before but I think it’s worth putting on record again—access does not mean that researchers can hold and store the data themselves. Access occurs through a secure portal, and researchers can only access data that is relevant to their research.

Perhaps I’ll just also relate the comments the Privacy Commissioner made. The Privacy Commissioner, in their submission to the committee, noted that they were satisfied that the bill contains adequate protections around the inappropriate use of personal information. They noted that the protections have included “a clear framework for access to data held by Stats NZ for research purposes (Part 5)”—this is a quote from them—“including that the Statistician, before authorising access to data for research, must: be satisfied the research is in the public interest (cl 49); be satisfied the research is to be carried out by an appropriate researcher, who will protect the privacy, confidentiality and security of the data (cl 50, especially cl 50(a)(iii)); be satisfied access to data is subject to appropriate measures to protect the privacy, confidentiality and security of data (cl 51); consider whether, if the researcher is an overseas person, the data will be protected by comparable safeguards to those in the bill (cl 52); and that the Statistician must publish information about access to data by researchers (cl 53); [and] a requirement that researchers must comply with obligations in relation to data accessed for research, including to take all reasonable steps to ensure that data is only disclosed in a form that could not reasonably be expected to identify individuals (cl 54, especially cl 54(1)(c)).”

So I do think this represents a substantial strengthening of the Act, and an appropriate one, and I think it’s important to spell that out. I thank the committee for its indulgence. Obviously, it’s in the part, but I think it’s worth putting on the record both the Privacy Commissioner’s view that they’re satisfied with this improved regime. I think the transparency is important, and, obviously, the safe dealing with the data that’s provided, sometimes sensitive data, is imperative.

That’s helpful. And I think the comments of the Privacy Commissioner are relevant. I’ve just brought up the comment though, because what I think I heard the Minister say was that there was no real regime for the provision of data for research in the 1975 Act, so my two questions really are in relation to that. Because what the Chief Ombudsman said, when he said in his submission—“It is unclear to me what purpose this alternative information access regime will serve.”—he was referring to an access regime that was an alternative to the Official Information Act. So my questions are, first, does that mean that, prior the passage of this bill, requests for information for the basis of research was always done under the Official Information Act? Is that how researchers got access to their data, because that wasn’t my understanding. And, secondly, when this bill is passed, how will it actually sit beside the Official Information Act, and are the two compatible? So, for example, if the Chief Statistician determines that it’s not appropriate to release certain information based on the criteria set out in Part 5, could the applicant then go through the Official Information Act to get the same data? Because it seems to me that the Official Information Act in section 9—grounds for refusal—is quite different from the grounds for acceptance and the conditions for acceptance set out in Part 5 of this bill. So they don’t actually dovetail together. And I don’t think it would be appropriate for somebody who the Statistician deemed inappropriate to get information to then actually use the Official Information Act in order to do so. But the Chief Ombudsman had kind of the opposite view. He was saying that because the Official Information Act exists, Part 5 was unnecessary and he recommended it be deleted altogether. So it’s just a kind of—again, perhaps to put on the record—a wrap-up of the combined effect and power of those two pieces of legislation once they’re passed.

I think Part 5 is actually in reasonably good shape, but the Chief Ombudsman is no dummy. He’s having to deal with these sorts of requests all the time and so it does behove us to make sure we’ve considered carefully what he said.

Section 18 of the Official Information Act (OIA)—I think the member raised a very good question—provides for the Official Information Act to be overridden by other Acts, and, in this case, the updated Data and Statistics Act would override it. The member asked the question, “Could a member of the public, having not received the information they wished for, with a request under this Act, go to the Official Information Act, request the same information and receive it?” And the answer is, no.

While the OIA provides some protection to personal or commercially sensitive information, the bill’s research access framework and its confidentiality requirements go beyond what is required for an Official Information Act release by ensuring that people and organisations cannot be identified by data published in research. And also, while conditions can technically be placed on information released under the provisions of the OIA, the conditions aren’t enforceable. So you would choose to use this Act to override it, because it is enforceable. The provisions in the bill that provide for statistical confidentiality are in clauses 39 to 42; safe and appropriate data access clauses, 48 to 54; and the ability of individuals and organisations to specify access conditions, clause 33, ensures that those providing data can have confidence that their data will be subject to the highest standards of protection. I do thank the member for raising this so that we can put that clearly on the record.

Thank you, Madam Chair. Just a question around clause 56(5) in which agencies that are authorised by the Statistician to provide access to data need to publish information about who is accessing the data held by the public sector agency for research in accordance with that section, what data is being accessed, the purposes for which the data is being accessed, how the data is being accessed, and, any characteristics of the data being accessed or limitations that may affect the quality of any research using the data. Subclause (6) then goes on to say that information required to be published about those above mentioned matters may be published in summary form. The New Zealand Council for Civil Liberties has raised a point here, saying that, “If access to granular data is good enough for the public sector, disclosure of granular information about that access and what has been done with it is an entirely justifiable quid pro quo”, and I’d be interested in the Minister’s response to that point.

A second point—if I could ask the Minister—is around clause 52, and that is the additional considerations if overseas persons are seeking access to data. I note that a number of protective measures have been put in this clause in terms of the need to take into account the laws that apply in the relevant jurisdiction, the relationship between Statistics New Zealand and the overseas person, and any means available to the Statistician to ensure that the overseas person complies with any conditions imposed. However, I also note that anyone overseas will not be subject to New Zealand law, and, in particular, will not be subject to the Privacy Act. So I would ask the Minister how people can be assured that if information is made available to people overseas, their data can be protected despite anyone overseas accessing that data not being subject to New Zealand’s laws.

Look, the bill provides for information to be published in summary form, as the member notes, and the reality is that it would be inappropriate or impractical to publish detailed information. I’ve give some examples.

Well, let me phrase it differently: if these could not be in summary form, which would still need to involve providing meaningful information—the summary form is not a “get out of jail free” cursory; it has to be a meaningful summary. But if they couldn’t be published in summary form it would not be clear as to whether the law required researchers to publish every set of results generated, all their notes and drafts that they produced over the course of their work—researchers to publish technical details of every method of analysis they applied, even if these are well known to the statistical community already. It would potentially require the Government Statistician to publish every detail of security and process setting in place regarding embargoed access to official statistics; potentially require the Government Statistician to publish every detail relating to the fields of data within data sets being accessed for research, the contents of CVs supplied by researchers, the contents of all documents they provided when describing their research project, for example, previous theses or reports relevant to the project; and potentially require the Government Statistician to publish every detail of process and security in place regarding research access.

You can kind of go on from there and see that it would be quite impractical and potentially come into conflict with all kinds of other requirements, particularly, for example, somebody coming from another jurisdiction where there was confidence that they could use the data securely and safely and had a good reputation as a researcher but may have other laws applying to them in another jurisdiction that would then have to be worked through as well. So it’s a practical expectation. But to the member’s point, I think that it’s important to say for the record that the summary form must be a meaningful summary form so that meaningful information is available to the public.

I thank the Minister for that explanation. Just the second question: I’d ask if the Minister could just address, regarding clause 52, the considerations of overseas persons accessing data and the point that they will not be subject to New Zealand’s law, in particular New Zealand’s Privacy Act. So what confidence can people have that data collected by various agencies for the Statistician and provided to persons overseas will be protected despite those persons not being subject to New Zealand’s laws—and, you know, recognising the point that once data is in the wild, it can be very difficult to pull it back? So there obviously needs to be quite significant protective measures around that.

I note that a number of measures have been put in place here, but what confidence can the Minister provide, and what confidence can people have, that that information that does go overseas won’t be used in ways that are unanticipated? And how can any persons or organisations overseas who access and use that data be held to account if they use it in ways that aren’t contemplated by the Statistician, who provides it to them?

Just a brief call in relation to my Supplementary Order Paper (SOP) around summary form. The Minister’s actually provided some elucidation in response to Joseph Mooney’s question one before.

But I’m looking in clause 56(5) as an example of where I’m a little unsure how much more of a summary form you could get. “Chief executive”, in this case, is talking about the determination, a report that the sector agency must publish about who’s accessing data, what data is being accessed, the purposes for which the data is being accessed, how the data is being accessed, and the characteristics of the data being accessed.

Now, with the exception of that last one, I fail to see how you can have a summary form of what’s effectively a summary. I mean, it’s a bit hard to say who was accessing the data in summary form. You either say who it is or you don’t. What data is being accessed? Well, they’ve all got sort of nomenclatures and titles on them. What purposes? Well, it might be for research into X, Y, or Z. It’s a bit hard to know how that could be further summarised; it’s a bit of a sort of a legal piece of string.

So does the Minister or officials actually have a template or some kind of indication about what the information that needs to be published right through the bill in summary form might look like? Are we talking about one page per—nobody wants a dictionary and a taxonomy and a mountain of information, but that’s not what the law asks for. The law, in its wording, actually strongly implies that that is a summary. So I don’t know how you can summarise a summary. That’s the problem I’ve got, and that’s why I put the amendment up.

I’ll respond first to the point raised by the Hon Michael Woodhouse and then come back to Joseph Mooney’s previous question.

In terms of what the summary would look like, effectively there is a convention and it’s already being done—this is codifying best practice. So what you—

💬 Hon Michael Woodhouse: You should have asked for it in committee, then. That’s our oversight.

The member—sorry, I’ve forgotten what I; I’ve been listening to the member. I shouldn’t do it while I’m talking—

💬 Hon Michael Woodhouse: You basically said there was already precedent.

Right. There is, yes. We would expect that to be a developing practice within the department of statistics as well.

I want to come back to the member Joseph Mooney’s question about the Privacy Act not applying to overseas persons. I think I may have covered this earlier, but again, it is an important point and I think a concern raised in some of the correspondence.

The member raised concerns about the Privacy Act not applying to overseas persons, and now while the New Zealand Privacy Act doesn’t apply to a person overseas, clause 52 requires the Statistician to take extra care when deciding whether to allow access from overseas, taking into account the laws that apply in the relevant jurisdiction and the relationship between Statistics New Zealand and the overseas person and any means available to the Statistician to ensure that the overseas person complies with any conditions imposed, obviously by the Statistician.

It’s important, I think, again in this context, to emphasise that data will not be provided to the researcher. Stats NZ continues to hold the data and it can only be accessed through a secure portal. The member noted previously, as well, that there might be no obligations—this is, I think last night, from memory—on the researcher to leak data, but that would only make sense if the researcher held the data. But again, it is actually held within Stats NZ—I think that’s really important to emphasise that point.

Thank you, Madam Chair. I’d like to speak on clause 39, “Statistician authorised to publish or otherwise disclose certain data”. Subclause (1) says “The Statistician must take all reasonable steps to ensure that the Statistician does not publish or otherwise disclose data in a form that could reasonably be expected to identify any individual or organisation.” One of the things that appeared on my desk was an article that the Government was looking to filter the internet. So how may the new data—if I may ask the Minister if he could address this concern—captured under this data and stats bill impact the Government’s plans to filter the internet, and can the Government give assurances that the information captured under this bill is actually not going to be used to potentially prosecute or filter a specific person’s internet content? Could the Minister actually address that?

I hesitate to say—we have canvassed the protection of data a number of times in the debate. The member’s referring to Subpart 5 of the previous part of the bill, rather than Part 5, which we’re on now, but I would stress for the member—in the spirit of her question—that the protection of data is paramount in this bill. And Part 5 absolutely goes to that issue, so I think the broad issue is there, and that is the issue we’re debating.

I move, That the question be now put.

The question is that the Minister’s amendment to Part 5 set out on Supplementary Order Paper 163 be agreed to.

Amendment agreed to.

The Hon Michael Woodhouse’s amendments to Part 5 set out on Supplementary Order Paper 197 are out of order as being inconsistent with a previous decision of the committee.

The question is that the Hon Michael Woodhouse’s amendments to Part 5 set out on Supplementary Order Paper 198 be agreed to.

The question is that the Hon Michael Woodhouse’s amendments to clause 53 set out on Supplementary Order Paper 199 be agreed to.

Debbie Ngarewa-Packer’s tabled amendment deleting clause 48 is out of order as being inconsistent with a previous decision of the committee.

The question is that Debbie Ngarewa-Packer’s remaining tabled amendments to Part 5 be agreed to.

Amendments not agreed to.

The question is that Part 5 as amended be agreed to.