Data and Statistics Bill

Members, we come now to Part 6. Part 6 is the debate on clauses 57 to 89, the offences and enforcement clauses. The question is that Part 6 stand part.

Thank you, Madam Chair. Part 6 is the part that deals with offences and enforcement, and I’m comparing Part 6 of the bill with Part 5 of the Statistics Act 1975, which we’re replacing. Subpart 1 of the bill talks about powers of entry and inspection. Clause 57 gives the Statistician quite a bit of power to enter businesses or individual dwellings—sorry, not private dwellings, I should qualify—but require persons to produce data, issue of search warrants by an authorised officer, an issuing officer, and it refers to data obtained using power of entry.

In the 1975 Act, at Part 5, which is the equivalent part on offences and penalties, there doesn’t appear to be any reference to powers of entry and the issuing of search warrants. So my question to the Minister is: are these powers of entry and search warrant new powers that don’t exist in the existing legislation, and, if the answer to that question is yes, given these are quite strong powers, what problem are we trying to solve and why are we giving the Statistician and issuing officers such strong powers of entry and inspection?

The powers of entry and inspection are a modernisation of section 35 of the existing Act. The power has existed in statistics legislation in various forms since 1910. I think that probably answers the member’s question.

Thank you, Madam Chair. Just on this, I note that the Statistician or the issuing officer can issue a search warrant if they believe there are reasonable grounds in believing it’s necessary or desirable for the purpose of enabling the Statistician to produce official statistics, so I’d just like the Minister just to clarify that. It’s very clear here as I read it, but I just want to confirm that the purpose of exercising a search warrant can only be to obtain data for official statistics and not for research purposes, although I would appreciate the Minister clarifying a little bit that definition all the way back in clause 6, which we didn’t quite get, which is “data includes information”. And that seems to be a very broad definition. So I will just ask how tightly exercised the Minister expects this power of entry and inspection to be used and for what purposes.

The fact that the definition of data includes information is a point that the member has raised before, and I haven’t directly addressed it, so I do want to acknowledge that and address it now. There are lots of points you’re following up on and sometimes you miss one. The information relates back to the Official Information Act, so it makes the link back. So it’s not a great expansion or anything like that—sorry, the Privacy Act; sorry, I said Information Act, didn’t I? The Privacy Act, please excuse me. So it’s a clarification and provides protections, effectively.

Please excuse me if I actually sound a little obtuse on this one, but I’m baffled as to why there is actually a search warrant for collection of data. Obviously I wasn’t in the Chamber when different Parts were actually discussed, maybe I’ve missed it, but perhaps the Minister could illuminate me.

Thank you. As I just briefly outlined, these powers go back to, basically, 1910 in New Zealand. This is a modernisation of the current Act, and this whole Part, I would note, is quite a reorganisation, a modernisation, but that particular set of powers is long existing for the purposes of ensuring robust statistics.

I think it’s important for the confidence of people in this bill, and the Minister’s touched on it to some extent previously, but just I’d appreciate a little bit of expansion on clauses 78 and 79 in terms of a person committing an offence and if the person, having completed a certificate of confidentiality knowingly breaches an obligation or knowingly makes a false statement about whether they breached an obligation undertaken in the certificate of confidentiality—that’s in clause 78.

Clause 79 is about wrongfully obtaining data while performing a duty or function or exercising power under the Act. So is this the clause which is intended to address a circumstance, for example, where someone might make a claim that they’re requesting data for research purposes, but it’s in fact for official statistics; or that they’re requesting it for official statistics and in fact, are accessing it for research purposes. Is the protective mechanism that is intended to provide confidence that people will comply strictly with the expectation that there’s a distinction between those two datasets and the collection of them, and that there is, in fact, a criminal penalty here to address anyone who wrongfully obtains data that conflates, wrongly and knowingly, those two purposes for the collection of data.

I thank the member for drawing attention to this part of the bill; I would struggle to put it any more clearly than it is in the bill itself. It says here, and I’ll just read it for the committee and for those following at home. Clause 78(1) states: “A person commits an offence if the person, having completed a certificate of confidentiality under section 42, (a) knowingly breaches an obligation undertaken in the certificate of confidentiality; or (b) knowingly makes a false statement about whether the person has breached an obligation undertaken in the certificate of confidentiality.” It then goes on to describe the consequences in terms of fines.

I think it’s really important that we have not only agreements around confidentiality, but that there are consequences for any breaches. Then clause 79 goes on to describe people who are obtaining data without the necessary authorisation to obtain it. So they are misrepresenting themselves or the authorisation that they have. And, again, it describes this as an offence which has the same fines attached. So there are many other clarifications there around what the obligations are and what the consequences of not meeting those obligations through this part of the Act are. And, indeed, to repeat myself, it’s pretty important that there are consequences if there are breaches here so that the public can know, and that the Statistician has powers. I think, again, it’s an unlikely event. Generally, those who are doing research are coming from reputable research backgrounds. They are often known to the statistics agency because they conduct ongoing research and they’re doing it for the very purposes laid down in the Act, which is improving the information available to New Zealanders for decision making, for holding decision makers to account, and so forth. Incredibly important work that provides the conditions for the betterment of our society. But if there are breaches, there do need to be clearly spelt out obligations and consequences, and this is what this part of the Act deals with.

Thank you, Madam Chair, and my apologies to my colleague Joseph Mooney, who obviously had more to actually ask on that particular issue. But I go back to the search warrant issue where the Minister has answered by saying that this is a part of the ability for the Government department to actually do a search warrant, and this is, apparently, the modernisation. So I asked the Minister if he could actually answer when was the last time a search warrant was executed to collect data, and what did that data get used for in the usefulness for the Government Statistician. I think it is really important to find out what circumstances warrant executing a search warrant on an individual’s business or premises when it is for statistical or research purposes. I just don’t understand why something which we normally associate for criminal offences—for example, to activate a search warrant—is needed to get statistics data. I’d like to get an answer on when was the last time it was actually activated and what useful data they collected, and what that data was used for by the Government.

Thank you, Madam Chair. I want to quickly direct the Minister’s attention also to clause 80, which says that “A person who is authorised under section 48 to access data research commits an offence if the person—(a) knowingly contravenes section 54(1)(a) or (b)”, and clause 54(1)(a) or (b), for those watching, is accessing and using the data only for the research for which access is authorised, and complying with any conditions imposed by the Statistician. So that, on the face of it, as a good protective measure.

What I’m interested for the Minister’s thoughts on is clause 80(1)(b)(ii), and that’s if they knowingly publish or disclose data, “being reckless as to whether the reasonable steps required by section 54(1)(c) have been taken.” Clause 54(1)(c), for clarity, is that they must “take all reasonable steps to ensure that they do not publish or otherwise disclose data in a form that could be reasonably expected to identify any individual or organisation;”.

This is an interesting point, and I’m interested in the Minister’s thoughts on how this will play out in an era of constantly increasing computational power. When the Statistics Act 1975 was passed, about 6 million transistors could fit on a microprocessor. Today, it’s around 114 billion.

💬 Stuart Smith: Say that again?

When the Statistics Act 1975 was passed, about 6 million transistors could fit on a microprocessor. Today, it’s around 114 billion—so 6 million to 114 billion. This computing power can then be increased further through networking computers, and it’s increasing exponentially.

There’s another point here that’s relevant. I asked the Minister this earlier, but didn’t yet receive a response to this specific point. The specific point is about how this bill appears to be focused on de-identification rather than anonymisation, and de-identification has a lower standard than anonymisation. So, as an example, as more facts are included in the public record—for example, date of birth, broad location, genders—this, combined with other facts, makes it increasingly easy to narrow candidates to a single person or a small group, and the New Zealand Council for Civil Liberties has provided a couple of examples. It’s been shown in research by the former US Federal Trade Commission’s chief technology officer, for example, that 87 percent of the US population can be uniquely re-identified based on a five-digit Zip code, gender, and date of birth.

New Zealand census meshblocks typically used in research here are smaller and make re-identification even simpler. Even using meshblock data on religion to identify which streets have higher presences of particular groups such as particular religious groups could be not a good thing in the wrong hands, and second data sets can be combined with existing public data, sometimes in unexpected ways. For example, in 2019, the Australian state of Victoria released an anonymised set of data from myki public transport cards. Researchers were able to use a tweet made by a Victorian MP about catching a train to obtain his entire travel history. Similar approaches have been used to de-anonymise medical records in the Australian medical system and locate US service personnel and base locations.

So it’s reasonable to assume that efforts to unravel de-identification of New Zealand’s personal data will only increase will only increase and become easier over time. So in terms of this definition in clause 80(1)(b)(ii) about being reckless as to whether reasonable steps to ensure that they only publish or disclose data in a form that can be reasonably expected to identify any individual or organisation, how does the Minister see this playing out in an era where the computational power is in increasing exponentially, and the different datasets are becoming increasingly available and can be linked to these datasets that have been collected for specific purposes under this bill?

In response to Joseph Mooney’s question—and the succinctness of my answer should not be interpreted in any way as dismissing it—“very carefully”, I think, is the answer. He’s outlined the problem, I think—a challenge facing modern societies—and I am convinced that the protections and the awareness is there, but, you know, I think that’s the answer. Technologies will change, and we do need to be careful. The framework laid out here is designed to do that.

I do want to go back to the point raised by Melissa Lee, just regarding search warrants. She asked for some further clarification, and I think it’s useful for the committee to hear a little bit more about that. I agree with the member. The power supports the ability of the Statistician to make mandatory requests for data for official statistics from businesses, and that data informs some of our most significant statistics, like the Consumers Price Index as an example. It can only be exercised with the consent of an authorised person or after Stats NZ has obtained a warrant from a judge or other court. It’s not a power that’s used lightly. The member asked when this was last used. I’m advised that people who’ve been around a wee while are not aware of it ever having been used. But it is there, because it backs up the requirement to comply with requests for data. I’m sure the member, and other members in this House, would agree that the likes of the Consumers Price Index are incredibly important economic indicators that we would want to see collected.

The reality is that Stats NZ collects data by consent. It doesn’t want to be in a position of being an enforcement agency; it wants to do it through having good relationships, and that is how things work. None the less, having a regulatory backstop, effectively, is a good idea. It’s the old story about policing by consent. If the police are pushing things through, they can lose the support of the public unless they’re doing it with the will of the public and in a way that fulfils the purposes and people can see fulfils the purposes. They want the relationship, and they work hard, in my observations of Stats NZ, to build relationships; for example—and the member has raised questions around this before—around the census, building relationships with the communities. I know Rachel Boyack, my colleague who was here earlier sitting behind me and is now a wee way across, has raised questions about the relationship that Stats NZ has with minority-pocketed communities around our regions and making sure that those are being developed for the purposes of Census data collection.

Mandatory powers only achieve so much, but here they are to underscore the importance of this and to encourage, or backup, the requirement to comply with the request. I do thank the member for that question.

The question is that the Minister’s amendments to Part 6 set out on Supplementary Order Paper 163 be agreed to.

Amendments agreed to.

The question is that Debbie Ngarewa-Packer’s tabled amendments to Part 6 be agreed to.

💬 Hon Julie Anne Genter: Can I clarify which tabled amendment this is? I know one was ruled out of order but I didn’t hear which one was ruled out of order.

CHAIRPERSON (Hon Jenny Salesa): This is the tabled amendment deleting references to “research”. It’s her amendment to Part 6. So let me just begin that question again.

The question is that Debbie Ngarewa-Packer’s tabled amendments to Part 6 be agreed to.

The question is that Debbie Ngarewa-Packer’s tabled amendments to clauses 71 and 76 be agreed to.

Amendments not agreed to.

The question is that Part 6 as amended stand part.