The damning PSC report

The Public Service Commission has released its report around alleged misuse of information by three entities and the findings are damning. Two major outcomes are:

• The Government Statistician has decided to not seek re-appointment and ends his contract on 30 March.
• the Commissioner has asked Stats, the Ministry of Health, Health NZ and Te Puni Kōkiri to temporarily suspend entering into new contracts, renewals and/or extensions of contracts with the three third-party service providers named in the report.

The providers are Te Pou Matakana, Waipareira Trust, and Manurewa Marae, who are all heavily inter-related.

Some of the findings include:

• Te Whatu Ora has not yet obtained satisfactory assurance from Te Pou Matakana and Waipareira that they have each complied with the terms of their respective DSAs. As a result, Te Whatu Ora and we are unable to conclude on how effective the safeguards and institutional arrangements have been for personal health information shared for COVID 19 vaccination purposes.
• The Ministry of Health and Te Whatu Ora had no safeguards in place for identifying and managing the possibility of conflicts of interest arising from the sharing of personal health information with the relevant service providers
• Several concerns about the management of personal information were raised with Stats, both by internal and external parties, including while the contract with Te Pou Matakana was being performed. The complaints raised by internal Stats employees were largely ignored. 
• Stats removed the requirement for Certificates of Confidentiality, a key requirement to ensure the protection of Census data.
• When concerns surfaced publicly about the relevant service providers using personal information, shared by government agencies, for improper purposes, the providers all swiftly refuted the allegations. However, none of the agencies were able to draw on their existing assurance systems to respond to the allegations. This is problematic.
• we received details of an allegation of unauthorised use of personal information by Manurewa Marae – collected at the point of vaccination – for a Te Pāti Māori text message campaign in the weeks leading up to the General Election. As these allegations are outside the Inquiry Terms of Reference, we have referred them to the Privacy Commissioner for his consideration.
• Te Pou Matakana and Waipareira have told us that the personal information they collected was entered into a database owned by Waipareira, and it was clearly distinct from Census data (i.e. the information entered into the Census forms by whānau). This distinction was not always observed at Manurewa Marae.
• Aspects of this matter are the subject of an ongoing investigation by New Zealand Police.
• We have heard conflicting accounts about what happened with completed Census forms at Manurewa Marae – we have been told that they were sent to Stats each day and that unused or partially completed Census forms were destroyed. We have also been told that the forms were photocopied and then posted to Stats or entered online and still retained. There is no unified view as to why Census forms were retained at the Marae, where they were kept and for how long.

You have to wonder if any other contractors were allowed such lax access to government data, with few controls.