Two long-awaited reports into alleged personal data misuse, centred on census collection and Covid-19 vaccination efforts at Manurewa Marae, were released yesterday. Here’s what you need to know.

“Very sobering reading” was how public service commissioner Sir Brian Roche described his organisation’s long-awaited report into the alleged misuse of census and Covid-19 vaccination data, which will result in the chief executive of Stats NZ stepping down. The Public Service Commission’s report was released yesterday, as were the findings of a separate Stats NZ inquiry, eight months after allegations emerged that personal data collected at Manurewa Marae was misused to help Te Pāti Māori’s election campaign.

The PSC’s inquiry, commissioned by the prime minister and then public service minister Nicola Willis in June 2024 and carried out by Michael Heron KC and Pania Gray, centred around a slew of claims from marae whistle-blowers, reported on by Andrea Vance for the Sunday Star-Times over a number of months. The allegations included census documents being photocopied and a “winter wellness” QR code being used to “clandestinely” collect data. Manurewa Marae is an important pillar of South Auckland – it was one of the first places in Aotearoa to roll out Covid-19 vaccinations, and in 2023 was integral to reaching Māori communities for the census.

Te Pāti Māori MP Takutai Tarsh Kemp was chief executive of Manurewa Marae at the time the alleged misuse took place, and former marae staff have linked Kemp’s narrow win in the Tāmaki Makaurau electorate to misuse of data obtained from the vaccine rollout and the 2023 census, claiming those details were sent to Te Whānau o Waipareira Trust (whose chief executive is Te Pāti Māori president John Tamihere) and used to target voters in the electorate. Stats NZ had contracted Te Pou Matakana (also known as the Whānau Ora Commissioning Agency, which Te Whānau o Waipareira Trust is a shareholder in) in a last-ditch attempt to get census forms returned to boost the Māori turnout.

Kemp won Tāmaki Makaurau by just 42 votes over the incumbent, Labour’s Peeni Henare, who said the report was “long overdue”. “For people like myself and my team who have been caught in this sort of no-man’s land while waiting, the hope is that it will come to a conclusion whereby things get better into the future,” he said. Henare said he was waiting to read the report before holding hope for a byelection.

Roche called the report “a massive wakeup call”. “I’m surprised by a lot in this report,” he said. “There has to be a non-negotiable sense of confidence the public must have in us as a public service, and this has shown a systemic failure in one agency – that is one agency too many.”

Stats NZ chief executive and government statistician Mark Sowden, who is stepping down as a result of the inquiries, said, “It is unacceptable for people’s personal information to be misused in the way that’s been alleged, and absolutely unacceptable that we did not ensure that it could not happen.

“To the people of Aotearoa New Zealand, I unreservedly apologise.”

What did the reports find?

The PSC’s inquiry looked at the conduct of a number of government agencies – Te Puni Kōkiri, the Ministry of Health, Te Whatu Ora/Health New Zealand, Statistics New Zealand, Oranga Tamariki and the Ministry of Social Development – and the report laid blame primarily with Stats NZ, saying the agency failed to ensure its usual safeguards were in place to protect personal data against improper use. For the 2023 census, Stats NZ had enlisted the help of Te Pou Matakana (Whānau Ora Commissioning Agency/WACA) to help reach an extra 10,000 Māori households that Stats NZ had failed to get to.

The contract was “well-intentioned” and Stats NZ considered it “successful”, Roche said, with 40,000 census forms collected from Māori. However, concerns raised early in the organisation’s work with Te Pou Matakana around risks of conflicts, privacy breaches and poor processes were identified by Stats NZ but not managed. Concerns from Stats staff about Te Pou Matakana, Waipareira Trust and Manurewa Marae were “largely ignored”, Heron said.

Stats NZ provided information to Te Pou Matakana before understanding how it would be dealt with, failed to finalise a privacy assessment, failed to enact confidentiality protections or provide adequate training to Te Pou Matakana, the report found. 

In relation to Covid-19 vaccination data, the report also found the Ministry of Health and Health NZ had failed to enact any safeguards to identify or deal with the conflicts of interest from the sharing of personal health data with the service providers. 

The findings of the Stats NZ inquiry, led by Doug Craig, largely align with that of the PSC report, with the former going into greater detail about the risks inherent in contracting out sensitive and confidential census work. “The risks of this [contracting Te Pou Matakana] were amplified by the very short timeframes needed to establish a robust, fit-for-purpose delivery plan, risk management arrangements and oversight/assurance arrangements,” said the report.

Despite the damning findings, neither report confirms whether personal data was actually misused, saying that decision lies with other agencies. The Stats NZ report did find it was “more likely than not” census forms were photocopied and left unsealed, and that information entered into Te Pou Matakana’s database from Manurewa Marae was “derived directly from census forms”.

“While we don’t know if personal information was improperly used, the gate was left open,” Roche said. “It will be for other authorities, with the appropriate regulatory and investigative tools, to determine whether personal data was misused.”

Allegations that personal information collected from people receiving Covid vaccinations at the marae was used for a Te Pāti Māori text message campaign, and that census data was entered into a Waipareira database, have been referred to the Privacy Commissioner, said the PSC report, while the Stats NZ report said “the allegations of census data being allegedly misused for electoral purposes has been referred to the Police and Serious Fraud Office”. The Electoral Commission has made referrals to New Zealand Police and “is continuing to work with them on those matters”, according to the PSC report.

What’s changing as a result of the inquiries? 

Roche said the PSC report made it clear that “we need to raise the bar” on how government agencies handle personal data. One of the most significant outcomes of the inquiry is the departure of acting chief executive of Stats NZ and government statistician Mark Sowden, who will not seek reappointment when his contract ends on March 30. “His decision to step down reflects the standard of accountability expected of public service chief executives,” Roche said.

Agencies included in the inquiry have been asked to immediately suspend or refrain from entering into new contracts with third-party providers named in the report (Manurewa Marae, Te Whānau o Waipareira Trust and Te Pou Matakana). This is “until those agencies can satisfy me that their contracts are fit for purpose and adequately deal with the information sharing and conflict of interest obligations”, Roche said.

A new information-sharing standard is being developed for agencies to adopt by July 1, and all third-party entities will now be required to meet obligations around conflicts of interest and sharing of personal information before entering into contracts, said Roche.

The commission has also asked the Ministry of Justice to consider changes to electoral law regarding financial incentives encouraging people to switch from the general roll to the Māori roll or vice versa. This relates to allegations that at Manurewa Marae, supermarket vouchers, food parcels or wellness packages were given to encourage the completion of census forms or electoral forms to switch rolls. “I would like to think this is an isolated incident,” Roche said.

The recommendations in the Stats NZ report mostly cover requirements to strengthen its protection of personal data, and to follow its own guidelines and safeguards. These include a requirement for Stats NZ to complete certificates of confidentiality before data is shared, and positive assurances including physical inspections should occur.

Future census operations are required to keep a log of all concerns and complaints relevant to the handling of the census, and future decisions from Stats NZ to outsource their work should include a risk assessment that includes reputational risk to the organisation and its suppliers.