The Privacy Commissioner, John Edwards, says a Ministry of Social Development (MSD) policy requiring social service providers to disclose information about all their clients is excessive and disproportionate.
The Privacy Commissioner’s report, Inquiry into MSD Collection of Client-Level Data from NGOs, examines the privacy impact of the funding contracts. The new contracts make the provision of personal, identifiable, client data a requirement for receiving government funding, with no ability to opt out.
Mr Edwards acknowledged that “no NGO receives government funding as of right, and it is not only legitimate but important that Government takes steps to ensure the efficacy of any programme it funds. It needs good information in order to do so.”
However, the report finds that there has been insufficient consideration given to the possible unintended consequences of the policy change, and insufficient consideration of alternative means of achieving Government’s legitimate aims without risking those consequences.
“There is a real risk that the new arrangement will deter some people who are most in need from seeking support or assistance. Not only could that put those people at further risk, and increase pressure on the NGOs, the ultimate result could be that those individuals become “invisible” to Government and policy makers,” says Mr Edwards.
Privacy risks
The Commissioner’s report identifies three main privacy risks from collecting information this way:
- Individuals may choose to stay away from seeking help at all – leading to worse outcomes for individuals and society as a whole,
- Individuals may choose to provide incorrect information in order to preserve their privacy – leading to inaccurate or useless data for analysis
- NGOs may allow those clients who are reluctant to have their sensitive information given to MSD to access services without providing their personal information – leading to reduced funding and risks to NGOs’ long-term viability and the “invisibility” to the system of a significant cohort of individuals in need of support.
Lack of clear purpose for collection
The Commissioner says one of the report’s main findings is that MSD has not clearly explained its purpose for requiring individual client information.
Mr Edwards says NGOs have reported to them that MSD has not been able to definitively say what the client level information will be used for, who it will be disclosed to, and more importantly, what kinds of potential future uses will be ruled out.
He says he would like to see MSD explore less privacy-invasive means of achieving government’s legitimate objectives. One of the options that warrants further thought would be to have Statistics New Zealand receive the information, and provide the analysis to the ministry on an anonymised basis.
“My expectation is that data requirements for funding purposes should have sufficient flexibility to enable people to access services safely and not be deterred from seeking help or support - and thereby be put in greater harm - because of a concern about the confidentiality of the visit.”