An inquiry ordered by the Prime Minister has identified significant failures with public agencies’ protection of New Zealanders’ personal information and management of conflict of interests.

The findings are so serious for Stats NZ that chief executive Mark Sowden will leave at the end of his current term, something Public Service Commissioner Sir Brian Roche says is “the right thing to do”.

Sowden, the Government Statistician, won’t seek reappointment when his contract ends on March 30.

“His decision to step down reflects the standard of accountability expected of public service chief executives,” Roche said.

The investigation – which focused on public agencies’ actions – was sparked by allegations last year that data provided to health and social services providers at Manurewa Marae for the purposes of Census 2023 and Covid-19 vaccinations was misused.

It was claimed personal information was improperly used to favour Te Pāti Māori in the Māori electorate of Tamaki Makaurau. Those allegations have been denied by those involved, but the Government wanted assurances Kiwis’ data had been adequately safeguarded by the agencies that shared it.

Among the findings of the 73-page report from Michael Heron KC and Pania Gray is that the Ministry of Health (MoH) and Health New Zealand Te Whatu Ora didn’t have control over data once downloaded by providers, had no means for ensuring providers were meeting contractual expectations, and had no safeguards for managing potential conflicts of interest.

Stats NZ was found to have “insufficient” arrangements to protect the shared data. Among these was the removal of a requirement for confidentiality without any officials with the power to remove this requirement agreeing to that action. A privacy assessment was also not finalised.

“This is a significant failure in the context of the personal information shared,” the report says.

Manurewa Marae. Photo / Te Ao Māori News

The agency also “largely ignored” internal staff concern about the management of information and didn’t adequately consider conflict-of-interest provisions.

“As a result, there was a risk of the collection or use of personal information for an improper purpose due to this combination of factors,” the report said of Stats NZ.

While it wasn’t the role of the inquiry to conclude whether a conflict of interest existed, it said the context of the situation “should have led to Stats engaging the conflict-of-interest procedures”.

The inquiry said a “possible conflict of interest is alleged to arise” given some key officers of the providers were also either officers or candidates for Te Pāti Māori. Providers were also involved in electoral work at the same time as Census activity.

“Te Pāti Māori submitted ... that Māori participation in electoral politics alongside community mahi empowering whānau Māori should not be regarded as giving rise to any appearance of a conflict of interest,” the report said.

“In our view, however, the failure to properly identify and manage possible conflicts gave rise to the very allegations that initiated this inquiry.”

When the allegations were made about information being misused, the providers “swiftly refuted the allegations”, but none of the agencies were “able to draw on their existing assurance systems to respond to the allegations”.

“This is problematic,” the report says.

The MoH and Health NZ have accepted the findings, with the latter working to revise its protocols to ensure conflicts of interest are actively considered. Stats NZ has been undertaking its own independent investigation.

The specific allegations – such as that providers improperly used the data – were out of the scope of the inquiry. Some were referred to the Privacy Commissioner, while another remains under investigation by police.

Roche said the report made for “very sobering reading”.

“It raises a number of issues that go to the core of the confidence and trust required to maintain integrity and sanctity of information entrusted to government agencies.

“The system has failed and that isn’t acceptable – and it must be, and will be, remedied.”

As well as the decision for Sowden to not seek reappointment, the Public Service Commission said a number of actions were being taken in response to the report.

That includes some public agencies, including Stats NZ, the MoH and Health NZ temporarily suspending entering into new contracts, renewals, or extensions with the three providers.

A statement said that pause will last “until those agencies can satisfy the commissioner that their contracts are fit for purpose and adequately deal with information-sharing and conflict-of-interest obligations”.

“All current contracts will be honoured to ensure services continue to be delivered as normal. The suspension only applies to contracts that are new or being renewed or extended with [the providers]. It doesn’t apply to any subsidiaries or related parties.”

Work is also under way on a new information-sharing standard, which will be implemented by July 1. The commission’s conflict of interests model has also been reviewed and updated.

“This means all third-party entities who enter into contracts or information-sharing agreements with core public service agencies will need to meet obligations around conflict of interest and sharing of personal information.”

The Ministry of Justice will also be asked to consider changes to electoral law regarding financial incentives to switch electoral rolls. This relates to one of the specific allegations made.

Prime Minister Christopher Luxon and former Public Service Minister Nicola Willis ordered the inquiry last year. Photo / Mark Mitchell

Background to the report

The Public Service Commission (PSC) inquiry was ordered by Prime Minister Christopher Luxon and then-Public Service Minister Nicola Willis in June last year.

That followed the emergence of allegations that personal information obtained by providers linked to Manurewa Marae was used improperly, including for electoral purposes.

Te Pāti Māori’s candidate in Tamaki Makaurau, Takutai Tarsh Kemp, was also the chief executive of the marae at the time and won the seat by just 42 votes over the incumbent, Peeni Henare of Labour.

The inquiry considered six government agencies – Te Puni Kokiri (TPK), the Ministry of Health, Health NZ, Statistics New Zealand, Oranga Tamariki (OT) and the Ministry of Social Development (MSD) – each with links to specific service providers.

Those service providers were Manurewa Marae, Te Whānau o Waipareira (Waipareira), and Te Pou Matakana, formerly known as the Whānau Ora Commissioning Agency (Woca). Waipareira and the Woca provide health and social services to whānau.

There are a number of overlaps between these providers, including John Tamihere being the chief executive of Waipareira and the WOCA (he’s also the president of Te Pāti Māori), Waipareira being a shareholder in the Woca, and the Manurewa Marae being contracted by the Woca to lift Māori and Pasifika rates of Census completion.

Importantly, the inquiry’s scope was limited to making findings in relation to the government agencies and, in some circumstances, the relevant service providers. It was not to establish any type of liability or to draw conclusions about the credibility of the allegations.

“We have been careful ... that we limit our assessment of the appropriateness of arrangements and actions to that of the agencies,” the report says.

The inquiry took place in parallel to others, including investigations by Stats NZ and the Electoral Commission.

The public release of the report has been repeatedly delayed, partly for natural justice purposes. After being pushed back several times at the end of last year, a press conference was scheduled to be held in early February, but that too was postponed just hours after being called.

Sir Brian Roche became the Public Service Commissioner while the inquiry was under way. Photo / Marty Melville

Key findings

Ministry of Health and Health NZ

While the report makes findings about each of the government agencies it looked at, the primary focus is on the MoH, Health NZ and Stats NZ. These are the agencies which shared personal information with the providers for the purposes of lifting Covid vaccination and Census response rates.

The report says the MoH and Health NZ shared information with providers pursuant to data-sharing agreements (DSAs) and providers’ staff accessing the national immunisation database.

“The terms of the DSAs adequately and appropriately set out the expectations of the parties. There is a range of safeguards operating over personal information held in the national immunisation database.”

However, the agencies didn’t have the means for assuring themselves the providers were meeting those expectations, the inquiry found.

“The validation checks applied by the agencies did not relate to the systems and controls of the service providers for the receipt, storage, use and disposal of data. Health officials advised us that there were no controls operating over the files once they were downloaded by the providers’ authorised staff.”

The report says that lack of “back-end” controls was “concerning”.

The DSA relied on “high trust and commercial incentives as safeguards”, which has “not provided satisfactory reassurance here”.

Health NZ is also yet to receive “satisfactory assurance” from the Woca or Waipareira that they “complied with the terms of their DSAs”, the report says.

“As a result, Te Whatu Ora and we are unable to conclude how effective the safeguards and institutional arrangements have been for personal health information shared for Covid-19 vaccination purposes.”

The report also says neither the MoH nor Health NZ had safeguards in place for identifying or managing potential conflicts of interest that could arise from sharing the information with third parties. The MoH thought this would be managed by TPK, but TPK “did not consider that this was their sole responsibility”.

Both the MoH and Health NZ accepted the findings. Health NZ halted its supply of personal information to the Woca under the DSA in June last year, when the allegations emerged. The agency also now has work under way to revise its DSA terms, including monitoring the use of information shared with providers and ensuring conflicts of interest are actively considered.

The inquiry referred to the Privacy Commissioner the allegation that personal information collected at Manurewa Marae when people visited to receive their Covid vaccination was then used for another purpose, including for a Te Pāti Māori election campaign.

Health NZ came under the microscope. Photo / 123rf

Stats NZ

Stats NZ provided unit-level dwelling data for households that hadn’t yet responded to the Census in the South Auckland area. It was understood this information would then be combined with data held by the Woca to identify Māori in those households.

The agency believed this qualified as personal information and was shared under an information-sharing agreement and a contract of services. These contained safeguards and protections on the data.

However, the inquiry report says Stats NZ did not action some of these key safeguards, including Certificates of Confidentiality, which would have imposed a lifelong statutory obligation of confidentiality on their signatories, a breach of which would be a criminal offence.

While Stats NZ “apparently made some attempts at drafting the Certificates, these were never finalised nor provided to [the Woca]”, the report says.

“It has been difficult for us to conclude why Certificates of Confidentiality were not signed by all relevant kaimahi [employees] carrying out Census activity under the contract.”

The report explores potential reasons for this, including the Woca saying Stats NZ waived the need for the certificates because its staff already had processes in place to deal with personal information. Stats may have “erroneously” conflated the certificates with training, the report says.

The lack of the certificates is “unsatisfactory”, the report says, and the only personnel who could “descope” the need for them was the Government Statistician or his delegates. The inquiry found no evidence that these senior officials agreed to this or actioned it.

“We are unsure why anyone else would have considered they had the power to ‘descope’ this requirement,” the report said.

“Of greater concern, in our view, is the impact of the failure to execute these on public perception and trust and confidence. The Certificates of Confidentiality are a part of Stats’ branding and they are referred to on the Stats website in the section ‘How we look after your data’.”

Census information was shared. Photo / Bevan Conley

The inquiry also found there was inadequate training for Woca staff dealing with the information and a Privacy Impact Assessment was not finalised, meaning “insufficient attention was paid to the management of processes and data”.

“As a result, it appears to us that Stats did not have [a] unified view of how the personal information was being shared or processed and the associated risks,” the report says.

“Importantly, the Stats Privacy Team had not provided any recommendations on how to manage those risks. This is a significant failure in the context of the personal information shared.”

One of the allegations that had been made was that Census forms were photocopied by staff at Manurewa Marae.

The report says the Woca and Waipareira said they expected staff to put completed Census forms in sealed envelopes in the presence of whānau and place them in the nearest post box, but it was “without any contest” that forms were returned to Manurewa Marae “for some period”. The length of that period is disputed.

There were conflicting reports about what happened to these forms at the marae, including the allegation some were photocopied.

One staff member at the marae said they were “retained to facilitate Waipareira’s reporting requirements”. The Woca and Waipareira said information separate from the Census data was entered into a Waipareira database.

“We saw evidence that this distinction was not always observed at Manurewa Marae. We have referred this matter to the Privacy Commissioner for his consideration.”

Waipareira Trust chief executive John Tamihere. Photo / Mike Scott

The report highlighted that Stats NZ employees raised concerns internally about the use of the Census forms. These were “largely ignored”, while Stats dealt with external concerns “as best as it could in the circumstances”.

“Stats’ failure to respond to these allegations in an appropriate and timely manner is concerning in the context of a nationwide, mandatory data-gathering event. Responses to the Census comprise both important and sensitive personal information.

“We expected that any suggestion that the Census activity was not being carried out with the care and diligence required would be investigated thoroughly.”

While Stats NZ’s contract contained a conflicts of interest clause, it was not clear to the inquiry how much consideration was given to these terms and “there is no evidence that they were engaged by either party”.

The inquiry found there was a possibility for a conflict of interest to arise, especially given the overlaps between the providers and Te Pāti Māori, and the providers engaging in electoral work.

“This introduced the potential for personal information to be collected under one process (Census) and used for another (electoral),” the report says.

It emphasised the inquiry was not finding a conflict of interest existed, but setting out the “context and possibility that should have led to Stats engaging the conflict-of-interest procedures in the contract”.

Both the Woca and Waipareira deny Census data was used for electoral purposes. The providers, as well as Te Pāti Māori, also submitted there was no conflict of interest and the inquiry was not empowered to find one.

“Irrespective of this submission, we find that there were connections and interests (as already noted) which should have been disclosed to Stats and considered by Stats as part of the contractual process,” the inquiry report says.

“Though the connections and interests were publicly available, we did not see notification from [the Woca] to Stats of the electoral enrolment activities it intended to carry out and acknowledgement of the interests its personnel has in such a process (as required under the contract).”

A diagram is included in the report highlighting the large number of connections between different, unnamed individuals, the providers and Te Pāti Māori. One of the individuals is clearly Kemp, noted as at the time as being a Te Pāti Māori candidate, the chief executive of Manurewa Marae and director of the Woca.

“The multiple and overlapping interests of the persons involved on the service provider side should have given rise to Stats needing to be clear about its expectations relating to the identification and management of actual, perceived and potential conflicts.”

The report says the existence of a conflict wouldn’t have precluded Stats from contracting the Woca, but the failure to identify and manage possible conflicts gave rise to the allegations at the heart of the inquiry. A concern raised by a Stats employee about the possibility of a conflict was also not responded to by the agency.

Whether the Census data was used for improper purposes, such as to help in the election, has been left the police investigation under way.

Separately, the Electoral Commission has previously accepted it failed to manage the perceived conflict of interest arising from using Auckland’s Manurewa Marae as a voting base in the 2023 election when the marae’s chief executive was standing as a candidate.

Jamie Ensor is a political reporter in the NZ Herald Press Gallery team based at Parliament. He was previously a TV reporter and digital producer in the Newshub Press Gallery office.