Stats NZ head to step down after inquiry into census and vaccination data misuse

Tuesday, 18 February 2025

Stats NZ had insufficient safeguards while the Ministry of Health and Health NZ had no safeguards to protect against conflicts of interest, a damning inquiry into the use of Census and vaccination information by the Public Service Commissioner has found.

Sir Brian Roche, the public service commissioner, released the findings of the inquiry led by Michael Heron KC and Pania Gray on Tuesday. It could not determine if personal information was improperly used, but uncovered a raft of issues relating to how personal information was shared.

“It raises a number of issues that go to the core of the confidence and trust required to maintain the integrity and sanctity of information entrusted to government agencies,” Sir Brian said.

“The system has failed and that isn’t acceptable - and it must and will be remedied.”

Stats NZ commissioned its own independent inquiry, in light of the claims It released a separate independent report, which outlined 33 recommendations as a result of the findings.

Its chief executive, Mark Sowden, will not seek reappointment once his contract ends on March 30, as a result of the inquiry.

Prime Minister Christopher Luxon in June said the Public Service Commission would launch an independent inquiry following allegations Te Pāti Māori misused private data during the 2023 election.

At a high level, the allegations were that personal information collected for the 2023 Census was used for an improper purpose or purposes by a service provider, that personal information collected for vaccination purposes during the Covid-19 pandemic was used for an improper purpose or purposes by a service provider, and that relevant government agencies were made aware of the allegations above, prior to the media reporting, and did not take appropriate action.

The third party agencies involved - Whānau Ora Commissioning Agency, Te Whānau o Waipareira Trust and Manurewa Marae Trust Board - have strenuously denied the allegations.

Takutai Moana Natasha Kemp, who won the Tamaki Makaurau seat for Te Pāti Māori, was the chief executive of the Manurewa Marae, while John Tamihere is the chief executive of the Waipareira Trust and Te Pāti Māori president.

The three charities were also critical in boosting Māori vaccination rates during the pandemic and encouraging Māori in Auckland to complete the last Census.

But the Commissioner has asked Health NZ, Ministry of Health and Te Puni Kokiri to not enter in to any new contracts - or renew or extend any existing ones - with Whanau Ora Commissioning Agency, Manurewa Marae, and Waipareira Trust until the providers “can satisfy the Commissioner that their contracts are fit for purpose and adequately deal with information sharing and conflict of interest obligations”

The inquiry found Stats NZ failed to safeguard personal information, creating the risk information provided to or collected by Whānau Ora Commissioning Agency could be used for an improper purpose.

It also failed to implement the safeguards in the contract for services, allowing the potential for census data to be mishandled.

On vaccinations, it found the Ministry of Health and Health NZ had no safeguards in place for addressing the possibility of conflicts of interest arising from sharing personal health information with the service providers.

The Ministry and Health NZ did not assure themselves that the relevant service providers were meeting contractual expectations, and there were no controls over files once they were downloaded by the providers’ authorised staff, according to the inquiry.

The inquiry also referred a number of other important matters. which it wasn’t able to consider because it was out of scope, to other relevant authorities, such as the Office for the Privacy Commissioner.

This includes the finding the Ministy, Health NZ and Stats NZ were unable to reassure themselves the relevant service providers were meeting the privacy protections set out in its agreements, an allegation Census information collected at Manurewa Marae was entered into a database owned by Waipareira Trust, and that Manurea Marae collected personal information for a Te Pāti Māori text message campaign.