Chief Statistician stands down after ‘sobering’ report into misuse of census information

Tuesday, 18 February 2025

The Government’s chief statistician Mark Sowden has quit after two damning reports into allegations that census data collected by Manurewa Marae was misused to help Te Pāti Māori’s election campaign.

And public service agencies have been barred from signing any new contracts, or extending agreements with the marae, Te Pou Matakana - now the Whānau Ora Commissioning Agency (WOCA) - and the Waipareira Trust.

The agency and the trust are headed by Te Pāti Māori president John Tamihere. The marae was formerly headed by the party’s MP Takutai Moana Natasha Kemp.

Stats NZ and the Public Service Commission commissioned two inquiries.

Neither were tasked with investigating whether the allegations were true: that’s the job of the police and Privacy Commission, which are now carrying out investigations. The Serious Fraud Office is also investigating.

The PSC inquiry led by former solicitor-general Michael Heron, KC, and Pania Gray, identified a number of flaws in how public service agencies protected personal information provided to third party contractors hired to help with the 2023 Census and a Covid-19 vaccination drive.

Sir Brian Roche, head of the public service, said the report made “for very sobering reading.” He said “the system has failed and that isn’t acceptable.”

It “must be, and will be, remedied,” he added.

“These are serious allegations that go to the integrity of our democratic process,” he said.

“The inquiry found some agencies fell short on their responsibility to protect and manage the sharing of personal information, which is unacceptable.

“While we don’t know if personal information was improperly used, the gate was left open.

“It will be for other authorities, with the appropriate regulatory and investigative tools, to determine whether personal data was misused.”

Roche confirmed Sowden has decided not to seek re-appointment as a result of the findings. His contract as acting chief executive ends on March 30.

This was “the right thing to do in the circumstances,” Roche said.

In a statement, Sowden apologised.

“It is unacceptable for people’s personal information to be misused in the way that’s been alleged, and absolutely unacceptable that we did not ensure that it could not happen,” he said.

“To the people of Aotearoa New Zealand, I unreservedly apologise.”

The inquiries were established after the Sunday Star-Times and The Post revealed allegations that census data and private information collected during the immunisation drive run out of the marae was used to help Te Pāti Māori’s general election campaign.

The marae was at the forefront of Auckland's vaccine roll-out, being one of the first sites to offer immunisations. It was then part of a Whānau Ora Commissioning Agency drive to promote last year’s census, between March and June 2023.

It then became a polling booth at the general election, a controversial decision because the marae’s chief executive Kemp was TPM’s candidate for Tāmaki Makaurau.

Kemp pipped incumbent Labour MP Peeni Henare to the seat by just 42 votes.

Tamihere is chief executive of Whānau Ora and chief executive of the Waipareira Trust. TPM has strenuously denied the allegations.

The PSC inquiry found Stats safeguards to protect personal information were insufficient and there was a risk it could be used for an “improper purpose”.

Concerns were raised early in the census process within the agency but not acted on. Risks of conflict of interest, privacy breaches and poor process were not dealt with.

Complaints made about the processes used by the marae and Whānau Ora were not dealt with.

Usual processes and safeguards were not implemented and a high trust model was “inappropriate”.

It also found:

– Health NZ, the Ministry of Health and Stats NZ were “unable to assure themselves” that service providers - including the marae, Whānau Ora, and the Waipareira Trust, a Māori urban authority that holds Whānau Ora contracts - were meeting privacy protections set out in information sharing agreements.

– there was an absence of controls for agencies to ensure the storage, use and disposal of data after transmission from the agencies to service providers

These two findings, along with allegations that the marae collected information from people receiving Covid-19 vaccinations, later used in a TPM text message campaign during the election campaign, and entered into a database owned by Waipareira Trust, were referred to the Privacy Commissioner.

All of these matters have been referred to the Privacy Commissioner.

The inquiry also found that the compulsory collection of personal information, when combined with a campaign, using incentives such as supermarket vouchers and well-being packages, to switch to the Māori roll but not the general roll, “need to be considered.”

Those matters are now being investigated by the police.

Roche has also written to the Justice Ministry and asked the agency and the Electoral Commission, to look at the issue of using incentives to encourage voters to switch rolls.

Included in the scope of the Public Service Commission (PSC) inquiry were the Ministry of Health, Health NZ, Te Puni Kōkiri, Oranga Tamariki, and the Ministry of Social Development.

The Electoral Commission was not included.

Roche has asked Stats, the Ministry of Health, and Te Puni Kōkiri to temporarily suspend entering into new contracts or renewals with the three service providers.

That’s until the PSC is satisfied the contracts are “fit for purpose” and can deal with information sharing.

Current contracts will be honoured.

Work on a new information sharing standard is under way and will be implemented by July, and conflict of interest “standards” were updated.

Stats’ inquiry, was headed by independent external investigator Doug Craig.

Craig’s report said the agency was under pressure to improve Māori census response rates, which were lagging behind expectations. It hired Whānau Ora to help.

But the procurement process diverged from standard government practices and was not openly advertised on the Government Electronic Tenders Service (GETS).

A formal conflict-of-interest register and a contract management plan were also not created.

The contract included obligations related to data privacy and confidentiality, but these were not adequately monitored, Craig found. And a Privacy Impact Assessment was not completed.

There was also minimal 'on the ground' monitoring by Stats NZ to ensure compliance, nor did it insist on a formal training plan for the Whānau Ora Commissioning Agency (WOCA) or marae staff.

Stats provided WOCA with daily updated Excel files containing address and location data for households identified as non-responding or partially responding to the census.

WOCA used this data, and combined it with their own datasets, to identify Māori households to target. Craig found that the intention to target Māori households, raised privacy concerns.

The contract allowed for incentives, such as supermarket vouchers, to encourage census completion, with up to $1 million allocated. This was a departure from Stats’ usual practice but was approved by the board.

“We have found that there have been failures in compliance with the requirements under the Data and Statistics Act 2022 in terms of Stats NZ’s disclosure of and oversight of how confidential and personal information would be managed and how Census forms would be handled,” the report said.

“We also consider our findings raise the potential that Stats NZ has not complied with the Privacy Act 2020. In particular, we have concerns that there may have been breaches of IPP 5 (relating to the storage and security of personal information) and IPP 10 (which places limits on the use of personal information for different purposes than it was collected for).”

Sowden confirmed “the investigation found Stats NZ failed to implement the safeguards and rules for ensuring privacy is protected and data secured.”

Although these were included in the contract with WOCA, to which Manurewa Marae was a sub-contractor, but were not fully enacted, he said.

“The allegations do not call into question the validity or quality of the 2023 Census data, but this is a serious situation for New Zealand,” Sowden said.

“It is clear our actions fell short of our own standards; we did not do enough to make sure people’s privacy was protected by our third-party providers, nor did we have the right processes in place to make sure concerns were appropriately escalated.

“We will ensure this does not happen again and are well on track to address the recommendations of the reports.”

Stats has now started a remediation programme with 33 specific actions which will see improvements to its policies, systems, processes and training.

Privacy Commissioner Michael Webster said the two reports show agencies “must be better at privacy”.

He said he is carefully reviewing the referrals raised in the two reports.

'New Zealanders need to be confident that when they do activities, like filling in their Census form, or giving over information for medical services, that their information is collected, used, and shared as the law outlines it should be,“ Webster said.

“The Privacy Act is very clear that agencies collecting personal information need to keep it safe and treat it with care. This responsibility extends to the use of third-party service providers.

Agencies need to be confident that personal information is protected wherever and whatever organisation is handling it.“

Late last year Chief Electoral Officer Karl Le Quesne told MPs on Parliament’s Justice Committee that the Electoral Commission failed to manage the perceived conflict of interest.