Marae whistleblowers backed by damning data breach inquiry

Tuesday, 18 February 2025

A damning inquiry into the misuse of personal information has found “it was more likely than not” census forms were photocopied and left unsealed.

Two investigations were launched after The Post and Sunday Star-Times revealed allegations that data collected by Manurewa Marae on behalf of Stats NZ and other government agencies was later used to help Te Pāti Māori’s election campaign.

Takutai Moana Natasha Kemp was the marae’s chief executive until she entered Parliament as a Te Pāti Māori (TPM) MP in 2023, after narrowly beating incumbent Labour MP Peeni Henare by only 42 votes in the Tāmaki Makaurau race.

The urban marae was part of a Whānau Ora Commissioning Agency (WOCA) drive to promote the 2023 census and a Covid-19 vaccination drive. It then became a polling booth at the general election.

John Tamihere is both TPM president and chief executive of WOCA. TPM strenuously denies the allegations it misused personal information.

Marae staff-turned-whistleblowers came forward with the claims last year, sparking a government inquiry commissioned by the Public Service Commission and a separate review by Stats NZ, led by former deputy state services commissioner Doug Craig.

Craig’s review, released on Tuesday, said the whistleblowers told him marae management instructed staff to use paper, rather than online forms, when helping people to complete the census and to leave the supplied envelopes unstuck.

Workers were told this was so they could receive a bonus payment of $100 per form. But they suspected the information was being copied into an Excel spreadsheet run by the WOCA.

This instruction was contrary to Stats NZ policy and confidentiality processes, requiring paper census forms to be sealed in front of the individual and placed immediately in the nearest post box.

Training material from WOCA said: “All sealed envelopes need to be placed in the nearest post box once you have done your quality control against your Whānau Ora engagement records.”

Craig concluded the excerpt from the training material suggested “forms would not be sealed straight away”.

“We consider it more likely than not that unsealed envelopes were returned to Manurewa Marae. The marae itself accepts that unsealed envelopes were returned in the final weeks of the contract.”

The whistleblowers also described how census forms were photocopied at the marae in the early days of the census collection process, as part of information gathered for a winter health campaign.

Later, WOCA introduced an online reporting tool and associated QR code.

According to the whistleblowers, this reduced the need for time intensive photocopying of census forms, Craig said.

Manurewa Marae contested these allegations, saying that no census forms were copied, to its knowledge, Craig said. On balance, it was “more likely than not” some photocopying of census forms occurred, particularly in the early phases of collection.

“We think it is more likely than not that, at least on some occasions, the information entered into WOCA’s database from Manurewa Marae (whether entered through the QR code or by means of the earlier Excel spreadsheet entry process) was derived directly from census forms.”

Whistleblowers also claimed they observed “open census forms being stored insecurely for many weeks”.

A Stats NZ staff member also raised concerns about finding boxes of completed census forms at the marae after the contract finished.

This was reported to a manager, a director and WOCA, but “was not sufficiently responded to or investigated in detail at the time”.

Craig wrote: “While there is insufficient evidence to be definitive about the level of retention of census forms by Manurewa marae, we think it is more likely than not that, at least to some extent (and particularly for forms collected after 19 June 2023), census forms were retained beyond what was allowable under Stats NZ policy.”

He said evidence raised “the probability of significant volumes of census forms being held on the marae as late as June 2024”.

The report also raised concerns about the security of information collected for the census.

“Whistleblowers advised us that census forms were kept in large volumes in unsealed envelopes in areas accessible to significant numbers of people,” it said.

“They allege that these forms were not locked away or stored securely. We note that the whistleblowers provided a number of photographs supporting their allegations that census forms were not stored securely.”

The marae claimed forms were kept in a locked room “on the rare occasion that census forms were not able to be sent”.

However, this was contradicted by a photo provided by the marae, which shows census forms sitting in trays in what appears to be an open area, Craig noted.

“This creates significant risks to the reputation and integrity of the census collection, albeit in the context of a relatively small number of forms (approximately 1800 versus 4.5 million census returns received by Stats NZ).

“On this basis, we believe that the management of census information, including personal information and census forms collected by the Manurewa Marae, was not undertaken in a manner that was consistent with the Data and Statistics Act 2022 and raises issues about the management of personal information … nor was it consistent with the contract between Stats NZ and WOCA,” the review said.

Craig’s inquiry also found there was a lack of staff training by both Stats NZ and WOCA. Monitoring arrangements were weak, and confidentiality certificates were not signed, he said.

The 73-page report from the public service inquiry, led by Pania Gray and Michael Heron, KC, found the Ministry of Health (MoH) and Health New Zealand Te Whatu Ora shared personal information with the marae, WOCA, and the Waipareira Trust, also run by Tamihere.

The staff of those organisations were able to access national immunisation databases. But neither MOH nor Health NZ had control over that data once it was downloaded by providers.

They had no way to ensure providers were meeting contractual expectations, nor were there safeguards in place to manage potential conflicts of interest, the report found.

This was complicated by a court case in which WOCA requested all the data on unvaccinated Māori in the North Island, including a National Health Index number, name, demographics, contact details and vaccination status. The High Court ordered it be provided in August 2021.

The report said MOH’s due diligence on WOCA was “light touch”. An agreement signed between the health agencies and WOCA had a number of privacy and security obligations, but did not allow use of the data to be verified or audited. This was “not appropriate”, the report said.

It also found there was an absence of controls for agencies to ensure the storage, use and disposal of data after transmission from the agencies to service providers.

Stats NZ provided information about households to WOCA “before it understood how the information would be dealt with, handled, protected and destroyed”, Gray and Heron’s report found.

It also removed a requirement for confidentiality certificates ‒ “a key requirement to ensure the protection of census data”. Nor did it finalise a privacy impact assessment nor provide training.