One of the aims of the Privacy Act was to regulate government use of information matching. The Act prevents unauthorised disclosure, so any government use for (for example) seeing if people on the electoral roll are citizens or residents and so qualified to vote requires specific statutory authorisation. There's a lot of statutory authorisations littering the books, and the Privacy Commissioner is required to review them every five years to see if they're still necessary. And it turns out that a pile of them aren't just unnecessary, but have never been used:
Privacy Commissioner John Edwards is recommending the repeal of 22 government information matching provisions, after a report showed many of them were never used.
Mr Edwards says information matching provisions are enacted by Parliament to allow the sharing of information in ways that would otherwise breach the Privacy Act’s information privacy principles.
“I am concerned these exceptional powers have been sought by officials, agreed to by Ministers, enacted by Parliament, and then never used. It shows up a weakness in the system and demonstrates the importance of having robust policy development procedures in advance of enacting such provisions.”
Mr Edwards says the unused information matching provisions did not deliver their intended benefits to society and continuing Parliamentary authorisation of these privacy intrusive measures was unjustified.
It seems that government agencies have a bad habit of demanding statutory authorisation for intrusive database trawls, making big claims about how vital it is and how the sky will fall if they don't get these powers, and then never using them. Which undermines not just privacy, but also trust in government. The Commissioner is right: these intrusive and entirely unnecessary provisions need to be repealed. But beyond that, Parliament needs to provide much greater scrutiny of such demands in future, and only grant them where there is a clear and urgent requirement for information sharing. MP's giving agencies intrusive powers "just in case" is not fulfilling their basic duty to protect the privacy and human rights of New Zealanders.
The Commissioner's full report can be read here.
