Inquiry into the protection of personal information

18 February 2025

An inquiry into how government agencies protected personal information provided for Census 2023 and COVID 19 vaccination purposes.

On 14 June 2024, following a directive from the Prime Minister and the Minister for the Public Service, the Public Service Commissioner appointed Pania Gray and Michael Heron KC to conduct an inquiry into how government agencies protected personal information provided for Census 2023 and COVID 19 vaccination purposes (the inquiry) as set out in the terms of reference below.

The inquiry’s final report can be found below. The purpose was to establish the facts and provide an independent assessment of government agency activity in relation to allegations that personal data may have been misused during the 2023 General Election.

The inquiry leads were only able to make findings of fault in relation to the government agencies and, to the extent necessary to achieve the purpose of the inquiry, the relevant service providers. The inquiry identified a number of matters outside its scope. These have been referred to other authorities for investigation and consideration.

Key findings

The findings show significant failures by several agencies to protect personal information which created the potential for the possible misuse of Census data. These include:

failures at Statistics New Zealand in terms of their processes, safeguards, training and risk management procedures.
adverse findings at Ministry of Health and Health New Zealand in relation to information sharing agreements. Most information sharing agreements were sufficient, but there were few mechanisms by which agencies could assure compliance with the agreements or impose consequences for non-compliance. 
conflict of interest practices were inadequate and not up to the standard required.
concerns raised in agencies about these matters were not always adequately addressed.

Strengthening practices

Public Service Commissioner Sir Brian Roche has written to the six subject agencies to set out his expectations and seek their assurance that they are developing and rolling out plans for improving contract management, conflicts of interest management and information sharing practices. The plans will address the findings in the final report. The relevant agencies have already started work to address these findings.

In addition to this, the Public Service Commission is working with system leads to strengthen practices in procurement, conflicts of interest management and information sharing, and has reviewed and re-issued the conflicts of interest model standards.