Privacy scare spurs new IT system

The Government has backed away from moves to have organisations hand over the identifiable data of thousands of vulnerable clients, until a new computer system has been developed.

And responsibility for handling that data has been stripped from the Ministry of Social Development (MSD) and handed to the new Social Investment Agency, established earlier this year.

It follows a near privacy breach which saw the deputy chief executive of the MSD fall on his sword and resign last week.

An independent review found that in trying to fix an initial scare, the MSD revoked its own access to the IT system and its reinstatement resulted in even wider access being granted to prohibited parties.

The ministry began the process of establishing an interim database last year, to hold vulnerable clients data – right down to an identifiable level – in response to a new Government policy requiring non-government organisations (NGOs) to hand it over to remain eligible for Government funding.

The move garnered widespread opposition, from MPs, the Privacy Commissioner, NGOs, academics and unions alike – for fear it would result in some clients walking away from receiving help.

Yesterday, Social Development Minister Anne Tolley and Justice Minister Amy Adams said the Government would be advising social service providers that their new contracts would no longer require the collection of individual client level data until a new data protection and use policy is in place.

‘‘Our Social Investment approach is about intervening earlier to help change lives for the better. We want to be working alongside providers on ways data sources can help ensure our most vulnerable New Zealanders are getting access to the services that they need,’’ Adams said.

Tolley said it made sense for the new agency to handle the work around the data collection. The MSD would continue working with providers and building a new IT system. She predicted it would have lost about six months in terms of the rollout of the policy.

‘‘The Social Investment Agency will lead a working group with Statistics New Zealand and NGOs to agree on an approach to increasing the availability of data in a way that is scalable, and builds and maintains trust and confidence.

‘‘It makes sense for the Social Investment Agency to lead this work as the data we need to collect and analyse will be used by the wider social sector,’’ Tolley said.

‘‘An advisory group will provide oversight and lead the work to identify, evaluate and recommend a robust approach.

‘‘It will bring together a number of agencies, as well as the Government Chief Information Officer, the Office of the Privacy Commissioner, and independent data consultants.

‘‘The Ministry for Vulnerable Children, Oranga Tamariki will be writing to providers to advise them their July 1, 2017 contracts will not require the collection of data until the approach has been agreed and suitable IT systems are available,’’ she said.

’’We then intend to write to providers to agree a contract variation by the end of the current financial year.’’

Late last year, the MSD was forced to shut down an information-sharing portal after a privacy flaw allowed officials from one NGO which had a contract with the ministry, to view a folder that could have contained client data supplied by another.

Tolley called for an immediate review into the blunder, and the building of a new IT system.