It's on the record: you can be bought

Every year the amount of information Government departments and agencies hold about you gets larger. EUGENE BINGHAM looks at what they know and who they tell.

As you read this, information about you and your property garnered from a Government list is for sale for 30c on an Australian website.

Soon your tax details and benefit information could be available to foreign governments, beginning with the Dutch.

And you will be tracked down through official records to make sure you do not escape from the electoral roll.

All of this is perfectly legal.

Make no mistake: if Big Brother exists, he lives in Wellington.

The biggest collection of personal information about New Zealanders is controlled within a few square kilometres of the Beehive. Through numerous laws, and for many sound reasons, Government bureaucrats are empowered to demand, retain and pass on information about you, where you live and what you do.

Your name will be routinely held on the databases of about 20 Government departments and agencies. You could also appear on up to 43 public registers which anyone can dip into to find out when you were born, how much you paid for your house, and details about your driver's licence and your dog.

Some of the information is even for sale in bulk: two state-owned businesses make money by selling details of your private life to commercial companies.

Departments maintain strict policies about data control to ensure it should not fall into the wrong hands, but senior officials admit that a "probability" of confidential information being misused exists.

At least one major investigation into the corrupt selling of client details by employees of a Government department is under way.

When it comes to selling data, though, the odd unscrupulous civil servant slipping names to rogue debt collectors is small-fry. Infinitely more information about you changes hands through legal transactions.

New Zealand Post has become adept at gleaning highly valuable information from its customers and marketing the lists, while the crown-owned company Quotable Value (QV) has staff dedicated to the selling of its database. Both organisations are acting within the Privacy Act.

Right now, an Australian company that specialises in data-broking has lists from NZ Post and QV for sale over the internet.

The Sydney-based company, Direct Media, has operated in New Zealand for about 10 years dealing mainly with private companies such as magazine publishers prepared to sell their customer lists to marketing firms or merchandisers.

But it also has high praise for the quality of data available from NZ Post and QV.

Direct Media's internet site has this to say about QV's data: "This database, now available for rental, provides information on more than 1.5 million properties, including 1.2 million residential properties. The database consists of personalised, gendered, target market-focused and accurate consumer records and is foremost in its field."

It costs $300 for 1000 records, plus a selection fee of $200. The information is available on a disk, e-mail or on labels and can only be used once.

NZ Post has two lists available through the internet site, "Hot Leads" and "Rural Post NZ."

Both lists are compiled from voluntary surveys filled out by customers about their product and service preferences.

It also sells another list of people who have recently moved houses. People end up on this list when they fill out a change of address form at the Post Office. The form states clearly that the information will be passed on to others and a bold box invites people who do not wish to be on the list to write no.

Direct Media's Jeff Brooks told the Weekend Herald his company was very careful about who it sold information to and required them to sign legal documents to protect against the misuse of data. It took security precautions such as seeding the lists with false names to ensure there was no unauthorised use.

"We only sell lists where the list-owner has done whatever is required of them under the Privacy Act," said Brooks.

His company discouraged direct marketers from taking a scattergun approach and tended to sell lists that targeted specific potential consumers.

"Where we fit in is really using names of people who do have a predisposition, who are on lists and who enjoy being on them."

QV is able to sell the national property database information - details about property owners, previous owners, purchase price and valuation - because it is a public register and therefore publicly available.

The general manager of QV on-line, Mary McKnight, said the information was generally sold to financial institutions, insurers, valuers and real estate agencies as well as Government agencies such as the Earthquake Commission.

"The different agencies and customers use the data differently. Insurance companies might use it to assist in the assessment of a property insurance quote or to profile their customer base, valuers and real estate agents use [it] to assist in valuations or setting a sales price."

QV had a code of practice that it required "key parties" to sign. The code was designed to prevent the misuse of the database and to ensure that it was used for fair and ethical purposes.

Companies and agencies listed as "key parties" to the code include the Consumers Institute, Baycorp, NZ Post, Moore Business Forms, Datamail, EQC, the Property Council and Headway Systems.

McKnight said QV fielded "the odd call" from property owners who did not want to be on direct marketing lists. In that case, their names were deleted from any lists sold to direct marketers. The Direct Marketing Association was also informed so the person's name went on the association's "do not send" list.

QV also had the ability to hide someone's name on the database if they were in physical danger. "We can protect individuals by enforcing the Domestic Violence Act should this be required by the courts," said McKnight. "If someone needs protection, QV has the capability to place a blanket on any information relating to [that] person."

With 42 other registers available to the public through the Government and local councils - from the national register of driver licences, to company records, the electoral roll, building permits and registers of births, deaths and marriages - Privacy Commissioner Bruce Slane has campaigned for access to be tightened. He wants the bulk release of public registers banned.

He argued that laws compelling people to provide certain private information should not be abused by companies seeking commercial gain through the use of that information.

Debate flared three years ago when the Office of the Ombudsmen ruled that QV's predecessor, Valuation NZ, had to comply with an Official Information Act request from an Australian direct-marketing firm. Laws controlling each of the public registers also specify the extent to which they should be available.

"I believe the time has come to reassess the appropriateness of freedom of information legislation's intervention in public registers," Slane said. "I support open government and the aims of freedom of information legislation, but the current use of it to upset any balance established in the public register provisions in particular statutes ... is undesirable. The use of freedom of information to force bulk release of public register information is out of step with the privacy climate in New Zealand."

Opponents, including leaders of the media industry, have argued that public interest considerations should be carefully balanced before any changes are enacted. Fundamental principles behind the establishment of the registers should not be overlooked because of people's dislike of unwanted mail.

Slane has concerns about public registers, but his office has a firm control of an area that was ripe with paranoia and debate 10 years ago: data-matching between government agencies.

The use of computer programmes to check whether people are receiving entitlements they are not supposed to, or to track down people who are wanted by various departments, has generally been trouble-free since it began. In fact, the use of technology to scan people's details has been recognised as a less invasive way to do the work.

Of the 17 data-matching programmes, some are carried out by the privately owned computer giant EDS for the nine Government agencies authorised to conduct them under the supervision of Slane's office.

Two pieces of legislation are about to allow more programmes to go ahead.

The Social Welfare (Transitional Provisions) Amendment Act, passed last year, has established the framework for running data-matching programmes with foreign governments. The initiative came after an approach from the Netherlands over a social security agreement with New Zealand. As part of that agreement, the Dutch Government wanted data-matching provisions relating to social welfare payments and tax information.

Another bill introduced to the House this year will enable the Electoral Enrolment Centre to track voters through databases held by the Ministry of Transport, Land Transport Safety Authority, the Department of Work and Income and the Department of Internal Affairs to ensure people stay on the electoral roll.

As with those two law changes, every incremental slide by the state into your life is carried out for what the Government argues are very valid reasons. Safeguards are in place for each of the 20 Government agencies with databases that probably hold your name. The Weekend Herald approached 22 agencies seeking information on their powers to obtain information and measures they have in place to protect privacy.

Aside from adhering to the Privacy Act, most departments have drawn up their own policies and employ staff with special responsibilities for privacy. The Customs Service, the Immigration Service, ACC, the Department of Child Youth and Family, and the Ministry of Education are among departments that provided details of the lengths they go to make sure the information held is secure and that staff are aware of their obligations to maintain confidentiality.

The Customs policy runs to 10 pages explaining the information privacy principles; the Ministry of Education's guide gives staff explicit instructions on their obligations under the Privacy Act; ACC says it includes a privacy module in its induction course for all staff.

But even the most stringent systems fail.

Three staff from the Department of Work and Income are under investigation for allegedly selling clients' data to debt collectors for $10 a name.

The Herald has also learned that two Department for Courts staff have been disciplined after investigations into the improper use of confidential personal information since July 1998. The department has refused to provide other details - citing the privacy of the staff members concerned.

Three years ago, State Services Commissioner Michael Wintringham launched an investigation into the protection of private information after leaks from Winz and the Inland Revenue Department. He found that while systems and policies were in place, they needed to be tightened up to prevent the chance of future abuse.

"Departments must maintain management standards and an ethical environment that ensures vigilance with regard to the confidentiality and security of that information," Wintringham's report said.

The report acknowledged that no matter what systems were in place, breaches of confidentiality were always a danger.

"There is always a probability that failure to preserve the confidentiality and security of personal information will occur. There will always be some cases of improper use or disclosure; some cases will be inadvertent, some will be deliberate and criminal. A management priority should be to minimise the probability of failures and to minimise their impact when they occur."

Wintringham could only conclude that the data held by Winz and IRD was "generally safe."

"However, given the quantity and nature of the personal information held by the departments, I recognise that this level of reassurance will not satisfy everyone."

Every year, the state's collection of personal information grows larger. That means more people handling more confidential data. Every few years, the Government finds new uses for that information. Laws, policies and specialist staff are in place to protect it from falling into the wrong hands.

But a system is only as strong as the people within it and only as tight as the policies of the government of the day.

Herald Online feature: Privacy