Tax Office Confirms Thousands of New Zealand Taxpayers’ Information Shared with Social Media Platforms

New Zealand’s Inland Revenue Department (IRD), which holds personal details of millions of New Zealanders, including children with after-school jobs, has been providing personal information to social media platforms in a supposedly secure format, although experts contest its effectiveness.

Data on hundreds of thousands of individuals have been shared with these platforms to facilitate the targeting of IRD’s marketing campaigns.

The IRD did not directly inform the individuals whose data was divulged, but the practice was brought to light by an individual who described it as a “betrayal” of taxpayers.

Despite the general disclaimer on its website privacy policy indicating that they occasionally provide hashed and fully anonymised information to social media channels for advertising purposes, the Chairperson of the New Zealand Council for Civil Liberties, Thomas Beagle, believes that the department handling tax records should not be sharing personal data under any circumstances.

He stated, “It’s a privacy violation.”

Related Stories

He highlighted that recipients with access to more data could potentially match individuals’ attributes across datasets and de-anonymise the information from IRD to expose names and other details, especially when shared with “platforms like Facebook [which] have a rapacious desire for data.”

Despite the Department’s assertion of protecting the information using a “hashing” process, Beagle insisted that they did not implement adequate safety measures.

Claiming Hashing is Secure is ‘Deceptive’: US FTC

Following the disclosure of this practice, IRD mentioned in a statement to RNZ that the data is hashed before being uploaded to social media platforms like Facebook, Instagram, or LinkedIn, and customer details are not directly shared.

However, as recently as July of this year, the United States Federal Trade Commission (FTC) warned that hashing does not guarantee anonymity for data.

The FTC criticized the notion that hashing ensures secure anonymisation as “deceptive” and emphasized that hashes can still identify users, potentially leading to harm.

European regulators also identified a “re-identification problem” with hashing back in 2019, indicating the need for additional security steps for protecting data.

Despite these concerns, Inland Revenue’s statement maintained that the data cannot be decrypted post-hashing, ensuring its safety for the matching process.

Relying on Social Media Companies’ Integrity

The Department further expressed its reliance on the integrity of social media companies, asserting that each platform adheres to its own privacy principles to safeguard customer information for intended purposes.

It claimed full compliance with the Tax Administration and Privacy Act.

Michael Webster, the Office of New Zealand’s Privacy Commissioner, stressed that anyone relying on hashing must ensure its effectiveness, particularly in determining if a person remains “reasonably identifiable” under the Privacy Act.

While the Privacy Commissioner in New Zealand currently lacks a stance on hashing, they stated readiness to undertake a compliance approach if concerns arise regarding anonymisation or hashing practices and their alignment with the Privacy Act.

Under New Zealand’s Privacy Act, individuals have the right to know if their information is being appropriately used and secured. They can file complaints with the Commissioner if they perceive any misuse of their data.

Currently, there are 3.38 million individual taxpayers in New Zealand.