Stats NZ has a new website.

For new releases go to

www.stats.govt.nz

As we transition to our new site, you'll still find some Stats NZ information here on this archive site.

  • Share this page to Facebook
  • Share this page to Twitter
  • Share this page to Google+
7 Summary of privacy risks and mitigations

Risks

The leading areas of risk associated with this Agricultural land database matching and data integration are:

  • privacy
  • confidentiality
  • security
  • survey response
  • public response.

These might manifest as the:

  • identification of farm owners, occupiers or operators, and their farm location
  • potential mis-use of this information as a basis for ‘naming and shaming’ farm location and farming practices in terms of water quality in the same area
  • claim that improved water quality near farm sites is attributable to named farms, farm owners, occupiers or operators.

The risks this data matching present are potentially far-reaching. The privacy risks centre on accidental or deliberate access to personal information (names and addresses of individuals) and how that information may be inappropriately used.

In addition, the outcomes of a privacy breach carry potentially significant fallout for Statistics NZ’s ongoing relationship with its primary industry information data suppliers (farmers) who could collectively withdraw their support in providing highly valued land use and production information.

Statistically sound (and confidentialised) outcomes of this data matching (the changes in farm outputs and the changes in known water quality) still have the potential for the agriculture sector (the largest sector of New Zealand’s tradable economy) to react negatively.

This in turn has the potential to have adverse effects by causing New Zealand’s farmers to feel that they and their farming practices are being highlighted and monitored (statistically) and that pressures will be brought to bear to introduce or change regulatory controls.

This data matching also brings in additional partners. The government agencies (Ministry for the Environment and Ministry for Primary Industries) are not considered high-risk partners and Statistics NZ has long-term experience in joint survey work where these relationships and privacy, confidentiality, and security are well tested.

In addition, this privacy impact assessment (PIA) considers the potential impact that the outcomes to be published may have:

  • on the ongoing commitment of respondents, in particular farmers and farmer organisations, to supply data and support future surveys
  • on public opinion and response.

Mitigation of risks

Tools and practices for ensuring privacy, confidentiality and security of information used in this data integration and the datasets and outputs produced, lie in:

  • the Statistics Act 1975
  • employing highly trained and highly experienced secondees to Statistics NZ and bona fide researchers contracted under s37C of the Statistics Act 1975
  • undertaking all work within Statistics NZ or Statistics NZ’s secure environment (Data Lab) conditions
  • Statistics NZ retaining all sign-off rights to data that is to be published and the confidentiality provisions that are to apply to the data throughout all stages of production and publication.

The outcomes of this data matching will be published providing confidentiality criteria are met. Confidentiality assurance will be provided by Statistics NZ. Published outputs will be in the form of aggregated statistics and any tabulated cells that contain small numbers (for example at some regional levels) will be confidentialised using standard methods.

Statistics NZ’s Strategic Communications team have been informed of potential risks. Statistics NZ has experience dealing with the protection of personal and individual information. Privacy, confidentiality, and security are cornerstones of Statistics NZ’s work and to date no significant breaches have occurred.

The five identified risks are each discussed in the remainder of this chapter.

Privacy

Description of risk

There is a risk that personal name and address information is misused or used for a purpose beyond the brief of this data matching.

While this data integration places farm locations alongside known water quality of those locations, published output is presented only in a way that names and addresses of farms, farmers and farm operators, and specific farm locations cannot be identified.

Likelihood of risk occurring

Unlikely

Impact of risk occurring

Moderate

The potential impact is that respondents refuse to continue supplying land use data to Statistics NZ for its Agricultural production survey. Also, the other databases used in this data matching could be impacted by any misuse of private and personal information of respondents.

How the risk will be mitigated

Statistics NZ is very experienced in protecting personal information and will retain control of the storage of datasets created and used in this data matching along with confidentialisation assurance, security, applying the Statistics Act 1975, ensuring provisions of the Privacy Act 1993, and final sign-off on published outputs.

Names and addresses will be removed at the end of stage 1 of this data matching and personal farm locator identifiers will be removed at the end of stage 2.

Confidentiality assurance will be provided by Statistics NZ. Published outputs will be in the form of aggregated statistics and any tabulated cells that contain small numbers (for example at some regional levels) will be confidentialised using standard methods.

Overall assessment of risk to privacy

Medium 

Confidentiality

Description of risk

There is a risk that the location of a farm could be identified and this information be mis-used.

If inappropriate identification of farm sites or owners and operators were made and linked to local water quality information, this could negatively impact future participation by farmers and land occupiers in Statistics NZ’s Agricultural production surveys.

Likelihood of risk occurring

Unlikely

Impact of risk occurring

Moderate

The potential impact is that respondents refuse to continue supplying land use data to Statistics NZ for its Agricultural production survey. Also, the other databases used in this data matching could be negatively impacted if a particular farm or its farm outputs were identified and inappropriate links between the two were implied.

How the risk will be mitigated

Statistics NZ is experienced in confidentialising data to protect personal information and maintaining the statistical integrity of outputs. Statistics NZ retains the final sign-off to publishing the outputs and will rigorously apply confidentiality limitations (through the use of aggregation) so that no individual farmer or farming operation can be identified.

The outcomes of this data matching will be published providing confidentiality criteria are met. Confidentiality assurance will be provided by Statistics NZ. Published outputs will be in the form of aggregated statistics and any tabulated cells that contain small numbers (for example at some regional levels) will be confidentialised using standard methods.

Names and addresses will be removed at the end of stage 1 of this data matching and personal farm locator identifiers will be removed at the end of stage 2.

Overall assessment of risk to confidentiality

Medium

Security

Description of risk

There is a risk that personal name and address information is accessed by unauthorised personnel and used for another purpose than the limits imposed by this privacy impact assessment.

Likelihood of risk occurring

Low

Impact of risk occurring

Moderate

The potential impact is that respondents lose confidence in Statistics NZ’s ability to protect their personal information. This could result in a collective refusal to continue supplying land use data to Statistics NZ for its Agricultural production survey (APS). Potentially, this could extend beyond the APS to collections undertaken across Statistics NZ and even more broadly across other government agencies’ surveys. Also, other databases used in this data matching, eg AsureQuality’s AgriBase®, could be negatively impacted by a security breach of personal information about respondents.

How the risk will be mitigated

Statistics NZ is experienced in confidentialising data to protect personal information and maintaining the statistical integrity of outputs. For stage 1 of this data matching, staff accessing personal information are seconded to Statistics NZ and will sign a statutory declaration (a lifetime commitment to the Statistics Act 1975) and agreements to uphold Statistics NZ’s security and IT policies. The secondees will be located at Statistics NZ. In stages 2 and 3, contractors working as researchers under s37C of the Statistics Act 1975 will be located in specially designed, secure locations (Data Lab conditions).

Overall assessment of risk to security

Medium

Survey response

Description of risk

There is a risk that a breach of privacy, confidentiality and security, or negative reaction to published results could adversely impact other Statistics NZ surveys.

Likelihood of risk occurring

Unlikely

Impact of risk occurring

Moderate

The potential impact is that respondents affected by a breach of privacy, confidentiality or security will not only refuse to continue supplying land use data to Statistics NZ for its Agricultural production survey, but negatively impact other Statistics NZ survey response rates. Potential flow-on would see the other databases used in this data matching impacted as well.

How the risk will be mitigated

Ongoing data supply in the Agricultural production survey is important to Statistics NZ. It is important to Statistics NZ that best principles and practices are applied throughout the three listed stages of this data matching described in this privacy impact assessment. Statistics NZ adheres to the Cabinet-approved Principles and Protocols for Producers of Tier 1 Statistics.

Statistics NZ is a brand that inspires trust and confidence. It will ensure the highest standards are applied to this data matching to mitigate the impact of any breach or negative feedback that might arise and potentially impact on other Statistics NZ survey respondents.

Overall assessment of risk to security

Medium

Public response

Description of risk

Data integration that presents changing water quality alongside farm information is potentially sensitive, especially if negative or incorrect cause and effect conclusions are drawn (such as directly linking specific farms or farm owners with local water quality information).

There is a risk that the published information (changing agricultural pressures – such as nitrogen and phosphorus leaching – and changing water quality) is challenged by the public or sectors of it.

Conversely, there is widespread support for producing improved environmental reporting measures, as evidenced by the extent of in-principle support for the Environmental Reporting Bill currently passing through New Zealand’s legislation process. This will result in providing a sound, statistical approach to information on agricultural land use and freshwater quality changes in New Zealand.

While the desired outputs from these data integrations have been identified, the movements, over time, of those outputs are not known. They won’t be established until the processes described in this privacy impact assessment are complete.

Outputs from this database matching will provide new insights into agricultural land use and freshwater quality changes in New Zealand. It will produce better information on which to base decisions relating to agricultural land use and fresh water.

Likelihood of risk occurring

Possible

The risk of public negative feedback may be related to the findings of this data matching. If findings are positive where improvements in the measures of changes in farming outputs occur near improved water quality in local waterways (lakes, streams, etc), the public perception and response is likely to be positive.

Conversely, if this data matching identifies deteriorating water quality near higher levels of farm outputs, the public perception and response is likely to be negative.

Impact of risk occurring

Major

The potential impact is that respondents refuse to continue supplying land use data to Statistics NZ for its Agricultural production survey. Also, the other databases used in this data matching could be impacted by any misuse of private and personal information of respondents.

Published information may initiate public debate and directly link farming output changes with water quality changes, when they may contribute and be partially responsible for the relationship.

How the risk will be mitigated

Statistics NZ and the Ministry for the Environment need to explain (in plain English) the data they publish so that it is readily understood. Statistics NZ’s Strategic Communications team will be advised of the risks associated with commentators should they fail to understand and correctly explain the published information.

Overall assessment of risk from public response

High

  • Share this page to Facebook
  • Share this page to Twitter
  • Share this page to Google+
Top
  • Share this page to Facebook
  • Share this page to Twitter
  • Share this page to Google+