Community groups have expressed their disbelief at the Ministry of Social Development's claim that it can set up a new IT system in a matter of months to securely collect people's private information.
Photo: RNZ / Rebekah Parsons-King
The ministry's current portal was shut-down yesterday after a second breach was revealed.
It said it was going to fast-track a new one to ensure the safety of the information.
The groups were worried that would mean shortcuts were taken.
From July, hundreds of non-government organisations funded by the Ministry of Social Development would be expected to pass on private client information.
Most of the groups are against the mass collection, but have little choice but to comply if they want to continue receiving funding.
The Privacy Commissioner has warned the plan was excessive and disproportionate to the government's legitimate need, and was inconsistent with the principles of the Privacy Act.
Trevor McGlinchey from the social services umbrella group ComVoices said the government seemed determined to forge ahead with the plan, regardless of the cost.
He said the Ministry of Social Development was well-known for losing data, or using it inappropriately.
"You know the fact that [they] would put a temporary patched-up solution in place to receive this information and then suddenly - oops, that's failed - doesn't give you, from the outset, good confidence.
"The huge rush, the great urgency that they're putting around gathering this data. The fact that they believe they can have a new system up and running a matter of months, tested and demonstrated to be secure and it doesn't give great confidence," Mr McGlinchey said.
The ministry's principal adviser, Peter Galvin, said the portal that has been shut down was always going to be a temporary solution.
He said a new one was being worked on, and it would have additional controls such as being peer-reviewed and monitored by the Privacy Commissioner.
"Security is critical for us in this project.
"We understand the anxieties that people will have about sharing client level data with the ministry and we want to make sure that they feel one hundred, well, totally safe about being able to do that," said Mr Galvin.
The Social Development Minister, Anne Tolley, said she was furious and disappointed with her agency for taking short-cuts in the first place by using the temporary portal.
She told Parliament she would now get more involved.
"I did not as a Minister have operational oversight of it but I agree with the Privacy Commissioner that that is not the correct way to develop a system like this.
"We will not upload any data until, not only myself, but the Privacy Commissioner and the Government Information Officer are content that it is a secure system."
But the Privacy Commissioner wanted the Minister to go further than that.
John Edwards recommended Statistics New Zealand took responsibility for collection and analysis of the data.
He also suggested allowing clients to provide information anonymously or in some cases to opt out altogether.
Anne Tolley said that wouldn't work.
"Whilst that might give us the progress made by NGOs, it doesn't give us the coverage. So we don't know that everyone that needs the services are actually getting that service."
But ComVoice's Trevor McGlinchey said community groups at least trusted Statistics New Zealand.
"It takes time and a long time to build trust.
"In the meantime let's work with trusted agencies in order to gather the data to demonstrate the effectiveness and value of the social services being provided."
Anne Tolley said there was no reason for service providers not to have trust in the Ministry of Social Development.
She said it had very good record of protecting more than one million New Zealanders' information, with very few privacy breaches.