An American researcher says New Zealand public agencies are monitoring people's social media with too few controls over them.
Rachel Levinson-Waldman said at least a dozen agencies including police, ACC and the Ministry for Social Development are regularly monitoring the main online platforms like Facebook and X (formerly Twitter).
Her 90-page report out on Thursday says that is a "rich, sometimes overwhelming, and potentially risky source of information for state agencies seeking to combat crime and hate speech, conduct investigations, enforce regulations, detect fraud and assess risk".
But the public was kept too much in the dark about its use, and she sounded a warning about this becoming super-charged by AI.
"I do see more caution here than I see in the United States," Levinson-Waldman, a director at the Brennan Centre for Justice in Washington, said.
"I do think that there's been sort of a head-long rush" in the US; this was in the absence of adequate guard-rails or public engagement, a lesson for New Zealand to do better, sooner, her report said.
"Here I think probably for some combination of more resource constraints and kind of attentiveness to the public buy-in, I do think it's been more cautious," she told RNZ on Thursday.
People exhibited a level of resignation about private companies harvesting their social media data, however, the stakes were "much higher" when state agencies with coercive power over, say, if a person got a benefit or got locked up, were doing it.
The agencies had to make more effort to get public buy-in.
"This is the right time to have a real push for public transparency from these agencies and to have a conversation about what the social licence is."
That required more transparency, Levinson-Waldman said.
"I think the real question is one around oversight.
"Are there policies in place to guide their use? Are they publicly available to the maximum extent possible, and are there really robust mechanisms in place for record keeping and oversight and accountability?"
Most of the dozen agencies had policies but MSD did not.
MSD was relying on interim principles around how its staff monitor people's social media use, three years after suspending its earlier interim guidelines.
The ministry said publicly available social media was an "obvious" place for its investigators to go to detect and prevent benefit fraud.
It introduced interim social media guidelines in 2017 but dumped them after a critcial review in 2021.
It was currently working on a policy to govern how social media information was collected and used, and in the meantime, staff followed principles including they must have "reasonable cause" to suspect an offence, to search social media, and must corroborate that with other evidence.
Apart from at the Ministry of Business, Innovation and Employment (MBIE), which had published its policy, the public had to ask to see them in every case, such as by using the Official Information Act (OIA).
"I wouldn't say it's necessarily hiding it.
"I don't think it's necessarily that they're doing, you know, kind of problematic or secretive things under them, but it is still something of an obstacle to transparency."
This persists despite the Law Commission and Ministry of Justice telling agencies seven years ago to be transparent.
"The reason it matters is that this information can be used to do a lot of things.
"It can create a comprehensive picture about people. It's very easy to misinterpret. It can undermine core democratic rights.
"And when you loop in AI-driven or automated tools, it kind of supercharges all of those risks."
The Search and Surveillance Act was amended in 2022 to give police more powers to combat organised crime, but Levinson-Waldman said both that Act and the Privacy Act 2020 needed an update to direct agencies to be more open and more careful with exploiting information off social media - but in the absence of that, the agencies should do more to take that approach off their own bat.
*Levinson-Waldman undertook her research under the Ian Axford (New Zealand) Fellowships in Public Policy