Inland Revenue has announced it will stop the use of custom audience lists due to public concern.
Here is what the Commissioner of Inland Revenue, Peter Mersi, said at a media briefing today.
"In the course of our work, we are required to make every effort to contact customers about their entitlements and obligations. That requirement is included in our legislation and it’s what drives our efforts to use the most effective and efficient means of communicating with people.
As you’re aware, Inland Revenue has been using custom audience lists with social media platforms for a number of years.
The purpose of those lists was to help us more accurately target individual taxpayers with information they need. It has been true for some time that to communicate with large numbers of people effectively, social media platforms are very important. Being able to reach people where they are active is vital. Using social media since 2013 has significantly increased our success in reaching taxpayers with important messages about their entitlements and obligations.
However, in response to public concern at having personal details passed to social media platforms without their consent, we will no longer supply de identified, or hashed, customer details to social media platforms for use in targeted advertising.
As Commissioner, I want to make it very clear that we have listened carefully to the concerns people have expressed. And it’s really important to me that we do the right thing in responding to those concerns. I take the matter of customer privacy very seriously and I think our decision, and this special briefing, demonstrates that.
When concerns were raised over our use of custom audience lists, we paused their use on 12 September. Over the past several weeks, a comprehensive internal review of our use of custom audience lists has been carried out. We have also had our review independently reviewed by Geof Nightingale. Both our and Geof’s review documents will be available online early this afternoon.
It's important for me to say at the outset that it’s not the review that has driven our decision to stop using custom audience lists.
It is people’s strongly expressed concerns, about information being passed to social media platforms regardless of the protections, that have led us to make the call we have. The review has enabled us to explore those concerns in greater detail.
Inland Revenue will continue to advertise on social media platforms but not by using custom audience lists. For the reasons I’ve outlined already, social media platforms are a very important and effective way to reach taxpayers with information. And one of my clear responsibilities as Commissioner is to ensure that Inland Revenue makes the maximum effort to reach taxpayers with the information they need in respect of their entitlements and obligations.
Customer privacy is a top priority. I can reassure all of our customers that in all the work we have done during the course of the review, there has been no evidence of customer details ever being used by social media platforms for anything other than the purpose intended.
In undertaking the review, and in responding to OIA requests on this matter, we discovered two instances of customer details being supplied in their raw form by Inland Revenue to a social media platform – clearly, this was not the correct procedure. One instance was in the context of trying to fix a problem with creating a particular custom audience list. The other was the result of a misunderstanding of what data the hashing process applied to with one of the platforms.
These unintended disclosures occurred at the Inland Revenue end and while both have been reported to the Office of the Privacy Commissioner, neither were categorised as notifiable. That means we are not required to report them publicly or to notify the customers involved. This is because the risk of any of the customer data having been shared further is deemed very low, as is the risk that it could have been used for any harmful purpose.
We are examining the circumstances surrounding both instances and if we find any breach of our code of conduct we will work through what action is to be taken.
We are writing to the taxpayers involved in the first of the two instances, apologising for what happened, explaining how it happened, and telling them what details were shared. And the social media platform involved has confirmed that all unhashed data provided to them was deleted within previously agreed time frames.
The second is less easy to quantify, and identifying individual customers involved is very difficult because it was in the context of a totally automated, ‘machine to machine’ exchange between Inland Revenue and the platform.
I want to emphasise here again, that the decision to stop using custom audience lists has been driven by public concern – not by these unintended disclosures. Obviously, they are a concern, and we are treating them very seriously, but as I’ve said, neither was deemed serious enough to meet privacy legislation requirements for reporting.
I have made the decision to make all of this information public because as Commissioner I prioritise transparency and maintaining the trust of our customers. So, I apologise to all those customers whose details were passed against correct procedures. And I’m giving taxpayers my assurance that we have stopped sharing their details, in any form, with social media platforms - we have no plans to resume that practice.
Prior to the review Inland Revenue has always believed that sufficient work was done to ensure the security of customer details within the hashing and custom-list creation process. In addition to hashing, the social media platforms have layers of security which means customer information has been kept safe and secure.
Again, there is no evidence that any customer details, hashed or unhashed, have ever been used by social media platforms for anything other than the purpose agreed.
Custom audience lists have been a very valuable tool for Inland Revenue with real benefits for customers because we could get relevant messages directly to them through the channels we knew they were using.
The terms of the agreements with the social media platforms were always explicit and clear in stating that all hashed data was secure, used only for the purpose intended, and then deleted within agreed timeframes.
But as I’ve said, public concern at the practice of passing details to social media platforms in any form has led us to the decision not to resume use of the custom audience list tool.
We have a number of different ways of reaching the customers we need to get to, so that they can continue to get the information they need as quickly and efficiently as possible. We will continue to review these for their effectiveness and ability to reach taxpayers.
Thank you for your time today. It isn’t often that the Commissioner of Inland Revenue calls a media briefing such as this. As I said at the outset, it’s a personal priority of mine that we are transparent and that we do the right thing in responding to customer concerns."
Inland Revenue's review of the use of custom lists and the report from Geoff Nightingale is available at About custom audience lists.