IRD to stop sharing taxpayers’ details with social media platforms following backlash

By Phil Pennington of RNZ

• Inland Revenue has stopped sharing taxpayers’ details with social media platforms for marketing.
• 8000 taxpayers protested against the practice, citing concerns about their personal data being at risk.
• IRD found two cases of unintended disclosure but said neither breach met privacy law notification requirements.

Inland Revenue (IRD) has put a full stop to sharing taxpayers’ details with social media platforms for marketing.

It follows 8000 taxpayers protesting to Inland Revenue about its practice of sharing their encrypted details to enable targeted ad campaigns.

IRD commissioner Peter Mersi told media on Tuesday they believed the system was fully secure, and it was a cost-effective way of getting tax information to targeted groups, but the strength of public opinion meant they would no longer use it.

“Whether we are really confident about the data is sort of irrelevant at the moment. There are a number of people who feel a degree of discomfort – people really feel that by us sharing information with platforms, their personal data is at risk, there are people who believe that. It would be remiss of me if I didn’t really take that into account.”

IRD found two cases of unintended disclosure of people’s details, that were not properly hashed, in reviews running since September.

In the first, 268,000 taxpayers were involved, and IRD would write to them to explain and apologise in the next 24 hours, Mersi said. In the second case, it was harder to determine the numbers and who was affected.

Neither breach was serious enough to meet privacy law requirements for notification, he said.

People’s details went through a “hashing” process to anonymise it when it went to Facebook, Google, Instagram and LinkedIn. IRD stood by hashing and its other security measures as “sufficient”, Mersi said.

A “concerted campaign” directly suggesting some of the details were leaked or misused had taken place, Mersi said.

“Some of that has been misrepresented.”

Asked who was in this campaign, Mersi mentioned the Taxpayers’ Union and some media reporting.

“There is no evidence that any customer details, hashed or unhashed, have ever been used by social media platforms for anything other than the purpose agreed.”

The marketing practice was of “real benefit” in getting targeted messages to taxpayers, and IRD’s website made it clear what was going on, he added.

David Buckingham, a Queenstown employment relations consultant who spotted IRD doing this and complained several months ago, said it was a welcome move by IRD as far as it went.

“It doesn’t do anything for those people who have already had their data breached,” he said. “Facebook is already able to use the information gathered to profile these consumers.”

It was not believable that the social media companies would delete the taxpayers’ details provided to them “simply because IRD says that they will”, Buckingham said.

The Taxpayers’ Union has been approached for comment.

Sign up to The Daily H, a free newsletter curated by our editors and delivered straight to your inbox every weekday.