Inland Revenue is under scrutiny for sharing the personal details of thousands of taxpayers with social media platforms for targeted marketing campaigns. This practice, which involves using an anonymisation technique deemed inadequate by leading international regulators, has raised significant privacy concerns.
Queenstown employment relations consultant David Buckingham spotted the practice, saying taxpayers had no options but to provide extensive personal information and their tax status to Inland Revenue, only for this data to be passed on to Facebook and LinkedIn. Buckingham also described it as a widespread “betrayal” of taxpayers.
IR claims the data is “hashed,” in which letters are replaced with numbers, before being uploaded to the platforms, and that the platforms have their own privacy principles in place.
However, top international regulators like the US Federal Trade Commission stated that hashing is inadequate for protecting personal information.
“No, hashing still doesn’t make your data anonymous,” the organisation said. ‘
“Companies often claim that hashing allows them to preserve user privacy.”
“This logic is as old as it is flawed—hashes aren’t ‘anonymous’ and can still be used to identify users, and their misuse can lead to harm. Companies should not act or claim as if hashing personal information renders it anonymised.”
European regulators who examined hashing in 2019 determined that there was a “re-identification problem” and that additional measures were necessary to safeguard data.
Inland Revenue did not specify whether it had considered the conclusions from the United States and European regulators. However, it stated that “after hashing, the data cannot be decrypted, and it’s safe for the matching process to take place.”
It also said that the platforms have managed customer information “responsibly” and confirmed that they deleted the data after hashing. However, Buckingham was not satisfied, especially with IR’s privileged situation.
“Inland Revenue in particular has secrecy provisions. It makes it actually particularly egregious. No one agreed to any of this, and there’s no way to opt out.”
“(IR) has created a technical-techno gobbledygook smokescreen as a distraction from the fact that they’ve actually betrayed almost every New Zealander by disclosing the nature of their tax status,” he added.
Inland Revenue has stated that it adheres to both the Privacy Act and the Tax Administration Act.
According to its privacy policy, which is accessible on its website, the organisation “sometimes provide hashed and fully anonymised information to social media channels when placing advertisements.”
The Office of the Privacy Commissioner stated that anyone using hashing is responsible for ensuring its effectiveness.
“We do not have a general position on hashing, but it is something we would consider if there was a question about the use of anonymisation or hashing and the application of the Privacy Act, which could depend on the facts involved and the circumstance of its use,” the OPC said.
“Should we have any concerns, we may take a compliance approach as set out in our Compliance and Regulatory Action Framework.”
Hashing is a technique for protecting sensitive personal data while still allowing it to be processed and analyzed. This technique is particularly relevant in contexts such as social media advertising, where companies upload “anonymised” data to social media platforms without sharing identifiable personal information directly, enabling them to create custom audience lists and target specific groups for advertisements related to their services.
