Office of the Privacy Commissioner
PO Box 10094, The Terrace, Wel ington 6143
Level 11, 215 Lambton Quay
Wellington, New Zealand
P +64 4 474 7590 F +64 4 474 7595
E [email address]
0800 803 909 Enquiries
privacy.org.nz
23 August 2023
Thomas Wilson
By email only to: [FYI request #23743 email]
Tēnā koe
Official Information Act Request (Our Ref: OIA/0299)
We refer to your Official Information Act request received on 9 August 2023.
You request:
1. Please detail your progress against each measure in your SPE for 2022/23
2. Please provide your current SPE and previous SPE and detail the specific dif erences
between the two including specific detail of any changes in measures or new
measures
3. Please provide all documentation and all correspondence in the past 12 months that
demonstrate and detail the progress made on key priorities defined in your current
statement of intent, SOI
4. Please advise the number of staff employed on a full time basis for each year covered
over your last two SOI’s (10 years?) and how these number support you SOI’s goals
or priorities over that period and if your SOI’s resulted in an increase in staf
5. Please provide detail of your budget figures for the years covered by current and
previous SOI’s and explain major increases or decreases in budget over that period
including how these assign with you SOI’s priorities/goals
6. For the period of your current and previous SOI’s what has been your spend broken
down by department or business unit by year.
7. What organisational changes such as restructures have occurred in the periods
covered by you last 2 SOI’s, provide documentation relating to organisation changes,
consultations, ministerial advice, briefing documents, plans, feedback/responses.
OIA/0299/A886126
2
1. Please detail your progress against each measure in your SPE for 2022/23
Progress against each measure in our SPE’s are provided in the section titled “Finance
and performance report” in the Annual Report
The Annual Reports for each year are available on our website through the following link.
https:/ privacy.org.nz/publications/corporate-reports/
2. Please provide your current SPE and previous SPE and detail the specific differences
between the two including specific detail of any changes in measures or new measures.
The current and previous Statements of Performance Expectations (SPE’s) are available
on our website through the following links:
SPE 2023-2024
https:/ www.privacy.org.nz/publications/corporate-reports/statement-of-performance-
expectations-2023-2024/
SPE 2022-2023
https:/ www.privacy.org.nz/publications/corporate-reports/statement-of-performance-
expectations-1-july-2022-to-30-june-2023/
New Measures 2023-2024
Target
How it wil be measured
Strategy and Insights
Conduct 2 assessments a year to gauge 2
Copies of assessments
the privacy maturity or attitudes of
conducted wil be retained in
agencies or individuals.
the document management
system.
Communication and Education
Significant improvements made to digital Achieved Evidence of improvements
service channels.
made.
Compliance and Enforcement Activities
Notified privacy breaches that are likely 100%
Evidence retained in the
to cause serious harm, are followed up
document management system.
with the notifying agency within 10
working days of receipt.
The percentage of externally reviewed
90%
Evidenced by report prepared
compliance investigations that are rated
by an independent evaluator.
as 3.5 out of 5 or better for quality.
Incoming compliance issues are risk
100%
Evidence retained in the
assessed to determinate the appropriate
document management system.
response activity.
Policy and Advocacy
OIA/0299/A886126
3
New Measures 2023-2024
Target
How it wil be measured
Undertake 2 projects relevant to setting Achieved Evidence retained in the
privacy standards, expectations or
document management system.
guidance in the privacy system.
All externally reviewed policy files
100%
Evidenced by report prepared
appropriately incorporate Treaty and Te
by independent evaluator.
Ao Māori analysis as necessary.
3. Please provide all documentation and all correspondence in the past 12 months that
demonstrate and detail the progress made on key priorities defined in your current
statement of intent, SOI.
Our current Statement of Intent (SOI) is for the period 1 July 2023 to 30 June 2027. There
is insufficient reporting of progress for a one-month period.
The previous SOI and the SPE’s that support it are reported on in our Annual Report. The
latest Annual Report is for the period ending 30 June 2022 and can be found on our
website through the following link.
https:/ www.privacy.org.nz/publications/corporate-reports/annual-report/
We are currently compiling our Annual Report for the period ending 30 June 2023. This
wil be posted on our website when submit ed to Parliament for publication, late this year.
We post our Quarterly Reports to the Minister of Justice on our website. These
demonstrate the progress made on key priorities, financial and non-financial performance.
https://www.privacy.org.nz/publications/corporate-reports/quarterly-reports-to-the-
minister-of-justice/
4. Please advise the number of staff employed on a full-time basis for each year covered
over your last two SOI’s (10 years?) and how these number support you SOI’s goals or
priorities over that period and if your SOI’s resulted in an increase in staff.
Notes to the response:
For the purposes of your request, I have assumed the last two Statements of Intent would
be for the SOI 1 July 2020 to 30 June 2024 and the previous SOI 1 July 2017 to 30 June
2021 rather than our current SOI 1 July 2023 to 30 June 2027. A period of six years.
Full Time Equivalents (FTE’s) year ending 30 June
2018
2019
2020
2021
2022
2023
33.96
36.26
32.63
39.43
41.12
48.63
The increase in staff numbers was to manage increased demand and additional functions
with the introduction of the new Privacy Act in December 2020. The new responsibilities
post 2020 required new teams to be established and increased resourcing required across
the office.
OIA/0299/A886126
4
5. Please provide detail of your budget figures for the years covered by current and previous
SOI’s and explain major increases or decreases in budget over that period including how
these assign with you SOI’s priorities/goals
Notes to the response:
For the purposes of your request, I have assumed the last two Statements of Intent would
be for the SOI 1 July 2020 to 30 June 2024 and the previous SOI 1 July 2017 to 30 June
2021 rather than our current SOI 1 July 2023 to 30 June 2027. A period of six years.
The budget increases were not assigned to our SOI’s priorities/goals. The budget increase
was to provide for new functions and other changes as a result of the new Privacy Act
2020.
Year End
Budget ($m)
Explanation
30 June 2018
4.970
No change
30 June 2019
4.970
No change
30 June 2020
5.582
Provide for preliminary activities and planning
required to support the planning and other
materials required prior to the introduction of
the new Privacy Act on 1 December 2020, and
post implementation costs to year end.
30 June 2021
7.276
Provide for the new functions and other
changes introduced with the Privacy Act 2020
for the first full year of introduction and to meet
initial capability increases.
30 June 2022
7.392
Part of the Budget 2021 which provided a
further increase to out-years to support the
new functions other changes introduced with
the Privacy Act 2020 as capability was
increased.
30 June 2023
7.392
No change
6. For the period of your current and previous SOI’s what has been your spend broken down
by department or business unit by year.
The spends for each function are provided in the “Summary of Output Revenue and
Expenses” within the respective Statement of Expectations for each year. They are
available on our website using the link below:
https:/ www.privacy.org.nz/publications/corporate-reports/
7. What organisational changes such as restructures have occurred in the periods covered
by you last 2 SOI’s, provide documentation relating to organisation changes, consultations,
ministerial advice, briefing documents, plans, feedback/responses.
We undertook a significant review of services to be delivered following the introduction of
the new Privacy Act in December 2020 and the new responsibilities within the Act. We
termed this review
Privacy 2.0. The new services included increased capacity in some
teams and the establishment of two new teams, the Strategy and Insights Team and the
Compliance Team. The increase in capacity and capability was not a formal restructuring
OIA/0299/A886126
5
and did not involve staff reductions. Further, under the Privacy Act 2020, we sought the
statutory appointment of a Deputy Privacy Commissioner.
We maintain a continuous review of how we deliver our services and how we might make
best use of available resources, making adjustments as identified. We have not extended
this process of continuous improvement to a formal restructuring.
Attached are the organisational charts for 2019 and 2023 which show the organisational
changes that have taken place over that period.
The Privacy Commissioner is an Independent Crown entity and is not subject to Ministerial
advice other than the annual letter of expectations, which are
attached.
Nāku iti noa, nā
Gary Bulog
General Manager
Encls.
OIA/0299/A886126
