19 August 2025
Mr M Thompson and Mr E Strafford
[FYI request #31232 email]
Official information request
Our ref: R001037
Tēnā kōrua
Thank you for your Official Information Act 1982 (OIA) request received by the Ministry for
Regulation (Ministry) on 6 June 2025. On 3 July 2025, we notified you of the extension to make our
decision to 15 August 2025.
We have itemised your request for ease of reference. You requested:
“Please provide policy documents and discussions involving Ministry of Regulation officials
relating to the use of AI in processing of submissions on the Regulatory Standards Bill. If third
party providers such as Public Voice, or other third party providers were used please provide
communication between the Ministry and those third party providers as related to the use of
AI and in particular, any discussions or policy documents relating to the following issues:
1. Was the data processed in any country other than NZ?
2. What privacy guarantees were made regarding the use of models to process this
data?
3. Was the ministry assured that the AI model provider would not be able to train and
improve their models using the data uploaded, and if so how much confidence did
the ministry have in these assurances?
4. Was the provider or providers required to delete any data uploaded after processing?
5. Was the data redacted for privacy before it was uploaded to any AI models?
6. If so, who did the redaction work, what instructions were they given and what types
of data was redacted?
7. If not, what representations did the third party providers or AI model providers make
in regards to data redactions, if any?
8. What consideration, if any, was made regarding use of indigenous data and data
provided Māori?
9. Was any of the data provided to the model written in te reo Māori and if so, what
consideration was taken for safeguarding the use of that data and preventing it
being used to train language models?
10. Finally, could you please provide any privacy impact assessments that were done in
relation to this work.”
Page 1 of 5
Response
I have responded to each of your questions in turn.
1. Was the data processed in any country other than NZ?
Data processing occurred both within and outside of New Zealand. Please also refer to the
response to
item 2.
2. What privacy guarantees were made regarding the use of models to process this data?
The Ministry worked with PublicVoice to ensure the privacy and security of all submissions.
Privacy implications and risks were considered appropriately and the Ministry sought and received
assurances regarding the handing of personal information, including:
• Confirmation that all information would be kept confidential, in line with PublicVoice’s privacy
policy and in line with legal requirements under the Privacy Act 2020.
• Confirmation that data would not be used to train Artificial Intelligence (AI) models and
assurance that all data would be destroyed upon project completion.
• Zero data retention policies were in place, and SSL/TLS 1.3 encryption was used for data
transmission.
• Data would be processed in New Zealand, the European Union or the United States, and only
three New Zealand-based staff would have access to the information.
• Outputs would be human-reviewed, and a multi-step validation process would be used to
mitigate risks such as hallucination.
3. Was the ministry assured that the AI model provider would not be able to train and
improve their models using the data uploaded, and if so how much confidence did the
ministry have in these assurances?
Yes, the Ministry received and accepted the assurances on this matter. Please refer to the response
to
item 2.
4. Was the provider or providers required to delete any data uploaded after processing?
Yes, the tools used to analyse the submissions did not retain personal information or submission
content as the information was destroyed upon project completion. Please refer to the response to
item 2.
5. Was the data redacted for privacy before it was uploaded to any AI models?
Personal information included in the submissions were analysed by AI technology as part of the
analysis of all submissions. The tools used did not retain personal information or submission
content as the information was destroyed upon project completion.
Submitter identification data was analysed as part of data handling and cleaning processes for the
following purposes:
• Classification of each submission by submitter type (individual, iwi/hapū, or organisation)
• Determination of stance (oppose, support, partially support, or unclear)
• De-duplication and flagging of identical or near-identical submissions
• Determination whether submissions contained an Official Information Act request
• Identifying the language and whether a submission needed translation
Page 2 of 5
• Assessment whether submissions pertained to matters unrelated to the proposed Regulatory
Standards Bill.
6. If so, who did the redaction work, what instructions were they given and what types of
data was redacted?
Refer to the response to
item 5.
7. If not, what representations did the third party providers or AI model providers make in
regards to data redactions, if any?
There were no commitments specifically with regard to data redactions. However, contractual
obligations on PublicVoice included the following privacy requirements:
• To comply with the Ministry’s Privacy policies and guidelines
• To comply with the Privacy Act (and other laws)
• To access the information only to the extent necessary to provide the services
• To not disclose the information to any third party
• To keep the information secure
• To return or destroy confidential information after expiry or termination of the agreement.
Beyond the above, the Ministry specifically tested and received reassurances on further potential
privacy impacts, including:
• No information would be used to train the AI model
• Information would be destroyed after expiry or termination
• The number of people with access to the information would be limited (3), and in New Zealand
• Measures to take to mitigate risk of AI error/hallucination
• The information will be kept confidential, for both privacy and general confidentiality
purposes.
8. What consideration, if any, was made regarding use of indigenous data and data provided
Māori?
We understand your question to be seeking clarification on how the Ministry managed data and
information from submissions provided by Māori. These submissions were handled with care and
integrity, consistent with the approach taken for all submissions. The Ministry maintained a record
of submissions received in te reo Māori, which were subsequently translated to ensure accessibility
and understanding. To support this, PublicVoice was asked to run a script to identify any
additional submissions requiring translation. The translation work was undertaken by the
Department of Internal Affairs.
9. Was any of the data provided to the model written in te reo Māori and if so, what
consideration was taken for safeguarding the use of that data and preventing it being
used to train language models?
Refer to the response to
items 2, 5, 7 and
8.
The Ministry was assured that any data provided was subject to the data handling and cleaning
processes referenced in
item 5, and we were advised by PublicVoice that data would not be
Page 3 of 5
link to page 4 link to page 4 link to page 4
retained/used for training AI models as per
item 7. Please also refer to the privacy assurances
in
item 2 and the treatment of submissions in te reo Māori in
item 8.
10. Please provide any privacy impact assessments that were done in relation to this work.
While the Ministry does not hold a ‘Privacy Impact Assessment’ document in the form of a
standalone report, privacy implications were considered appropriately and the Ministry sought
and received assurances from PublicVoice regarding the handling of personal information as part
of its due diligence as explained in the response to
item 2.
Documents
You requested policy documents, discussions and communications involving Ministry officials and
PublicVoice relating to the use of AI in processing submissions on the discussion document.
On 29 January 2025, Ministry officials discussed the potential use of AI during a weekly meeting
with the Minister. At the meeting, we advised we were exploring engaging with PublicVoice and the
application of AI tools for the analysis of submissions. The Minister was supportive of this.
We provided briefing papers to the Minister for Regulation, which reference working with
PublicVoice and the use of AI in the analysis of submissions. Copies of these briefings are publicly
available on the
Publications and resources page of the Ministry’s website, I therefore refuse the
publicly available parts of your request under section 18(d) of the OIA as the documents you have
requested, itemised below, are publicly available.
• MFR2025-026: Regulatory Standards Bill Initial findings from public consultatio
n1, dated
21 February 2025
• MFR2025-027: Regulatory Standards Bill Summary of Submissi
ons2, dated 19 March 2025
• Information Release - Summary of Submissions for proposed Regulatory Standards
Bill3, dated
May 2025.
Some information in the aforementioned material has been redacted consistent with the
provisions for withholding information under the OIA. Where this is the case, the relevant sections
of the OIA that would apply have been identified and where information was withheld, no public
interest considerations were identified that would outweigh the reasons for withholding the
information.
I have considered the grounds under which information has been redacted in the proactively
released documents which you have requested, and I consider they continue to apply in the same
ways under this request. I therefore withhold the same parts of these documents, under the same
grounds as listed in the published versions.
1 https://www.regulation.govt.nz/about-us/our-publications/mfr2025-026-regulatory-standards-bill-initial-findings-
from-public-consultation/
2https://www.regulation.govt.nz/about-us/our-publications/mfr2025-027-regulatory-standards-bill-final-summary-of-
submissions/
3 https://www.regulation.govt.nz/about-us/our-publications/information-release-summary-of-submissions-for-
proposed-regulatory-standards-bill/
Page 4 of 5
Communications involving Ministry officials and PublicVoice, which are in scope of your request
are attached as
Appendix A. Some information has been withheld under the following sections of
the OIA:
• 9(2)(a) to protect the privacy of natural persons
• 9(2)(g)(i) to maintain the effective conduct of public affairs through the free and frank
expression of opinions by or between or to Ministers of the Crown or members of an
organisation or officers and employees of any public service agency or organisation in the
course of their duty
• 9(2)(h) to maintain legal professional privilege.
As required by section 9(1) of the OIA, I have considered whether the grounds for withholding the
information requested is outweighed by the public interest. In this instance I do not consider that
to be the case.
Additional information
Attached as
Appendix B is a copy of the Ministry’s Artificial Intelligence (AI) policy, which sets out
how AI may be used within the Ministry. This policy explicitly stipulates that Ministry staff may use
AI tools to analyse and summarise Ministry information, including submissions data. While the
material is not strictly within the scope of your request — as the policy was confirmed and came
into effect on 29 April 2025 — we have decided to provide this to you for your reference.
Right of review
If you wish to discuss this decision with us, please contac
t [Ministry for Regulation request email].
You have the right to seek an investigation and review by the Ombudsman of this decision.
Information about how to make a complaint is available a
t www.ombudsman.parliament.nz or
freephone 0800 802 602.
Please note that we may publish this response (with your details removed) on the Ministry for
Regulation website.
Ngā mihi
Aisling Risdon
Head of Ministerial Services
Ministry for Regulation
Page 5 of 5
