Warning: IRD has leaked personal information of hundreds of thousands of taxpayers to overseas tech companies. We've created an online tool to find out whether your privacy has been breached.

Hi Friend

Further to yesterday's update, thanks to the efforts by a Taxpayers' Union supporter and 'citizen journalist' David Buckingham, Inland Revenue has been caught red-handed leaking sensitive taxpayer data to overseas tech giants like Facebook.

IRD has breached New Zealanders' trust 🙅

We can reveal that the scale of this data leak is enormous. As far as we can tell, up to half a million Kiwis are affected.

Use IRD-Leak.nz to find out if you one of them.

Friend, this is almost certainly the biggest breach of taxpayer privacy in New Zealand's history.

Unlike cases when you voluntarily give personal information to corporates, taxpayers literally go to prison if they do not give personal information to Inland Revenue. We are supposed to be able to trust them with information – but instead of holding it securely, they've been uploading it to Facebook, Google, and others, every week!

Covering-up: IRD not telling the truth 😡

IRD are still saying 'nothing to see here'.

Last week, IRD's head spin doctor told 1News that "no complaints had been received over the practices."

But we learned yesterday (and have the documentary evidence to prove) that it was a complete and utter lie!

What's even more concerning – Inland Revenue are trying to run a line that your data is safe through a process called "hashing" – or jumbling up the data before handing it over to the overseas tech giants.

We've approached a number of IT experts to understand whether IRD's "hashed" assurances can be trusted. The short point is, hashing does nothing in terms of Facebook, Google, etc being able to match the data with the profiles of identifiable individuals (i.e. IRD told them your tax status).

IRD officials also seem unaware (or are just choosing to ignore?) that even the US Federal Trade Commission recently confirmed 'hashing' is not at all adequate in protecting sensitive user information. European regulators have said the same.

So who has your tax data now ? 🤷

Under the New Zealand Privacy Act, you are entitled to know what information is held by any agency and what they are doing with it.

Ironically, that law does not apply to the international social media companies IRD may well have handed your private information to.

But you have the right to require IRD to tell you whether or not they've shared given away your personal information. 

✉️ Click here to file a Privacy Act request now ✉️

Next steps 🪧 

, before we can force the IRD to stop leaking taxpayers' private data, we have to find out how many people are affected. That's why we've launched this tool at www.IRD-Leak.nz.

Next steps are more legalistic and political. It is, frankly, pathetic that the Minister of Revenue hasn't issued a single media comment on what has happened under his watch.

Running for political cover on this one, simply will not cut it. 

We'll keep you posted.

Jordan Williams Executive Director New Zealand Taxpayers’ Union

Ps. Copied below is the media release which tackles some of the fibs being told by Inland Revenue's spin doctors.

MEDIA RELEASE
Taxpayers' Union launches tool for taxpayers to find out whether their personal data has been exposed in IRD data leak

TUESDAY 17 SEPTEMBER 2024
FOR IMMEDIATE RELEASE

The Taxpayers’ Union has launched an online Privacy Act Request tool at www.IRD-Leak.nz for taxpayers to find out whether their private information has been handed over to social media platforms by the Inland Revenue Department.

Taxpayers' Union Executive Director, Jordan Williams, said:

"Last week IRD were caught red-handed misusing private taxpayer information. Instead of respecting taxpayer privacy, they extracted the data from the tax system, shared it with their 'marketing department' and deliberately sent it onto social media companies.

"Many New Zealanders choose not to give their personal information to foreign social media giants. It's beggars belief that IRD chose to do it for them.

"Taxpayers have no choice but to share private and personal information with Inland Revenue. The quid pro quo is that the information is handled securely. That trust has been completely betrayed and justifies heads rolling at the very top.

"Instead of being upfront and truthful, IRD have now been caught lying to New Zealanders about the data breach.

"First they told media that there wasn't any complaints about the practise. That was untrue.

"Now they're trying to seed confusion by giving bogus assurances about 'hashing'. IRD's leadership team will know full well that it does not provide protection. IRD have even admitted that the whole purpose was to enable social media companies to identify and target individual and identifiable taxpayers.

"The 'hashing' is a convenient PR distraction tactic. It demonstrates a total arrogance towards taxpayers IRD are supposed to serve.

“Make no mistake, this is the biggest breach of taxpayer privacy in New Zealand's history, affecting hundreds of thousands of taxpayers, if not more. Having consulted with taxpayer groups throughout the english-speaking world, we cannot find any example of a privacy breach anywhere near this scale," said Mr Williams.

www.IRD-Leak.nz allows taxpayers to file a Privacy Act request with Inland Revenue to requires the Department to inform them whether the taxpayer's private information was leaked.

For transparency, the site was commissioned and is hosted by the Taxpayers' Union. Unlike IRD, the Taxpayers' Union respects taxpayers' rights to privacy. The site uses a New Zealand-owned and operated software tool to generate and send the Privacy Act requests.

ENDS