Last year the OECD did a survey* of budget changes in ‘privacy enforcement authorities’. It was revealing. I was taken aback when I saw where New Zealand sat in relation to our most commonly compared OECD economies.

This chart shows that for 2016-2017, New Zealand was one of only two countries whose funding support for privacy law enforcement actually went backwards. It was such a striking visual depiction that I took it to my financial estimates hearing with Parliament’s Justice Select Committee.

The OECD work prompted me to undertake further research to see where we actually stand in relation to other countries.

It turns out that comparing ourselves against our fellow authorities is not as easy as you would think. We could compare ourselves against a similar sized country such as Ireland, whose population of 5 million is close to our own. Ireland also has a Data Protection Act that applies across the entire economy. In 2014, when I became the Privacy Commissioner, my office’s annual budget was around $4 million and Ireland’s authority was €3 million.

Now, in 2019, my office's budget is $5 million, while my Irish counterpart’s is €15.2 million. In $NZD that’s just shy of $27 million. Should that be my annual budget? The comparison is not quite as like for like as it appears at first blush: the Irish authority oversees and regulates some of the biggest and most data rich companies in the world, which are located there for tax reasons.

What about Australia - our closest neighbour - geographically and culturally, if not legally? The Office of the Australian Information Commissioner this year received an extra $25 million over three years for its privacy functions (it is also responsible for freedom of information, which in New Zealand is looked after by the Ombudsman). Given that Australia has five times New Zealand’s population, should I get $5 million more to keep up? Perhaps it should be more? After all, Australia’s federal privacy law exempts businesses with a turnover below $3 million, and they have state commissioners in Victoria, Queensland, New South Wales and the Northern Territories. This means that $25 million increase covers a much smaller proportion of the economy than my office covers.

What about domestic comparisons? Well, the Ombudsman, an Officer of Parliament with many comparable functions receives $16 million per annum in order to cover (with some minor exceptions) the public sector of New Zealand. That’s three times the funding for about 40 percent of GDP.

The Royal Commission of Inquiry into Historical Abuse in State Care receives $78.85 million over four years.

The Royal Commission of Inquiry into the Attack on Christchurch Mosques has a budget of $8.2 million over an eight-month period.

So, with those qualifications and caveats in mind, here’s some ways of looking at how privacy law is funded in New Zealand, compared to a few selected others:

This chart illustrates the budget changes of authorities in US dollars - which means that exchange rate changes can have a substantial impact. We can see that Australia, Ireland, Japan and the United Kingdom have had budget increases beyond that of New Zealand. But we are a small economy – so what is the story in percentages? 

When we look at the percentages, we find that my office’s last increase in funding has been eclipsed by the funding changes in Australia, Ireland, Japan and the United Kingdom.

But money isn’t everything – it's people that get the job done, so how do we fare in that respect?

Looking at the percentage change in full-time equivalent staff, we can see that New Zealand has also been falling behind. For example, while we have grown from 30 to 38 FTEs, our Irish colleagues have increased from 31 to 100.

In recent years, ‘data is the new oil’ has become an accepted truism. And countries are safeguarding this new commodity through corresponding increases in the funding of their privacy enforcement authorities.

New Zealand is not at risk of falling behind; it has done so. This means we have to advocate for better funding support, but also ensure that we are using the resources entrusted to us in the most effective way possible.

In preparation for the Privacy Act 2020, we are reviewing all aspects of our operation to ensure we are getting the maximum benefit of our investment for all New Zealanders. We are calling that process Privacy 2.0 and you will hear more about this work in the coming months. 

International, OECD