Stevens, Robert --- "Information matching - if you've got it, why not use it?" [1995] PrivLawPRpr 94; (1995) 2(8) Privacy Law & Policy Reporter 145

---

---

Information matching - if you've got it, why not use it?

Robert Stevens analyses our reactions to data matching.

In this article I ask what it is about information matching that people object to, and then I consider how a democratic government should take account of those objections. I go on to suggest some rules which can be derived solely from the government's self-interest and which it might reasonably impose upon its information matching activities, and I briefly examine the degree to which those rules are now embodied in NZ's Privacy Act 1993.

Information matching is, roughly speaking, the comparison of one body of information about a group of individuals against another body of information, with the aim of checking that the information about an individual is not inconsistent. These days it is a lot easier to do this than it ever was before, because the two bodies of information are probably already held in a computerised form, and one thing that computers do very well and very cheaply is to compare and sort lists.

Typically, the information is held by two different branches of one organisation. Let's imagine that this big organisation has employee records held by the Human Resources department, and payroll records held by Accounts. Wouldn't it be sensible every now and then to ask the computer to just compare one lot of data with the other and tell the organisation of any people who it is paying wages to who don't show up on the records of who is in what job? And, moreover, wouldn't it be a bit silly not to run that sort of check? It's an elementary audit precaution.

Now let's take a different example, where the information is held by two branches of government. The US had a draft list, from which people were called for military service and on which it was a legal requirement to register. There was some reason to think that not everybody who was in their teenage years and resident in the US had in fact registered for the draft as they were supposed to do. Somebody realised that teenagers were routinely applying for driving licences, for which they had to be resident in the country and produce some proof of age. So they got the computerised lists and compared them, and they found a lot of people who had somehow omitted to register for the draft.

In NZ there are a lot of people who receive an unemployment benefit from Social Welfare, and even more people who pay income tax through deductions from their pay made by their employers. If a person is in both groups at the same time, there are a few questions which Social Welfare might reasonably want to put to that person. Wouldn't it be rather silly not to run that sort of check? Why would anybody object to that information matching unless they were trying to cheat the system?

But people in their droves do object; in fact it was one of the strongest concerns behind the push for privacy legislation in NZ. I'm interested to know why.

Reactions to matching

At one level, I think that there's a simple emotional reaction against being spied upon. Would you go through your partner's wallet or handbag when they were out of the house? How would you feel if you found that your partner had been doing that to you? Most people feel quite an intense reaction against that, even though they quite honestly have nothing to hide - or at least haven't left clues in their wallets and handbags. I think that the anger at having your handbag rifled through is not just because you resent your partner (of all people) doubting you; the feeling of invasion might be just the same if the search was done by a visiting tradesperson or by a work colleague. It's to do with a personal space that you expect to be treated and respected as such. It's to do with privacy; pure and simple and instinctive.

But it isn't that the handbag or wallet is always beyond the bounds of search. How outraged are you if the airport security people ask you to open up the handbag and then they go through it? Again your character is being doubted, and the same personal space is being invaded, but this time you knew that it was likely to happen, and knew why, and you knew that you could have been picked out at random. For some or all of those reasons, it's not nearly so upsetting and you rarely see arguments at the airport security counters.

At another level, more reasoned but perhaps less intense, there's a reaction against the use of information which you gave for one purpose being put to another purpose. But why should we object to that, as such? Isn't the objection really against the fact that this is done with the aim of catching you out, of tricking you, and of treating you as being untrustworthy?

Imagine going to your doctor about some health problem, and the doctor says that it could be something you picked up in Fiji when you'd been there on holiday. You wonder how the doctor knew about your holiday, and then you remember that you got the doctor to authenticate the photograph for your passport renewal application, and you probably mentioned it to her then. Are you upset that the doctor has remembered this, or even recorded it on your file, and brought that incidental knowledge to bear on this separate consultation? I don't think that it would upset me at all.

Now, picture a policeman who comes to your home after you reported that you'd been burgled. The policeman has looked up all the information you provided three years ago for your firearms permit, and asks what happened to the deadlocks you said then that you had got fitted, but actually never got around to doing. Are you outraged? A bit, I'd guess.

Thirdly, imagine this is the village in the TV programme Heartbeat. The doctor is married to the policeman and they share information all the time. The policeman who considers your firearm permit application has recommended against it on the grounds that the doctor has been prescribing you antidepressants. How do you feel? You'd complain to the Privacy Commissioner immediately!

Finally, imagine that the pillow talk between the policeman and the doctor sometimes gets a bit garbled, and it wasn't you but your father who was taking the Prozac. Your firearm permit was declined and it wasn't until later that you discovered why. I think your degree of outrage could well lead to a breach of the peace.

None of these examples is actually 'information matching' as defined in the Privacy Act because they only involve information about one individual at a time. The Act's controls on information matching only apply where the two records being compared each contain details about ten or more individuals. However, in talking to people about these matters I have never been told that the numbers matter at all to objections against the process; if an individual is upset at some aspect of information matching, they are upset at an individual instance, whether it has happened to them or to somebody else.

Explaining the reactions

In considering the above examples and others, and in talking to many different people about the subject, I have come to believe that the reaction and intensity of outrage to information matching is triggered by the following factors:

• The combination of the two pieces of information coming as a surprise.
• One or both pieces of information having been given in a situation where confidentiality was expected.
• The combination of the two pieces of information being used not to benefit you, but to catch you out.
• Some adverse action taken against you based upon a mistake of fact.

I'd suggest that the second factor, the expectation of confidentiality, might be seen as just a source of particularly acute surprise that the match of information has occurred. If so, the measure of outrage felt by the subject of information matching may resolve into the degree of surprise that this combination of information has occurred, the degree of disadvantage suffered by the individual as a result of that matching process, and the severity of any adverse action taken erroneously.

Now let us move to some more examples and scenarios, to see whether the theory works out.

• Your income tax return is questioned because it doesn't look to be consistent with last year's return. You're being doubted, but you're not at all surprised that IRD compare one year's figures with the next year's, and you don't regard it as particularly objectionable.
• Your income tax return is questioned because it doesn't look consistent with what your major client told IRD that it had paid out to you. You're being doubted, you're a bit surprised that IRD does that kind of cross-checking, but you did at least expect that the client would have to make its accounts available to IRD and you think that you should have realised that the match was likely to happen. So you're cross, but not outraged.
• Your income tax return is questioned because it doesn't look consistent with what you told your bank when you applied for a loan. You're being doubted, the combination is really surprising, and you expected that the bank would keep your dealings confidential. You would be outraged.

Now you can increase the outrage of that last case by imagining that, based mistakenly on the information given by another customer of the same bank who has the same surname and first initial as you, IRD has not only queried your return but has actually issued a form of charging order to seize some of your assets.

That set of examples follows the theory, but of course I selected or invented them. Can you think of a case where you'd feel outrage at information matching, but the matching would not come as a surprise to you?

Let's leave the individual to one side for the moment, outraged or not, and consider the position of the agency which wants to carry out this information matching. What has it to lose? Basically, it could lose friends because its activities would outrage some of its customers to the point where they wouldn't be good customers in the future. The agency could make some wrong decisions in individual cases if it acts on apparent discrepancies which turn out to be inaccurate, but these actions can always be reversed when the customer complains, or they can be averted by giving the customer notice of adverse action before the agency takes that action. The real problem for the agency is the possibility of alienating significant numbers of its customers if it depends upon their ongoing support. Thus IRD promises confidentiality so that it can collect revenue from all those people who would rather not add tax offences to their other illegal activities, promising the thieves and the brothel operators that their secret sources of income can stay secret if they will only declare some figures for their ill-gotten gains and pay taxes on them. I knew that IRD did this, but it still came as something of a shock to see written large as life in IRD literature that if you received income from 'illegal activities or prostitution' you should use an IR3 form. So the government has already decided that it will offer and honour a promise of confidentiality in some instances, presumably because the interest in collecting revenue is seen as outweighing the interest in identifying and prosecuting persons who make money from illegal activities.

In the same way, the government might decide that it has an interest in some other information being given fully and truthfully, and that this would be jeopardised if it were to become known that the information would be put to other uses which could disadvantage the individual who had to supply it in the first place. Thus it is conceivable that the government would not want to match census data in case the quality of information should suffer as a result. Many years ago I was a census officer in a part of an English city which had a high proportion of recent immigrants. I was equipped with leaflets which explained in Punjabi, Hindi and Gujarati (and a few other languages) that none of the information collected could be accessed by the immigration authorities. I discovered that remarkably few of the persons who spoke those languages and did not speak English could read. I also discovered that if you offered a Punjabi speaker a leaflet in Gujarati you might be attacked because there was virtually a civil war going on between the mother states at that time. But we conversed chiefly through using their children and grandchildren as interpreters. I had no way of knowing what comments these kids were delivering at the same time as to the trustworthiness of myself or the British government. Sometimes a single sentence of mine seemed to require a lengthy speech in translation, but more often the reverse was the case.

I think that any government these days wants to be seen as being efficient and fair. That doesn't mean that it sets out to be loved by everyone, but it will normally seek to avoid outraging significant numbers of its citizens (or 'customers', as it now regards them). Equally, the government will assess its operations in terms of their efficiency and, more importantly, the opportunity to demonstrate that it is being efficient. Apart from all the operational reasons why the government needs willing co-operation from its customers, there is always the next election to consider. And I ought to add that there is nothing wrong with government viewing its operations in this self-interested way; that is the mechanism by which democracy is intended to work.

Criteria for data matching

If I am right in my observations about what outrages us in information matching, and I am not being either simplistic or overly cynical as to the government's interest in these matters, we should be able to map out a set of criteria for the selection of information which would be suitable for matching, and an outline for the operation of the selected information matching programmes. We could then give logical answers to that question of why we do or don't use the information which the government (in one form or another) already has in one pocket to check the corresponding information it has in another pocket.

Robert Stevens, Auckland Manager, Office of the NZ Privacy Commissioner, presented this paper at the Privacy Issues Forum 1995, in Wellington*

The second part of Robert Stevens' article will be published in the next issue of the Reporter.

* Mr Stevens concluded his paper as follows: 'I must conclude with some caveats and a disclaimer. First, my analysis proceeds from a very informally surveyed impression of public opinions and sensitivities in this area, and from my own subjective reactions to examples I have conjured; I could be wrong about the generality of these reactions. Second, even if I am right about these triggers of relative degrees of outrage, that would probably be a situation specific to one society at one time. Third, this is the first occasion on which I have set out these ideas on paper, or in any ordered way exposed them to an audience, and they might turn out to be logically, factually or even politically flawed! Finally, they are my own thoughts, and are neither the policy nor the stance of the Privacy Commissioner'.