Why the privacy watchdog is cutting jobs when privacy breaches are going up

The Office of the Privacy Commissioner (OPC) is the government agency that looks after your personal information. It investigates complaints when someone's privacy has been breached and handles reports of serious data leaks. Now, the office is planning to cut nine jobs and create two new ones, which would shrink its staff by about 15 percent. It has 46 filled roles at the moment. The OPC told staff the cuts are happening because the government has refused to increase the office's funding. (RNZ)

The Public Service Association (PSA), which is the union representing many public service workers, says the cuts are the fault of a government that knew for years the office did not have enough money to do its job properly. PSA National Secretary Fleur Fitzsimons said privacy complaints are taking between several months and a year to be sorted out at the OPC. She said the office was already stretched thin and still faced a 6.5 percent funding cut. (PSA)

The jobs at risk include staff who investigate the most serious privacy complaints, including ones of a sexual nature. The OPC's role dedicated to working with Māori is also at risk, and what's left of it would be folded into another team's job description.

The timing has drawn attention to how much work the office is dealing with. According to OPC figures cited by the PSA, privacy complaints rose 21 percent in the past year, and serious privacy breach notifications rose up to 43 percent. Fitzsimons pointed to the ManageMyHealth data breach, which exposed the health information of 127,000 New Zealanders in January, as an example of what was at stake.

The OPC's annual report for 2024/25 said staff leaving and vacancies had pushed salary costs below budget by $380,000. The report also said funding remains limited, and that even when funding was increased, it was still below what the office said it needed to carry out its new responsibilities. The office is also no longer allowed to run deficits to cover shortfalls, according to RNZ. (OPC Annual Report 2024/25)

The OPC is a public body set up by law to operate independently from ministers. It was established under the Privacy Act 2020 and is publicly funded. (OPC)

Public Service Minister Paul Goldsmith said the OPC was not asked to make any savings in this year's budget. He said tough decisions have to be made because the government is running large deficits and wants to get the country's finances back in order.

There is a gap between what Goldsmith said and what the OPC is dealing with. Not being told to find savings is not the same as getting enough money to do the job. The OPC's annual report says its funding has not kept up with the responsibilities it was given under the Privacy Act 2020, and the office can no longer run deficits to make up the difference. The fact that staff departures and vacancies had already cut salary costs by $380,000 suggests the office has been coping with pressure through people leaving, not through any planned reduction.

The OPC's situation shows how a public body can get caught between being given more legal responsibilities and not getting the funding to match. The Privacy Act 2020 expanded the Commissioner's powers. Complaint volumes and breach notifications are both rising sharply. The team that investigates the most serious complaints, including those of a sexual nature, is the part the PSA says is now on the line.

Fitzsimons called the 6.5 percent funding cut paying for "tax cuts for landlords," which is political rhetoric, but the funding trend is documented in the OPC's own annual report. The office has said, in its own words, that even the increases it received were below what it recommended for its new powers. The Māori engagement role being removed as a standalone position also sits against the public service's broader commitments under Te Tiriti o Waitangi obligations, which agencies are expected to act on in their day-to-day work.

It is unclear whether the two new roles the OPC wants to create will pick up any of the work at risk, or whether the restructuring just reduces what the office can do overall. The OPC has not publicly explained which roles are being cut and which created. The PSA's account is the most specific picture available so far of where the reductions will fall.

For people waiting months to a year for their complaint to be resolved, and for organisations that have to report breaches, the practical question is what level of capacity the government thinks is enough for an agency whose workload is going up by double-digit percentages every year.

The broader context here is that the OPC is being asked to do more with less. The Privacy Act 2020 gave it new powers, complaints and breaches are rising fast, and the office can no longer run deficits to make up the funding gap. The people who investigate the most serious privacy breaches are the ones whose jobs are now at risk.