Privacy Commissioner faces 15% staff cuts as funding stays flat
The Office of the Privacy Commissioner (OPC) has proposed cutting nine roles while creating two new ones, a restructuring that would shrink its workforce by roughly 15 percent, according to the Public Service Association (PSA). The OPC currently has 46 filled positions. The proposed cuts come as the government has refused to increase the office's funding, the OPC told staff. (RNZ)
PSA National Secretary Fleur Fitzsimons said the cuts were the direct result of a government that knew for years the office did not have enough money to do its job properly and chose not to fix it. She said privacy complaints were taking between several months and a year to be resolved at the OPC, and that the office was already stretched thin yet still faced a 6.5 percent funding cut. (PSA)
The roles under threat include staff in the team that investigates the most serious privacy complaints, including complaints of a sexual nature, according to the PSA. The OPC's dedicated Māori engagement role is also at risk, with what remains of it folded into another team's job description.
The timing has sharpened attention on the office's workload. According to OPC figures cited by the PSA, privacy complaints rose 21 percent in the past year, and serious privacy breach notifications rose up to 43 percent. Fitzsimons pointed to the ManageMyHealth data breach, which exposed the health information of 127,000 New Zealanders in January, as an example of what was at stake.
The OPC's annual report for 2024/25 noted that staff departures and vacancies had driven salary costs below budget by $380,000. The same report stated that funding continues to be limited, and that even when funding was increased, it was below the level the office recommended to carry out its new responsibilities and powers. The office's ability to run deficits to cover shortfalls has now come to an end, according to RNZ. (OPC Annual Report 2024/25)
The OPC is an independent Crown entity — a public body set up by law to operate at arm's length from ministers — established under the Privacy Act 2020 and publicly funded. (OPC)
Public Service Minister Paul Goldsmith said the OPC was not asked to make any savings in this year's budget. He said tough decisions have to be made because the government is running substantial deficits and is serious about getting the country's finances back in order.
The gap between Goldsmith's statement and the OPC's situation is where the tension lies. Not being directed to find savings is not the same as receiving enough base funding to do the job. The OPC's annual report makes clear that its funding has not kept pace with the responsibilities assigned under the Privacy Act 2020, and the end of deficit-running removes the mechanism the office had been using to bridge the gap. Staff departures and vacancies already suppressing salary costs by $380,000 suggest the office has been absorbing pressure through turnover rather than through any planned reduction.
For those working in the regulatory state, the OPC's position is a case study in how an independent Crown entity can be caught between rising statutory demand and flat funding. The Privacy Act 2020 expanded the Commissioner's powers and responsibilities. Complaint volumes and breach notifications are both rising sharply. The investigative capacity for the most serious complaints, including those of a sexual nature, is the part of the operation the PSA says is now on the line.
Fitzsimons's framing of the 6.5 percent funding cut as paying for "tax cuts for landlords" is political rhetoric, but the underlying funding trajectory is documented in the OPC's own annual report. The office has said, in its own words, that even increases it received were below what it recommended for its new powers. The Māori engagement role being disestablished as a standalone position and folded into another role's description also sits against the public service's broader commitments under Te Tiriti o Waitangi obligations, which agencies are expected to give effect to in their operational practice.
What remains unclear is whether the two new roles the OPC proposes to create will absorb any of the functions at risk, or whether the restructuring simply reduces the office's overall capacity. The OPC has not publicly detailed the rationale for which roles are being cut and which created. The PSA's account is the most specific picture available so far of where the reductions will fall.
For complainants waiting months to a year for resolution, and for the organisations subject to breach notification obligations, the practical question is what level of regulatory capacity the government considers sufficient for an independent Crown entity whose workload is rising by double-digit percentages year on year.
The broader context here is that the OPC's situation reflects a structural problem faced by independent public bodies: their legal responsibilities can expand while their funding stays the same or shrinks. The Privacy Act 2020 gave the Commissioner new powers, but the annual report says the funding to carry them out has not followed. With the office no longer able to run deficits, and complaints and breach notifications climbing by double digits, the capacity to investigate serious privacy breaches is now the part of the operation most exposed.
