A data scientist wonders where his sensitive personal data ended up after he applied for a government job.
The company that conducted a criminal background check states on its website that it is connected to government databases, uses facial recognition technology, stores personal data in Australia and may share it with recipients in the United States. United.
When Dr. Karaitiana Taiuru recently applied for a job with a government agency, he said the recruitment consultant asked him to submit a selfie from his phone, as well as take his passport or driver’s license photo.
He didn’t give it much thought – until later.
“Just my professional experience and curiosity made me suspect that there was some sort of AI process going on,” he said.
“Then I realized it was either facial recognition or some kind of AI … and the data was not stored in New Zealand, nor by the Ministry of Health. Justice, but by an international society.”
The US-owned and Australian-based National Crime Check conducts criminal background checks on or for thousands of New Zealanders each year, and the same is true in Australia.
It is one of more than 3,000 entities registered to request the checks on behalf of others, through a system operated by the Department of Justice.
Each signs a ministerial contract to abide by New Zealand privacy laws and other rules, in what is a largely self-regulating system.
Taiuru asked how the system worked.
“My initial thought was, ‘this is the Department of Justice, knowing the controversy with facial recognition, Maori data sovereignty issues’.
“To begin with, I just assumed it was stored in New Zealand and I would have privacy.”
He had to make the request quickly, so keep going, he said.
The National Crime Check website says applicants must send a selfie of themselves holding their ID card.
It’s for its “advanced verification tool that will perform a biometric facial recognition scan by comparing your face/selfie with the photo on your driver’s license and/or passport.”
Data security was his top priority, he said.
“Our systems are connected to New Zealand government databases, so you can quickly get accredited criminal records, visa and right to work checks,” its website says.
In response to a question from RNZ, the Department of Justice said it “did not know they made that claim”.
“Being a registered third party does not provide a direct connection to the department’s systems,” Tracey Baguley, acting group leader of national service delivery, said in a statement.
Rather, it allowed the user to submit up to 200 check requests at a time.
“If an incorrect statement advertised by a registered third party comes to our attention, we may take steps to ensure that it is corrected.
“In this case, the department will follow up with National Crime Check,” she said.
RNZ asked National Crime Check about this.
The company declined an interview.
In a statement, he said, “No one actually has access to the Justice Department system.”
He had the authority to submit forensic checks on behalf of individuals through the Justice Department system, he said.
It also offers identity verification services, its website says.
The department is in charge of compliance, but said it does not monitor what organizations say about their services.
Organizations assess their compliance once a year.
Although the criminal background check system requires valid photo ID, the department said it does not use facial recognition and cannot comment on any registered third parties that do.
National Crime Check told RNZ it uses something called “liveness detection” to verify that the person in the selfie is a real person and is the person listed on the passport or driver’s license. conduct.
However, he also added that the data may also be shared, disclosed or processed elsewhere, such as in the United States, for certain purposes.
Having already shared her contact details and selfie through the ministry’s official system, Karaitiana Taiuru is not happy.
“I find it very disturbing,” he said.
“All of our ministries have an obligation to ensure our confidentiality to protect their data.
“And it almost feels like having no knowledge, they can’t be held accountable for what happens to our data. And I certainly expect a lot more from our government agencies.”
The parent company of National Crime Check in the United States, Sterling Check, claims to carry out more than 95 million background checks a year, with most completed in a single day.
In a statement on Tuesday, Sterling Check said it and its companies take data privacy and compliance very seriously.
“We do not sell any information collected from their customers, prospects, sources, workers and/or website visitors to third parties,” the statement said.
“Any information collected is used to market and sell their services, operate our business, and provide background and identity verification services.”
It has just been certified in the UK to provide digital identity checks to UK and Irish citizens, including criminal background checks for employment.
The UK government says it is “working to develop the digital identity market without the need for national ID cards”.
New Zealand is working hard on a digital identity framework and its implementation, with new laws and technologies looming.