Identity Information Confirmation Bill

Tēna koe, matua Lindsay Tisch. I thank you, Mr Deputy Speaker, for the call, because only last week, on Thursday evening, prior to the House rising at 6 o’clock, I was addressing the very important issue of identity fraud. It is an important issue, one that has taken the time of this House, and now I have the opportunity to complete my address. What we have to do is discuss this whole issue, and the Identity Information Confirmation Bill needs to go through this House and off to a select committee.

The bill provides great assistance to companies that need to comply with the Anti-Money Laundering and Countering Financing of Terrorism Act 2009. In supporting this legislation one has to be ever mindful about the issue of privacy. We on this side of the House are really concerned about issues relating to privacy. [Interruption] My colleague Dr Ashraf Choudhary agrees wholeheartedly with that. We have Big Brother syndrome, we have the excessive powers of the State, and we have state-of-the-art technology, and everywhere people go today there are closed-circuit television cameras all around the place. So we are mindful of privacy, but we also know that that needs to be balanced with the issue of identity fraud.

Here are some facts for New Zealanders about identity fraud, which I found fascinating when I was having a look at the issue. The average amount of money lost due to fraud in New Zealand in 2009 was $1.5 million. The top four types of fraud reported are false invoicing, which is very prevalent; theft; bribery and corruption; and, of course, lending fraud. Ninety percent of those responsible for managing the risks of fraud do not hold any form of fraud management or investigation qualification.

Forty-two percent of New Zealand businesses were affected by identity fraud during the year. New Zealand police identified 900 cases of identity fraud in New Zealand last year, but they believe that they are only a fraction of the number of cases that actually occur. In a high-profile case of identity fraud, New Zealand fraudster Wayne Thomas Patterson was sentenced to 8 years in prison after being convicted of using 123 different identities. He stole $3.4 million in benefits in 2007.

Let me conclude by saying that we support this bill’s referral to a select committee, but we are ever mindful of privacy concerns, and we will be paying very close attention to the views and the recommendations of the Privacy Commissioner.

💬 Hon Simon Power: Who’s we?

H V ROSS ROBERTSON: We, I say to Mr Simon Power, are the members of the Opposition. We are concerned about the issues of privacy on this side of the House, even if the member on the Government benches might not be. We are concerned, we will take notice of any recommendations that the Privacy Commissioner puts forward during the select committee process, and we will take those recommendations seriously. It is obvious that the Hon Simon Power does not care about privacy. Tihei mauri ora.

The Identity Information Confirmation Bill is a difficult bill. There is a genuinely good purpose behind it, which is to prevent fraudulent activity—that is, claiming someone else’s identity for a fraudulent purpose. However, there is also a big downside. It is, in effect, a significant move in the direction of an electronic ID card, with all the civil liberties difficulties that that entails.

The Government databases for births, deaths, marriages, civil unions, passports, and citizenship will be at the service of not only public agencies but also private agencies such as banks, insurance companies, and credit agencies. Those private agencies will be able to have the identity of a person confirmed by the State and use that information for their own advantage.

It could also enable discrimination against people applying for jobs. For example, one of the pieces of information that employers and others will be provided with instantaneously by email is the place of birth of a person. That could open the way for discrimination on the basis of national origin, as it has in similar circumstances overseas. Take, for example, a South African - born job applicant who is faced with an employer biased against people who, in Paul Henry’s terms, are not real New Zealanders. The State will now provide any such discriminatory employer with an immediate check on the applicant’s place of birth, and that employer will be able to exclude that person from the job even before they have got to the interview. Potential employees are supposed to give approval for the employer to check State databases, but if applicants really want the job they would be unlikely to block it.

One thing that particularly concerns the Greens is that the system does provide for what is, in effect, an electronic ID card via a provision in clause 5, whereby identity information includes “the photograph in the passport”. This electronic photograph provides a biometric identifier of the person. There is already a photographic identification system operating at the SmartGates at New Zealand’s airports, which compares our features in photographs taken of us as we pass through immigration and customs with a simplified version of our photograph contained in the immigration and customs database and in the chip in our passport. According to the Customs Service website this “Facial recognition technology works by mapping the underlying bone structure of the face, for example, the distances between eyes, nose, mouth and ears. The measurements are then digitally coded to be used for comparison and verification purposes. With SmartGate, a mathematical formula is used to determine whether the photo of the traveller’s face matches their ePassport photo.”

So what is likely to happen under this bill—and fairly soon, I imagine—is that when people stand at the counter of their bank, a camera will take a photograph as they fill in, say, a form to start up an account. The form will contain a box asking whether they agree to the bank checking their identity, which if they want a bank account they will be likely to tick. The photograph the bank takes will then be emailed to the Department of Internal Affairs, which will respond in seconds as to whether it matches the digitally coded version of the photograph in its passport database. One might say that is the same as the existing SmartGate procedure, but, firstly, one has a choice of whether to use a SmartGate or to go through customs in a less biometrically intrusive way, and, secondly, do we really want all kinds of private agencies such as banks, shops, insurance companies, and credit agencies checking us in this way? It is true that under clause 13 Government officials must consult the Privacy Commissioner if they “are proposing to enter into a confirmation agreement that will allow a comparison of an individual’s photographic image against any photographic images of that individual”. Such consultation with the Privacy Commissioner is good, but in reality it would only slow down, not stop, the creep towards a universal ID card and all the ethical problems associated with it. If this bill is passed, facial recognition systems may become commonplace in banks and in larger shops.

There is already a debate about privacy problems associated with facial recognition systems, particularly around their use on the Internet. Google already has a facial recognition system in Picasa to allow people to tag a particular individual in their own photos on the Picasa photo storage site. It can scan thousands of such photographs in an individual set to tag individuals in this manner. Google was also going to introduce a more general facial recognition search function on the web, but pulled back because of a bit of reaction as to the privacy implications. Another agency, face.com, already finds photos of people by searching Facebook sites. One can imagine the problems here not only for people’s privacy but also, for example, for a woman trying to stay away from a violent, possessive former spouse. If the woman happened to be snapped in a group picture at some event, perhaps without her knowledge, the picture could be put on the Net and discovered by the former spouse, who is chasing her by using facial recognition technology.

The debate over privacy issues around facial recognition systems and ID cards is growing around the world. In Britain, the Liberal Democrats made privacy issues a major issue in their election campaign, and the very first bill introduced by the new Conservative - Liberal Democrat coalition was the Identity Documents Bill, which cancelled the Labour Government’s programme for a universal ID card, a programme that was already under way. The bill cancelled all those ID cards that have already been handed out and abolishes the national identity register.

The British Home Secretary, Theresa May, explained to Parliament on 9 June: “Photographs and fingerprint biometrics will be securely destroyed. This will not be a literal bonfire of the last Government’s vanities, but it will none the less be deeply satisfying. The national identity register will then cease to exist entirely.” The Home Secretary also said such moves were not “just about saving money”—which was estimated to be about US$6 billion—“It’s also about principle … We did believe there was a liberties argument for not enforcing ID cards on the British people.” Deputy Prime Minister Nick Clegg said: “Cancelling the scheme and abolishing the National Identity Register is a major step in dismantling the surveillance state—but ID cards are just the tip of the iceberg. Today marks the start of a series of radical reforms to restore hard-won British freedoms.” There is also an intention to abolish biometric fingerprint passports, which was another British Labour Party measure.

In New Zealand we are not “dismantling the surveillance State”, to use Nick Clegg’s words, but extending it, not only through this bill but also through continually expanding the number of linkages between the database of one Government department and the database of another. This is called data matching, and there are now around 50 bilateral operating programmes linking the databases of departments, covering the Customs Service, the Inland Revenue Department, ACC, the Ministry of Justice, the Immigration Service, the Ministry of Social Development, the Ministry of Education, and the Department of Internal Affairs.

The bill before us allows this data matching in terms of confirmation of identity to extend well beyond existing State agencies to a whole range of private agencies in New Zealand. This bill will also, by its example, encourage more private agencies to keep their own identifying databases of people, including digital photos or digitally coded representations of photos matching those in the Passports Office database.

The Identity Information Confirmation Bill is not part of what Nick Clegg calls the dismantling of the surveillance State; rather, it is a step towards such a State. For that reason the Green Party will be voting against this bill.

It is quite distressing that my colleague Keith Locke across the House feels biometrically violated by the Identity Information Confirmation Bill, and I hope that it is not too painful. It was interesting that he reflected on the moves by the administration in the UK to dismantle the system, just as the Labour Party is quite keen to dismantle recent changes in our economy by introducing capital gains taxes, increased tax rates, and other things. I suggest to the biometrically violated member that any increases in tax by those people across the House will violate him to a far greater and a far more painful degree.

I think that my colleague from the Green Party is not thinking very clearly about the work that he has been engaged in this year. He was a member of the Foreign Affairs, Defence and Trade Committee when we worked very closely with industry in New Zealand, particularly the banks, to come up with arrangements for strengthening our anti - money-laundering and counterfeiting legislation earlier this year. This particular bill will help to prevent the use of fake identities, and, as we have discovered in this House, even some of our former members have created fake identities. That is absolutely outrageous.

The bill will extend the use of the web-based Data Validation Service to public and private sector agencies on a strictly need-to-know basis. I do not think that the Green member should feel biometrically violated at all, because that information will be used on a strictly need-to-know basis. Agencies—and by “agencies”, I am talking about banks, for example—will check whether the identity information presented by a customer is consistent with that held by the Department of Internal Affairs through the citizenship register, the passports database, and the various registers of the Births, Deaths and Marriages registry office.

My Green colleague will remember very specifically that the Anti-Money Laundering and Countering Financing of Terrorism Act requires all people who go into the bank to conduct a transaction to take photographic identity information with them, to prove that they are who they say they are. It is a critically important tool of our society that we have this information available for preventing identity fraud and for reducing compliance costs.

At the same time I say the Government is mindful of privacy concerns, because it does not want anybody to feel biometrically violated. Any agency using the tool must have the consent of customers. People have to agree to this; they cannot just be violated without agreement. Any agency will require individuals to give their permission. The decision as to whether an individual provides his or her identity is left entirely to the individual concerned, and if the individual does not do it, he or she will not get a bank account. Agencies must also have an alternative process for dealing with people who do not consent to a check by the service. That means that those people are not forced into consenting.

With those few words, I say I totally disagree with the previous speaker, Keith Locke, and I totally support the clauses of this bill. Thank you.

Thank you, Mr Deputy Speaker—

H V Ross Robertson: Salaam alaikum.

Salaam alaikum to the member. First of all, I say that it is interesting to hear from John Hayes—

💬 John Hayes: Salaam alaikum.

Salaam to that member, as well. He was criticising a Green MP who had, I thought, highlighted some important issues. I know that the Greens disagree with the Identity Information Confirmation Bill and will not be supporting it, but I thought that Keith Locke highlighted some key issues in this bill. Hopefully, when the bill goes through the select committee process, some of those issues will be fixed.

This bill is important in order to provide a consent-based service to allow both private and public sector agencies to check identity information. I will talk about the issue of consent later on. I think that issue will be very important, particularly when dealing with people like the migrant community and people who are not sure why they have to give this information. Some bullying tactics could be used on people to make them provide information that they may not want to give consent to sharing. That will be an important issue for a lot of people.

The Identity Information Confirmation Bill extends the use of the Data Validation Service to public and private sector agencies on a strictly need-to-know basis, as John Hayes said before. Clearly there are privacy issues. As Ross Robertson was saying earlier, that is where we will have to be very careful as this bill goes forward in the select committee. We will have to listen very closely to what the Privacy Commissioner has to say about some of the privacy issues in this area. This bill is important, and this kind of service will be important in ensuring compliance with anti - money-laundering and counterfeiting measures and in protecting against terrorism and those kinds of issues.

It is important for this bill to go forward, but those two issues, as I mentioned—the obtaining of consent from people and also the privacy issue—will be two key areas where we will have to—

H V Ross Robertson: The Privacy Commissioner’s recommendations are very important.

That is right. As Ross Robertson has rightly said, we will have to listen to the Privacy Commissioner’s views on this bill as we go forward. Clearly we will be looking to the Privacy Commissioner’s report.

Identity fraud is a very serious and growing problem in New Zealand, and we are supporting this bill for that reason. We know that some issues have arisen recently in the local elections—in the Papatoetoe area, for example—that could be related to some of these identity issues. I think it is a very important issue, and this bill is very timely from that point of view, as well.

The accessing of information held by the Department of Internal Affairs by private and public agencies that is proposed in this bill is facilitated by the digitisation of the department’s records, which was kick-started under the previous Labour Government. The recent saga of David Garrett—“The Jackal”—shows how easy it is to commit identity fraud. It is very unfortunate—

💬 Su’a William Sio: Especially from an ACT member.

—particularly from an ACT member who believes in making these kinds of laws to make it very difficult for others to do these things. It is amazing. It has been said that the former member made an application for a passport—a second passport, if you like—but that he never travelled overseas on that passport. One day, when it comes out, it will be interesting to know whether he actually used the second passport. A person could get out of New Zealand with his or her original, real passport, but what about somebody using that passport overseas? How would we know whether it was used overseas? It could be taken in the person’s bag and used somewhere overseas. Hopefully those issues will come out one day, and we will all find out.

I will be very keen to see whether the ACT Party will support this bill. Those members do not seem to support the notion of transparency and openness when it comes to their own MPs. I think it would be interesting to hear. I see that no ACT Party MP is present to say what ACT will do about—

💬 Mr DEPUTY SPEAKER: The member cannot refer to the absence of members.

We want to make sure that going forward this bill has the support of, hopefully, most of the political parties in Parliament. Too much identity fraud is happening in New Zealand at the moment, as has been highlighted by my colleague Ross Robertson. He listed a number of the frauds that have happened in this country in terms of money being withdrawn from banks and also in terms of theft, bribery, corruption, and lending fraud. I think this bill is important, and it has come out in a very timely fashion to respond to identity fraud.

It is important particularly in respect of the diversity of our population. People come from different backgrounds. Some people change their name, particularly their first name. When some people come to Western countries they change their first name to make it easier for other people to understand. That can be an issue, particularly in relation to issuing passports and certificates. I think that is something we have to look into.

Going forward, I am particularly worried about the consent provisions. As I said earlier, ethnic communities and migrant communities often come from countries where they have not had a good experience, if you like, with the police and with State agencies. When they come to this country they are often very scared when dealing with the Government and the police. They can be forced in some different ways to provide consent to give their information. We will have to educate our people about the fact that they have the right, under this bill, not to provide their information without proper consent. I think that is important. I am sure members across the other side of the House will be writing to ask some of the migrant and ethnic communities to make submissions on this bill. I think it is important for them particularly.

H V Ross Robertson: In Manukau we have so many different groups.

Exactly—180, or something. Mr Ross Robertson deals with them all the time. He knows the vulnerability of those people. People who cannot understand English very well can easily be pushed into giving a consent that they otherwise may not want to give.

Some members on this side of the House are very familiar with some of those issues among the ethnic communities. I hope that Mr Simon Power is listening to this. I know he lives in the beautiful town of Palmerston North, which probably does not have such huge problems. But in the very diverse situation in Auckland we have people who are not very familiar—and I am very serious about this—with the local law. Particularly if somebody is asking for consent to give some information, they might very easily give that consent, when they do not have to. Those issues concern my community.

I know that Mr Bakshi on the other side of the Chamber is probably listening too. He will know that there are vulnerable people out in the community who would like to have some assurance that they will not be forced into giving consent to provide this information, particularly to the private sector. I am more concerned about that. I do not have a serious concern at all about giving information to public departments, to the public sector people, but there is a real concern about giving information to the private sector.

Sat sri akaal, Ross Robertson, and Dr Ashraf Choudhary. Mr Deputy Speaker, the members called everyone with their salaam, but did not address me, so I am extending the greetings now.

I stand to support the first reading of the Identity Information Confirmation Bill. Dr Choudhary has just mentioned a few cases, and I think they are very relevant in today’s world. In recent times we have seen many cases of fake identities. We need to stop the practice, and I think this is the most important and appropriate time to pursue this bill. Under the present Privacy Act of 1993, Government agencies have access to match information about individuals, and discover whether the information is accurate. But the private sector has limited access to such information. That sector is not able to confirm whether the information provided by its clients is correct. The protection of identity is very important in today’s age.

The purpose of this bill is to help combat identity fraud. In this modern day and age this is a real problem. We regularly hear news of people being hounded for debts, when those people have absolutely no idea of how the debts came about. Under this bill, with the consent of individuals, both private and public sector agencies will be able to check identity information held on Government databases, such as the information held by the registry of passports and the Registrar-General of Births, Deaths and Marriages. To combat the misuse of this facility, the Identity Information Confirmation Bill will offer the use of the Data Validation Service to the public and private sector, on a strictly need-to-know basis. Data validation will permit agencies to check whether the identity information produced by a customer is reliable and consistent with the information held by the Department of Internal Affairs, through the citizenship register or any other register they have.

This bill will also allow banks and other financial institutions to carry out more dependable assessments on customers who require loans. That will extend the application and compliance of the Anti-Money Laundering and Countering Financing of Terrorism Act of 2009.

On the other hand, the Government is fully aware of privacy concerns. The consent of the customer is paramount; the customer is not compelled to consent to that background check. Personal information is protected, and the Data Validation Service will only confirm the accuracy of a person’s information. It will not reveal any other personal information.

This bill also protects privacy in other ways. The Privacy Commissioner will have the authority to compel the department to provide a report to her on the operation of the service. This is to monitor the consistency of the information delivered to various agencies, as they will need to demonstrate a genuine need for this service. Those organisations will also be listed on the department’s website.

The Identity Information Confirmation Bill has introduced a solution for our modern times. The National-led Government has assessed this problem and has acted promptly. This bill will help in the prevention of crime, particularly of identity-related crime, and will also ensure that public agencies can use, and if necessary record, criminal identity information. To protect the privacy of personal information, any agency using this service will need to enter into this agreement with the chief executive of the Department of Internal Affairs or the Registrar-General of Births, Deaths, and Marriages, or both. Private agencies will have limited ability to check whether the identity provided to them is correct. I commend this bill to the House.

I am pleased to take a brief call on the Identity Information Confirmation Bill. Most of the arguments have been made, so I shall repeat just a few of them.

💬 Hon Simon Power: Ha, ha!

But the important ones. We have had one good comment about Feilding, I say to Mr Power.

💬 Hon Simon Power: Fine place.

The member may make a second one. Ashurst was where I lived, so I do know the place well.

Identity fraud occurs when a person’s privacy is breached—that is the most important aspect of it—and someone pretends to be another person and takes on his or her persona in order to access resources of some kind, generally credit, moneys, etc., for personal gain and in that person’s name. It is not a victimless crime; there are often victims. But often we do not fully understand what the effects of the crime are on the victim. If someone simply has to pay for somebody else’s theft of one’s identity, then that is one thing, but the scar of the emotional effect of having one’s identity stolen can last a long time for a person. Therefore, it is a serious issue. Organisations are also victims; businesses can be victims when they suffer financial and reputational losses in the same way.

The issue really was brought into quite sharp relief for this House, as others have said, when a former member of this House in a previous life stole somebody else’s identity, which showed how relatively easy it was to do. That person has paid a heavy price for that action and thoughtlessness. But the effect of the illegal action on the family of the child whose identity was stolen has also come to light in this period as well. Likewise, New Zealanders were shocked when a couple of Mossad agents stole the identities of children and took up passports in their names. They travelled to New Zealand and used New Zealand passports for their illegal activities. So there are those kinds of cases as well. There is the well-known case of Wayne Thomas Patterson. He used over 123 different identities to commit fraud of $3.4 million. These cases all tell us that indeed there are problem and they need addressing. This bill sets out one way of trying to address those problems. Whether this legislation addresses all of the problems is something we are not certain about, but we know there are problems to be addressed. Identity fraud has serious consequences, so it is important to support the Government to send this bill to the Government Administration Committee where it can get detailed examination by a whole bunch of other people who have experience either as victims or those who have dealt with fraud cases from a privacy perspective. For those reasons Labour will support the bill’s referral to select committee.

There is another aspect that concerns me. Certainly studies overseas talk about identity fraud and the extent of identity fraud that is taking place. Some studies show that it is about 2 percent. Some other figures we see in New Zealand suggest that some companies are saying it is much larger, although when they report about their own experiences, it is much smaller. New Zealand is unclear about the extent of our identity fraud, except for the types of cases that have come out that have shown us it is a problem that it is important for us to address.

The other point is that it is not easy to identify identity fraud. There are so many different ways that people can do it. The attempt in this bill is simply to match the data of somebody applying for some service with the information given to the service against reliable data that is in the State’s databases. That is a useful way to start. Whether that is enough, we are uncertain. This will test our own privacy laws, and the privacy laws in New Zealand are particularly good. They have held us in good stead over a long period of time. The very good Office of the Privacy Commissioner monitors this quite well and has been instrumental in taking New Zealand to quite a sophisticated level of data matching, because at the moment it keeps quite a good lid on the situation.

There are a number of good things about this bill. The most important one is that it is consent-based. I think that is a powerful aspect of this bill, seeing as it is opening a facility to the private sector, so people need to consent. But as my colleague Ashraf Choudhary said, that in itself raises a problem, which the select committee ought to examine in some detail. The select committee should examine how that consent is to be given and how the person acquiring that consent needs to know that it has been understood what the person is giving, particularly when it comes to people who are unfamiliar with the English language, with filling in forms, and with dealing with systems like that. Great care will need to be taken to ensure that the consent is available.

The other good thing is we are using databases that we currently have. The bill addresses, as the commentary states, some compliance cost issues at the moment to do with the Anti-Money Laundering and Countering Finance of Terrorism Act, which the bill addresses. Perhaps the other powerful aspect of this bill is that it involves the Privacy Commissioner, and in the regulatory impact statement it was the major mechanism by which some guarantees could be given. So there is a lot of work for the select committee to do on that particular aspect, as well. However, there are some risks, such as the amount of information that could be available to the private sector and how that information would be utilised. Imagine the case of a person in New Zealand on a work permit who applies for a job. There is a need to get the data right. Employers are aware that that permit has only a short period to run. They may be in a position to abuse the kind of information that could be available. I think that raises questions and I would be very, very interested to see in the report back how those guarantees will be given. The committee will have to look at safeguards.

I say to my good friend from the Green Party Keith Locke that it is precisely for these reasons that Labour is happy for this bill to be referred to the select committee so those kinds of guarantees that we require at least can be addressed, and it will go further if we can be satisfied that those conditions that we require have been met. The points that the Green Party raised are very good ones. We have seen that when we try to address one problem, it has unintended consequences. It is entirely possible that this bill will create some new ones, which in time will cause us greater difficulties. So for those reasons it is useful for us to send the bill to the select committee.

The final point I make is that—and Mr Power looks surprised—this will not be a cure-all for identity fraud. It cannot be. Identity fraud is an issue that is probably much wider and much more complex, and this approach to it cannot be the full solution, so I hope that we do not take these provisions as a cure-all. The select committee might have other ideas that it wants to propose to the House for us to look at. We are pleased to support the bill’s referral to the Government Administration Committee. But members on this side of the House have some very serious concerns and we look forward to those matters being addressed in the report back. Thank you.

I am so pleased to take a call on the Identity Information Confirmation Bill. As Dr Rajen Prasad has already said this evening, a number of the arguments for it have already been canvassed, so I will take a very brief call.

Firstly, I say that I have been the victim of identity fraud. I was overseas when it happened. Someone swiped my credit card and I ended up in a pretty difficult situation, so I know what it feels like to have that happen. But much more serious situations can occur when individuals’ identities are stolen, which causes a lot of grief to the families involved.

This is very important legislation. It is modernising legislation. We are very clear that this bill is about giving the private sector and public agencies the ability to better cross-check information, and I think that there has not been a speaker in this House who has not agreed with that.

I will touch on a couple of issues that the select committee will have to deal with. The first is the issue of consent, which has been well canvassed, and the need to balance that with any privacy considerations. The term that will be crucial is what constitutes identity information. Finally, there will need to be a real focus on the conditions that an agency can use for the confirmation of the service. One positive aspect of the legislation is the fact that the Privacy Commissioner will have to provide a report on how the confirmation service is going.

I am very pleased to make a brief call on this bill this evening. It is an important bill to combat identity fraud. I commend this bill to the House.