Identity Information Confirmation Bill

I move, That the Identity Information Confirmation Bill be now read a second time. Can I start by thanking the Hon Nathan Guy for introducing the Identity Information Confirmation Bill during his time as Minister of Internal Affairs. Can I also thank the Government Administration Committee for its consideration of the bill, which goes back a year or so to the point when David Parker was the chair of that committee, and can I thank him for that guidance through that period. Can I also thank the 13 submitters on the bill, particularly the three who made oral submissions.

This bill goes to the heart of one of the Government’s key priorities, which is Better Public Services. In regard to that—in regard to Better Public Services—we have set 10 key result targets. One of these, for which the Department of Internal Affairs is responsible, is to enable New Zealanders to transact with Government agencies easily and in an online environment. This bill goes to the heart of that result. The two bills—the Identity Information Confirmation Bill and the Electronic Identity Verification Bill—enable Government departments, businesses, and other agencies to easily confirm the identity of the people they transact with. This will speed up transactions and reduce paperwork, enabling individuals to obtain services more quickly and easily.

The two bills are similar but different. Earlier this morning we considered the Electronic Identity Verification Bill. That bill regulates the use of the igovt Electronic Identity Verification Service to verify individuals’ identity over the internet when they are transacting directly with Government agencies or with businesses. The bill being debated now, the Identity Information Confirmation Bill, establishes an automated electronic service to be available for agencies and businesses, and to confirm the accuracy of individuals’ identity information, such as their name and date of birth. This service will confirm whether this information is consistent with the citizenship, passports, and births, deaths, and marriages information held by the Department of Internal Affairs. Individuals will need to provide their consent before their information is checked. This service can be used for a wide range of purposes, including meeting new anti - money-laundering requirements.

The select committee recommended amendments to the bill in response to some of the issues raised in submissions. The Government supports these amendments, as they will improve the operation of the service. The bill originally envisaged each agency having a direct relationship with the service. However, submitters indicated that it could be more convenient and cost-effective for some businesses to have another agency check identity information on their behalf. For instance, a credit reporter could wish to check identity information on behalf of an appliance store that was about to enter into a hire purchase agreement with a customer. The bill now allows this to happen by committing intermediary agencies to use this service on behalf of other agencies.

Using intermediaries can create additional privacy risks, and the select committee has recommended that this bill provide some additional safeguards to mitigate those risks. Intermediaries will be able to check identity information only on behalf of agencies that the service has approved. Before approving an agency’s use of the service a number of factors must be considered. These include the agency’s practices relating to the security of information and the privacy of individuals. Intermediaries are prohibited from using or retaining the results of checks performed on behalf of other agencies, although they can undertake separate checks for their own purposes. Agencies using an intermediary to undertake a check will be subject to a range of requirements that provide protection for members of the public, as will those agencies that directly undertake a check for their own purpose. For example, one of the important protections for members of the public is that agencies must obtain consent before this service can be used to check identity information. The bill also requires agencies to assure the service that consent has been given. In response to one submission, the bill now requires that consent and the assurance of consent be provided in either written or electronic form.

The service generally confirms only whether identity information is consistent or not with that recorded by the Department of Internal Affairs—in other words, a yes or no response. However, a check can result in some exception messages in situations where there is other specified information about an individual. This includes information that a person has registered a name change or has died. There will also be an exception message response when there is an issue with the status of a document that the individual has presented to an agency, such as when a passport has been reported as lost or stolen. In these cases the bill previously required agencies to contact the service to find out which of these exceptions applied. The select committee recommended that this information be provided automatically by the service. So this will make the service more user-friendly and efficient for agencies, which is a good thing, and shows the benefit of that select committee process in addressing the initial bill and making substantive changes to improve its efficiency.

Important protections for members of the public must be included in agreements between the service and the agency. Agreements must be entered into before identity information is checked. The select committee has clarified and improved a number of the protections that these agreements must contain. For instance, they must now specify how members of the public can withdraw their consent for an agency to check their information if they decide to do so. The agreements with agencies can be developed by the service on a case by case basis. Agreements may also include standard terms and conditions designed to apply to certain classes of agencies such as banks. The Privacy Commissioner must be consulted on both kinds of agreements.

The select committee has made some minor amendments, including clarifying when the Privacy Commissioner must be consulted about agreements that allow photographs to be checked. For instance, photographs can be checked only where the photograph provided by the agency is the same photograph as that recorded by the Department of Internal Affairs—for example, in the passports database. Agencies will not be able to take photographs of individuals and submit them to the service for checking.

I understand that Labour Party members of the select committee would have preferred that the Crown, Ministers, and officials not be protected from liability as a result of the service being used to check identity information. However, the bill provides protection from liability as this is an opt-in service. The bill also contains numerous protections for members of the public, including the consent-based nature of the service, which will reduce the likelihood of liability arising. The bill also excludes protection from liability when there has been an act that has been carried out in bad faith or was grossly negligent.

This bill makes it much simpler and easier for Government agencies and businesses to confirm the identity of individuals who transact with them. Knowing whom you are dealing with is vital to any transactional service, and this bill vastly improves identity confirmation services and speeds up other services that rely on confirming customers’ identity. Once again, I thank the Hon Nathan Guy for introducing the bill, and the Government Administration Committee, led by David Parker at the time that this bill was before the select committee. The Identity Information Confirmation Bill will provide a real benefit to businesses to assist them in confirming the identity of their customers while also balancing an individual’s right to privacy. This bill goes to the heart of enabling result area 10: enabling New Zealanders to transact easily with Government in a digital environment. I commend this bill to the House.

I want to commend the Minister of Internal Affairs on the progress he has made in approach between the last bill and this bill, the Identity Information Confirmation Bill. The purpose of this bill is to provide a consent-based service to allow both private sector and public sector agencies to check identity information. It extends the use of the Data Validation Service to public sector and private sector agencies on a strictly need-to-know basis. Labour members are supporting the bill because it allows Government agencies and the private sector to use identity information in the fight against fraud. We are mindful of the privacy concerns around the sharing of identity information, and the Government Administration Committee sought the Privacy Commissioner’s assurances during that process.

Identity fraud is a serious problem. It is a growing problem in New Zealand. It costs New Zealanders and the Government millions of dollars every year. Of course, we are all very familiar with the bizarre saga of David Garrett, also known as “Dave the Jackal”. It shows how easy it is in New Zealand to commit identity fraud. I know that although, certainly, the previous people from the ACT Party, and, in fact, the Prime Minister, were not uncomfortable with that approach, New Zealanders expect higher standards of members of Parliament, and also, in fact, we expect higher standards of systems in order to avoid that sort of thing happening.

There has been a very recent case of the employment of a known child sex offender in six schools around New Zealand. The Ombudsman’s review of that case found systemic failures by Government agencies primarily around the sharing of information by those agencies, which allowed Te Rito Henry Miki to carry on teaching. That is a scandal. It is something that this bill will not totally solve but will make some progress towards solving.

The last point I want to make is that we are not putting this bill through under urgency, but we are using the extended sitting procedures, which we do for legislation that has widespread support in the House. I am pleased that we are doing that, but what I am hoping—and I am looking in particular at the Minister and the Government whip—is that we do not need to wait another 2 years before we make more progress on it. Thank you very much.

This bill, the Identity Information Confirmation Bill, fits the same description I have used before. It is a grunty little bill, and it has a purpose. I join with the other speakers on both sides of the House in encouraging Parliament to adopt this bill in fast order. It is not always, when you are speaking on a bill, that you suddenly realise the relevance of it to your own situation, but with this particular bill, should members of the public be listening and wondering how it would work, I can actually give an illustration.

The illustration was some years ago. I was in Auckland. I had been to a pay-as-you-go gymnasium, a well known gymnasium in Auckland. Unfortunately, at that particular time there was a gentleman operating in the building, which resulted in theft. He did things fairly quickly. He did not just steal your wallet; he stole a pair of your trousers. It was quick—you simply go in to the changing room and see who is there. As soon as they have gone out, you go to their locker, spring the locker, grab the trousers, put them in your bag, and walk out.

So picture this, if you will. I come back, I have my shower, I go to get dressed, I put my shirt on, and suddenly I have got no strides. So I go up to the reception centre and say: “I’ve lost my breeks.”, or you do if you are a Scottish person. And they say: “How do you mean?”. So you say: “Well, my trousers have been nicked.” And they say: “Oh God, not again. We think we know who did it.” So I said: “Well, would you mind asking them if I could have my trousers back.” It was a brand new suit, bought from a department store in Auckland—

💬 Hon Trevor Mallard: Hang on, I lost the beginning of the story. Where did the member lose his trousers?

In a gymnasium. All right? This guy was operating—

💬 Hon Trevor Mallard: That’s better. That’s better.

Yeah, yeah. Oh, it gets—

💬 Hon Trevor Mallard: Hearing the story mid-point didn’t sound that good.

It gets worse. It gets worse.

💬 Michael Woodhouse: Never heard them called gymnasiums.

He says he has never heard them called gymnasiums. Even though we are in a privileged place I will not give the name of it. It would give the place a bad name. But it was a big commercial—

💬 Hon Trevor Mallard: Not a very successful gymnasium, obviously.

A big commercial gymnasium, yes. Anyway, I lost my breeks. This guy was operating. A young guy was there, and he said: “Oh yeah, he does it all the time. He comes in, waits to see who’s got wallets and things in their pockets, and then as soon as you go out he’ll jemmy the locker”. The guy who stole the trousers was a member of a gang. He had his tattoos and everything. I had actually, I thought, befriended him. But, anyway, he nicked my breeks.

So I was standing there at the counter and they said: “We’ll call the police. We know who it was. We will call the police. We’ve had enough of this.” So I said “Righty-o. I don’t mind seeing the police.” So while I waited for the police, I phoned the bank—standing in my shorts, trainer shoes, a shirt and tie, and looking ridiculous. So I phone the bank and I say: “I’d like to cancel my credit cards.” They say: “What are the numbers?”, and I say: “I don’t know. I haven’t got them. They’ve been stolen.” So I had a protracted conversation. Then the police arrive, and they know the individual: “OK, but your chances of getting of your stuff back are very limited. What was in your wallet?” I said that he really had not got much really, because it was only credit cards, a little bit of money—

💬 Shane Ardern: A Scotsman’s wallet.

—a Scotsman’s wallet. I said I had cancelled all the cards so they would be no use to him. The policeman looked at me with old world wonder, and said: “Oh, I think they’ve already been sold, Mr Auchinvole. I think they’ve already been sold.” So I said: “Well, they’ll be no use to anyone. They’re cancelled.” And he said: “Yeah, well, we’ll come and see you in a few months, and you can tell us how useful they were.” So I gave a light laugh.

There was one other amusing part. I went to Smith and Caughey’s, where I had bought the suit, went to the tailor, gentlemen’s outfitter, very professional people, and I said: “I need a certificate.” They said: “Yes, sir. What for, sir?” So I said: “The suit I bought.” “Oh, we remember it, it was a—”, whatever it was. So I said: “Well, the trousers were stolen.” And the guy did not change his expression. He looked straight at me and said: “Were we in them at the time, sir?”.

Anyway, I got the insurance for them, and then I started to get demands for payment from other department stores, which I had never been to, in South Auckland. So I phoned up the financial controllers and said: “I have never been to your store and I have got a bill here for thousands.” And they said: “But you opened an account and we sighted your credit card.” They would not relinquish the demands. So I went to see my solicitor, and one thing and another, and eventually they did relinquish the demands, because the age that the guy had given was not in any way related to my age, but they would not take my name off the debtor’s list, because someone in that name—

💬 Hon Trevor Mallard: That’s blackmail. That’s blackmail, actually.

Well, yes, but with a name like mine—there are not too many Auchinvoles around. It affects your credit rating and all those sorts of things, or it could, potentially. The point of the story is that had we had this verification system, that would not have occurred and the cards would indeed have been valueless. And that is why I think this bill is—I try to give it a practical rendition—a very, very useful piece of legislation, which, in fact, in my case would have worked. They did apprehend the person who nicked the trousers. They said he was one of the very, very few people they have arrested who actually said nothing. So I wrote him a nice letter hoping that he had a nice time where they sent him.

I would like to take a call on this bill, the Identity Information Confirmation Bill. Once again, I say that I did not sit on the Government Administration Committee, which examined this bill, so I have been poring over the submissions in great detail and understanding all the important issues. I would like to commend this committee for the work that has been done on this bill and the previous bill before it, the Electronic Identity Verification Bill, because they both address important issues, and, as I said in the previous speech, they are dragging us into the internet age. Whether I would describe it as a grunty little bill as opposed to a little ripper of a bill, I am not sure. It must be great fun on that select committee, I think.

💬 Chris Auchinvole: What did the member call it? A bifurcated bill?

It is more the “David Garrett (The Day of the Jackal) Bill”, really. But the fact is that there are some significant issues behind this bill, and I think that it is important to put them on the record in the House today. I do hope that the Privacy Commissioner is paying attention to the debate—as I am sure the office is—and paying attention to the importance of these issues.

The key thing about this bill is that it is a consent-based service. My antennae wave when I hear the phrase, because although it a good thing that it is consent-based service, the issues will be in the implementation and how the consent actually is gained, whether there is any coercion around gaining that consent, and whether that consent is freely given. So I think this is an important bill.

There is no doubt that we have to take a responsible position on this as a House and, therefore, although I have read what the Greens, in the first reading debate, said about their concerns around the privacy issues and the surveillance issues, I think that the most important thing is for us to be responsible about ensuring that identity fraud is not happening, and that, as much as possible, we are doing what we can through legislation to ensure that it does not happen. That is the responsible position, because there is identify fraud happening, and there will continue to be identity fraud happening through other means that this legislation cannot protect against. I think that the TradeMe submission, which was quite a good submission, pointed that out. For instance, on many social networking sites there is identify fraud happening, and this legislation does not cover that. People’s identities and information is being taken and used in all sorts of different ways across the internet, and we must be mindful of what we can put in place to protect people.

But we must also be mindful, on the other side of the equation, of the importance of people being able to go about their business and not feel as if they are under surveillance. This Parliament has the role to be responsible around this issue, and it also has the role to be responsible about any measures that involve any regulation of the internet. I want to repeat here today what I said in the debate on the previous bill, and that is a plea to every member in this House, particularly on the Government benches, that you pay attention to the issues that lie behind any legislative measures around the internet, and that freedom of expression and the ability to provide information out there are just as important as trying to prevent people from accessing and using information inappropriately.

There is an important report that has come out from the Law Commission. It deals with a whole lot of issues that could have regulatory impacts on how the internet is used in New Zealand, and there are recommendations that all publicly funded agencies should be subject to the Official Information Act. That debate is yet to be properly had in our country and in this House. So I would ask every member to seriously do the research on these pieces of legislation and not just read the notes provided to them. I ask them to do the research and think about the issues, because they do have implications for all of us. There are implications around protecting the rights of individuals to not have their identities used and abused, protecting individuals so they are not bullied and harassed, but also ensuring that we are not trying to control what people are doing and saying in this most important medium.

Kia ora. Ngā mihi nui ki a koutou. Kia ora. I rise to take a very brief call on the Identity Information Confirmation Bill. We support the intent of the bill, which is to help prevent fraudulent activity online. This bill helps with the confirmation and verification service between third parties, and the igovt system relates to the bill. We have just voted on the second reading of the Electronic Identify Verification Bill.

What we have seen is a growth of fraudulent identities online. I think of some of the parody Twitter accounts of some members of Parliament—I think of the Hon Dr Brash and “Big Gerry B”, as he is known, and sometimes funnier—

💬 Chris Hipkins: How do you know they’re parodies?

That is a good point from the member Chris Hipkins. How do we know they are parodies? That is a good question. I think they are a lot more entertaining than the real Twitter accounts, anyway.

We support the intent of this bill. We have got some concerns. Reading Keith Locke’s first reading speech on this bill, I see that he raised a number of concerns, which he championed over the 12 years he was in Parliament. We note that the bill has been improved in the Government Administration Committee. It is important that we take note of what the member Clare Curran has raised about the need for all MPs to be up to speed with these issues, because they are going to get more and more important as the years go on. The laws we write now are going to impact decisions and events in 10 years.

The key thing when you look at issues like this one is that we do not rush headlong, as we could do and as other countries have done, into a compulsory system, going down the path of electronic identity cards. I do not think it is the Kiwi way. I do not think it is desirable, and I do not think it is actually going to benefit us to a large measure in New Zealand.

We support the idea of a confirmation service. We do have some privacy concerns. We note that the Privacy Commissioner is going to have a role in this, and that is fantastic. I think we should also have a debate, obviously in the appropriate forums, about adequately resourcing the Office of the Privacy Commissioner. Her role is becoming more and more important, I believe, and we need to—

💬 Clare Curran: And the Ombudsman.

And the Ombudsman.

💬 Clare Curran: And the Auditor-General.

And the Auditor-General. I may as well add the Parliamentary Commissioner for the Environment in there, for good measure, as well.

I do not want to overly politicise this, but we have got to raise the point that I think the public and Parliament should have concerns about how this Government has been addressing the privacy issue. We have seen thousands of New Zealanders’ files handed out to the public. We have seen a Minister make some pretty egregious comments around privacy, breaching privacy, and intending to continue to breach privacy, which I think is terrible. We should not countenance it. It raises serious questions in the public as to whether they have confidence that the Government takes privacy seriously. It has got to be at the core of the system. When you design new systems such as this, I think the Government has to demonstrate that it takes privacy seriously, and we will have that debate down the line. Thank you.

New Zealand First supports this bill to attack online fraud, the Identity Information Confirmation Bill. I note from the commentary on the bill itself that it states that the bill “seeks to facilitate the use of an electronic service that allows agencies to confirm identity information provided to them by individuals with information held by the Department of Internal Affairs under the Births, Deaths, Marriages, and Relationships Registration Act 1995, the Citizenship Act 1977, and the Passports Act 1992.” The purpose overall, however, is stated in clause 4 as being “to facilitate the use of an electronic service that allows agencies to confirm identity information about individuals so as to (a) contribute to the prevention of crime … and (b) ensure that agencies can use and, if necessary, record confirmed identity information.” It is limited in those ways, which New Zealand First believes is appropriate.

I note, however, that in terms of the definition of the word “agency” it means any corporation, which, of course, under the Interpretation Act the word “person” includes anyway, whether in the public sector or in the private sector. In other words, it actually means anybody or any corporation at all, and I do not really know why the bill does not just say that instead of using the word “agency”. However, that is not a big issue.

I note also, in relation to the definition of “identity information”, that it includes information about a person’s full name, gender, date of birth, place of birth, other recorded information—for example, in a passport or a photograph on a passport—and the status of any other recorded information. It is good that the kind of information that is covered is so specifically stated, so that it does not go any further than that. I note also the use of intermediaries, and that an intermediary is a person who “is a party to a confirmation agreement with the responsible officials”. So it is limited in that way as well. I approve very much of the way that the bill is drafted so that it provides those limitations and is very understandable in that respect.

Similarly, I think the purpose of Part 2, “to allow an agency or intermediary to check whether an individual’s identity information is consistent with any recorded information.”, is well stated. That itself provides a very significant limitation as well, but there are others. In clause 8 there is a list of conditions for using the confirmation service, which most particularly, of course, requires the individual to consent, whether in writing or electronically. It requires the agency or intermediary applying to give an assurance that that consent has been obtained, and, of course, that they have entered into the required confirmation agreement. All of that seems fine to me, and also the ability for an individual to consent on a one-off basis or an ongoing basis, and the ability to withdraw that consent as well. Those are all important safeguards.

I approve also of clause 9(4), which states: “The confirmation service must not, at any stage, supply to the agency or intermediary any recorded information about the individual who is the subject of the search.” It is confirmation information that we are concerned with here. Clause 9(5), however, does go on to say that subclause (4) does not limit or prevent the disclosure of information relating to the fact that a person is dead, that there is name change information existing, or the status of recorded information. These are good provisions and good drafting, I believe.

Clause 10 gives a long list of requirements, in respect of the responsible officials, requiring a need to be demonstrated by an intermediary before they can enter into an agreement, and also they must have policies and practices in respect of the security of information and relating to the privacy of individuals. Again, these are very appropriate and good ways of limiting the scope of the bill to make sure that it is focused on what it is intended to do.

New clause 11 and new clauses 11A and 11B contain very comprehensive provisions concerning what must be in a confirmation agreement, and, in addition, how those agreements are to be used. I note the addition of new clause 11A concerning how the agency must obtain an individual’s consent and how he or she may withdraw that consent. Again, those are the sorts of things that I would wish to see in legislation of this kind.

For all the reasons I have indicated, New Zealand First approves of the bill, all the remaining provisions that I have not mentioned, those that have been put in by the Government Administration Committee, and also those relating to the role of the Privacy Commissioner. For all of those reasons, and noting all of those limitations, it is very happy indeed to support the bill as it stands.

Bill read a second time.

The House adjourned at 12.22 p.m. (Thursday)