Electronic Identity Verification Bill

We now come to the debate on Part 2 and schedule 1.

Part 2 of the Electronic Identity Verification Bill contains the majority of the actual implementation of this particular measure, so I am very pleased to speak to Part 2 of this bill, because my concern, which I hope the Minister in the chair, the Minister of Energy and Resources, will be able to address, is around the ability of the Government to implement this measure. The Inland Revenue Department computer system is something that has caused great public concern in recent times. There have been 32 reported breaches in the calendar year between September 2011 and September 2012. For over 600 people the breach was considered severe enough for them to be contacted and followed up by the Minister for Social Development. In those breaches, 6,300 people actually had their private details released, and it is not clear yet why the Inland Revenue Department did not think it worth following them up, why it should be that people should not be told that their privacy has been breached as a result of ineffective security systems, as a result of errors in the department, and so on.

I want to say that Labour will support this bill, because we support the principles behind it, as were enunciated in Part 1, but in Part 2 the real question is: can this be enacted? Can these measures be enacted? In the Inland Revenue Department’s case, we have a 20-year-old system. It is needing, according to Mr Key, a billion dollars spent on it in order to upgrade it, to replace it, and to bring it up to scratch. Mr English is on record as saying that $700 million of the asset-sales money will be spent on the system. Mr Dunne is on the record as saying “Don’t ask me any questions. Those decisions are going to be taken as a result of the Budget process.”—effectively saying “Nothing to see here.” I have serious concerns, because this is a department under incredible stress, and we are seeing bills now coming through the House that take backward steps. The Government says “We are implementing this in principle.”, and then later on has to follow up with legislation that says “Actually, we’ve realised we can’t implement these changes and we now have to change the goalposts. We have to move the goalposts to a place where we can put the ball through.” That raises a serious question about whether we should be considering this legislation now, or whether it is actually premature, given that it may not be able to be implemented in the way that is intended.

I am deeply concerned about the breaches at the Inland Revenue Department, and also those at ACC, at Work and Income, and at Novopay. I have certainly heard whispers around my electorate of other Novopay breaches that have yet to be publicly alerted, so it is not over yet. I am sure there will be more breaches coming to light. When I became aware of the Inland Revenue Department breaches, I did a quick calculation and realised that if the current rate of breaches continues, in a little over a decade it will be one in 20 New Zealanders who have had their privacy breached by the Government—if the current rate of breaches continues. That is outrageous. It is absolutely outrageous if one in 20 New Zealanders has to put up with their private details being breached by Government systems that are inadequate, that are not up to the task, and that do not take seriously the trust that New Zealand citizens put in them.

💬 David Bennett: Come on, David, sit down. You know you’re telling rubbish.

Mr Bennett, on the other side of the House there, is uncomfortable with these facts and figures and is wanting to put that on record. He should come across the floor and join a party where Davids can get ahead. I know his heart is in the right place, but these are serious, serious issues that we are raising.

These are serious issues, where four out of every thousand Kiwis have had their private details breached in the last 12 months, and where one in 20 will have their private details breached if this is not addressed in the next decade, and we see a Government that has no plan. In the case of the Inland Revenue Department, the Government is yet to outline a plan. John Key said in February this year that it would cost a billion dollars to upgrade the Inland Revenue Department computer system. Now, 9 months on, we do not have a single plan in place. We do not have a credible timetable outlined. We have no idea how the Government is going to make sure those systems are secure. Now in front of us is a piece of legislation that talks about the electronic identity verification that should be in place. We know that this is a good idea. There is no doubt that having electronic identity verification in place is a good idea, but can the Government actually deliver on it? That is the question that I am asking.

The Inland Revenue Department, to cite some further examples, failed to return 70,000 phone calls in the 2 weeks prior to the last GST filing period.

💬 Hon Ruth Dyson: What? How many?

70,000 phone calls.

💬 Hon Ruth Dyson: A year?

That was in 2 weeks. That was in 2 weeks, I say to my colleague, prior to last year’s GST return period.

There are over a million unprocessed returns in that department, and we have $7 billion in outstanding debt—$7 billion at the Inland Revenue Department in outstanding debt. It is little wonder that it has had a 33 percent turnover rate in the call centre in Wellington that handles many of these complaints. Those at the coalface are feeling the pinch because we have a Government that has not stepped up to the plate, and that is not addressing the concerns raised by a computer system that was put in place in 1992. That is 10 years prior to Facebook, that is prior to Google, and that is prior to the internet as many of us know it. There are even members of Parliament who were not born then, I think—oh no, I might be getting a bit premature there. But this system is nearly as old as some members of Parliament. We have had a 4 percent drop in the tax take under the watch of this Government, so there are serious, serious issues in that department. This bill would say that that department has to put in place a system that implements a system of electronic identification. I am not convinced at all that this department will be able to do it.

We also know that the Inland Revenue Department does not and cannot, currently—and the Minister in the chair can correct me if I am wrong on this—reset passwords. It cannot even reset passwords electronically. If you have got a department that is struggling with issues as simple as that, in terms of its computer system—John Key refers to it as a pig of a system, a pig of a system. Those words are from the Prime Minister’s own mouth. Nine months on we do not have any idea how the Government is going to address that system.

We have a bill with more aspiration in it, but we see no progress. How can the confidence of the New Zealand taxpayers be restored? It is being shot to pieces—shot to pieces—by the breaches this Government is making: ACC breaches, Inland Revenue Department breaches, Work and Income breaches, and now Novopay breaches. What we are seeing is a pattern. What we are seeing is a clear pattern. We have some talk about how these things are going to be addressed, then often we have a retraction, but we do not have any credible plan outlined as to how these problems are going to be addressed. New Zealand taxpayers give over their private details in good faith—in good faith—and good on them, because people do need to pay their fair share of tax. They do need to sign up for the various Government services that are available. But they are getting nervous because of the inaction of this Government. So although Labour will support this bill, because it supports the principles in it, we hold very, very deep concerns about the Government’s ability to implement these changes.

I would like to make just a very brief call on behalf of the Green Party to offer our support for this bill, the Electronic Identity Verification Bill, as well, in the Committee stage, and actually to raise our voice to share some of the concerns that have been raised by our Labour colleagues. Our reasons for supporting the bill are primarily about easing citizens’ engagement with the State through a variety of different agencies. We know there is a need to ease that engagement. All too often people are being required to bring information again and again and again, and are being sent away from appointments, which may have taken them some time to get, because they do not have the required information. It is our deep hope that this bill will go some way to alleviating this problem. That is the reason for our support.

We also, though, do have concerns around privacy issues—clearly. We have heard of a number of Government departments recently—ACC, the Inland Revenue Department, the Ministry of Justice, the Ministry of Education with Novopay, and Work and Income—that have all had very significant privacy breaches. We are interested and we expect to hear that possibly other departments have also had privacy breaches. We are seeing at the same time coming through this House a range of bills and amendments to other existing legislation that seek to change basic legislative arrangements for, and protections of, people’s privacy. It makes sense that we do that as technology develops, but it is also incredibly important that we take the duty of care to ensure that it does not undermine people’s confidence and ability to place their trust in the State. We have no choice on many occasions but to engage with the State. It is essential that we can trust that our information is kept secure in that process. Sadly, at the moment we cannot necessarily have that trust. That is a very worrying situation.

We see that there are many reasons for these breaches of privacy that have happened. My colleagues have mentioned the culture within some of the Government departments that does not prioritise privacy. We hope this bill will actually help to put it high up the agenda, as we hope the breaches will, as well. Another reason that has been mentioned for some of the breaches of privacy is a lack of expertise in terms of information technology within the departments, and the fact that a lot of the systems that have been set up in-house were set up in another time. We hope and trust that the Department of Internal Affairs and every other department that does engage in this process will ensure they have the appropriate information and communications technology expertise to ensure that privacy is protected in this process.

The digital divide is another aspect that I would like to just mention. I hope this bill is also a stimulus for each department to consider how it can provide the same ease of access for people who do not have access to online technology: older people, people on low incomes, people who have English as another language—all of those groups. If we provide a service only online, we will get a lower-quality service from our Government. I do not believe that is good enough, and I think that this bill could be a spur to consider what assistance we could put in place to help those people get that information online, so that they too can get the benefits of this bill. So I hope to see those policy initiatives come out of this bill.

On that note, again I will mention the Green Party’s support for this bill, which is a bill of its time, and we are pleased to support it in that context.

Mr Chairman, I know you had a lot of choices to make. Thank you for giving me the chance to speak on Part 2 of the Electronic Identity Verification Bill. As I said in my contribution on Part 1, the public need absolute confidence in the security of the information for the igovt system to be expanded out beyond what it has operated under since 2009. As a number of speakers have said already in the debate on Part 2, there is a certain amount of unease with the public—and I think that is probably being a bit kind, actually—about the ability of a number of Government departments to securely hold private information, given the recent events. At the risk of mentioning these ad nauseam, we have already spoken about the privacy breach in Work and Income—

💬 Chris Auchinvole: Ad nauseam.

—thank you, Mr Auchinvole—with the kiosks there. We have talked about the privacy breaches with Bronwyn Pullar, with the Accident Compensation Corporation. We have spoken about the thousands of people who were affected by the Inland Revenue Department breaches. We have talked about the Novopay transgressions, with some of the personal details of teachers from schools—

💬 Louise Upston: Are you talking about the specific part? Because that would be kind of useful.

I will get to it—I will get to it. Just hold on. Taihoa—taihoa. Patience—patience. What I would like to talk about, in terms of Part 2, is clauses 20A through to 21B, and they are about access—access—and who is allowed to access the information that we are going to be talking about expanding within the realms of the Department of Internal Affairs and the likes of Births, Deaths and Marriages and Passports. Clause 20A, in relation to access, says “Access to core identity information and status information. An individual may access—(a) the core identity information contained in the individual’s electronic identity credential: (b) information about the status of the individual’s electronic identity credential.” That sets out, in clause 20A, in terms of one aspect, access to this information.

But who is going to monitor that? That is one question I would like to have answered from the Minister in the chair, the Minister for the Community and Voluntary Sector. Also, who is responsible in the Government about giving assurances, given the context of what has happened recently about the security of that information and exactly who can access that information? As I have said before, we have had a number of instances and they have really rocked the confidence of the public in the ability of this Government to hold private information. In Part 2, clauses 20A through to 21B do talk about who can access this information. I want to hear from the Minister in the chair about who is going to give the assurances that this is going to be monitored, and who is going to give the assurances as to how there will be any punishment if the provisions within clause 20A to clause 21B are not adhered to.

There is a massive amount of public concern about, you know, the likes of Work and Income, the likes of ACC, and the likes of the Ministry of Education around their ability to hold private information. So we think it is only fair that we are asking these questions of the Minister in the chair in respect of access—who can access this information—and about the assurances this Government can give in the context of recent times, because there is a serious lack of confidence, and that lack of confidence is probably well founded, given what has happened in the last 3 or 4 months.

In terms of Novopay—that is a new one that has come out. There are a number of teachers whose personal information has been sent to an incorrect school, and the media reports suggest that that gave administrators at one school the ability to access or to manipulate the finances, or the pay, of that particular individual. That is quite shocking, given that this is a secondary issue with Novopay; it is not the primary issue with Novopay. The primary issue with Novopay, as we know, was the complete inability for it to meet its purpose of paying teachers on time and correctly. So that latest issue with the Novopay system is just another instance of where a Government department has really not met the mark, and you have got to ask the question around governance and whether there is enough monitoring being done.

I know there has been an inquiry into the leaks of information at Work and Income. We on this side of the Chamber hope that it is actually acted on, because it is a very serious case when you have one individual who can access 7,000 files of information of the likes of invoices, medical records, and information about children and where they are staying under protection orders. That kind of information being publicly available to any Joe Bloggs who can walk into the reception of Work and Income would shock most people, and has shocked most people. Therefore, there is subsequent concern around the ability of the Government to assure New Zealanders that it can be trusted with private information.

We have had instances of Ministers quite liberally throwing around private information, and that is shocking in itself in a political way, but when you get instances of the average Kiwi who has done nothing and is in a very—what is the word I am looking for—vulnerable position, and they have had their information—

💬 David Bennett: It’s called David Shearer—vulnerable position.

Oh, I am glad you find it funny, Mr Bennett. Kiwis who are in a vulnerable position, who have had family members who have committed suicide or are in protection situations—for their information to be freely available on those kiosks is a concern. That is why we are asking some serious questions, and I hope that the Minister in the chair does take the opportunity to answer these questions. Who is going to access this information? Who is going to monitor the access to this information? And what is going to be done if this information is either incorrectly accessed or dispersed to people who should not have that information? That is, I think, given the bipartisan way in which the Government Administration Committee worked on this bill, a fair enough question to ask given the times.

Also, I have just one more point on the access. There will also be provisions, in clause 20B, about access to photos, which is in this digital age very important, because if you have a legitimate or seemingly legitimate image of someone or something, it lends legitimacy to someone on a social media site. So there are very tight restrictions about who can access photos that are held within this realm. Obviously, if we are dealing with the likes of Passports, you do not want those photos floating around too widely or to be accessed by the incorrect people, because then it makes much easier the work of people who target the security of passports, and we know that in recent years there have been a number of instances where that has certainly happened. So to have some clarity around that within clause 20B, “Access to photograph”, in Part 2 is very good, and we hope that maybe the Minister in the chair could also clarify for us what the provisions might be in terms of assurances for the security of photos as well—

💬 Hon Ruth Dyson: I think, a new provision.

It is a new provision? Was it inserted by the select committee? It looks like it, and Ruth Dyson, the chair of the select committee, would know. But maybe, just to reiterate, the Minister in the chair could assure us around the security of those images, because, as I say, images in this digital era are very, very important. They lend legitimacy, especially to official transactions, and when we are talking, as I have mentioned before, about the likes of transactions with Passports, or with Births, Deaths and Marriages—I think it would probably be only in the case of Passports, though—the security and the good reputation of the New Zealand passport could be seriously at risk if we do not have tight controls over who can access the images that are held within the system that the Department of Internal Affairs has.

I want to just reiterate that we are supporting this bill, but I have asked a number of questions of the Minister in the chair, and I hope that at some stage during the debate on Part 2 of this bill the Minister in the chair will be able to elaborate on some of the questions that I have put to her concerning access to this information under Part 2.

Part 2 agreed to.

Sitting suspended from 6 p.m. to 7.30 p.m.

Part 3 Miscellaneous provisions