Identity Information Confirmation Bill

It would have given me great pleasure to say that the Identity Information Confirmation Bill, like the previous bill that we have been discussing, has been through the Government Administration Committee recently and that I was pleased to support its progress back through the Committee, but, actually, that is not the case. The Identity Information Confirmation Bill was actually referred to the select committee on 19 October 2010—2010. That was over 2 years ago. The closing date for submissions was 1 December 2010. The committee received and considered 13 submissions, and heard three. It received, I am sure, extremely competent advice from the Department of Internal Affairs. Now, 2 years and 1 month later, we get this bill back. What has the Minister of Internal Affairs been doing in that time, I wonder?

There does not appear to be much wrong with the bill. There do not appear to be any further changes from the select committee. The select committee made some very good changes, actually—entire sections were rewritten. I have to say that the commentary on the bill is very clear, as well. But, to be frank, there is not much to it, Minister, and I am not quite sure why it has taken the Government such a long time to get it to this final stage. Perhaps it does not consider identity information confirmation important, but I do.

We did have some departure from our total agreement with this bill, but not to the point where we decided to vote against any particular provision. I just want to draw the Committee’s attention to the fact that during the debate at the select committee the Labour members would have preferred to delete clause 18 from the bill. Again, this is quite similar to the comments that we have just been making about the previous legislation in regard to the protection from liability of various individuals. In this case Subpart 4 of the Identity Information Confirmation Bill says “There is no cause of action against the Crown, or a Minister of the Crown, or the responsible officials, or a delegate of the responsible officials, or an employee or a contractor of the department, to recover damages for any loss or damage that is due directly or indirectly to the use of the confirmation service for an identity information check.” We were a little concerned that this was really absolving the Crown, the Ministers, and any departmental officials who were involved from any responsibility, and that is not always a good thing. Sometimes it is important to say that it is better for an event to be owned up to, to be claimed, and then to move on from that. But in this case it is just absolving them of all liability.

So Labour members expressed their concern about that at the time, but we had advice, through a formal submission from the Legislation Advisory Committee. That committee persuaded us, actually, that this was a good provision to have in, and that our objections were outweighed by the arguments that it put to the select committee. That was our only major concern in relation to this legislation, in terms of the specifics of it.

It is, again, a pretty straightforward bill. It is quite similar in title but not in content to the bill that we have previously progressed. We have just progressed the Electronic Identity Verification Bill. This is the Identity Information Confirmation Bill. But what this bill does is ensure that there is a service that allows agencies to confirm an identity that has been provided to them by an individual. So if somebody says that this is my identity, then there is a service that allows for confirmation of that identity.

I had not really reflected on how many alterations a person might go through during their life in terms of what is on their birth certificate, and what their common name in use might be but that is not, therefore, in the documentation that they might otherwise be able to provide to prove that person’s identity. So if you are born with the name of Kris Faafoi—seeing as everyone is dropping that name tonight—but you decide that you might prefer to be called Freddy Faafoi for some reason, then your birth certificate still says Kris but all your rates demands, your power bills, your phone bills, whatever, are all in the name that you use most, Freddy. So quite common situations can actually cause quite a lot of difficulty.

I think that the officials, from my reading of the deliberations, not only went to the most common areas where this could be problematic but they also looked at the areas that might be more unusual, and ensured that this is a robust piece of legislation that will provide access to that service of verification for people regardless—

I would like to join with the chair of the Government Administration Committee in commending this Identity Information Confirmation Bill. It has been under consideration and thought for some considerable time, and, no, I do not have an explanation for that, but I am not the Minister.

The bill is a useful bill, and it is an adjunct in many ways to the bill that we had been discussing earlier in the evening. The point that the Hon Ruth Dyson made I would just like to refer to, because the Opposition members of the select committee did oppose the clause in the bill—clause 18, I think it is—that protects the Crown, Ministers, and officials from liability as a result of this service unless they acted in bad faith, in which case there is no protection for them; or if they were grossly negligent, there is no protection for them. But this clause has been retained on the basis that the service is provided on an opt-in basis and contains numerous protections for the members of the public. It was an interesting one to debate, and what I particularly like about select committees, especially with the officials that we had in this particular case, was that they were quite comfortable about giving us examples of when this service could be used.

The bill helps combat identity fraud by preventing the use of fake identities and extends the use of a web-based data validation service to public and private sector agencies on a strictly need-to-know basis. It allows agencies to check whether the identity information presented by a customer is consistent with that held by the Department of Internal Affairs through citizenship registers, the passport database, and the various registers of the Births, Deaths and Marriages registry office. As the Hon Ruth Dyson has just said, there are many occasions when small identity changes occur. But it did make me reflect back on my own experience of having my bankcards nicked, and—

💬 Kris Faafoi: You’ve had a bad run, haven’t you?

I have, I have. Well, I have lived a full life, Mr Faafoi. A full life, protected from nothing—protected from nothing. But when I had these cards stolen, I somewhat naively told the police that they would be of little use to the person who had stolen them because I had already reported them as stolen, so they would be invalid. They gazed at the sky, they rolled their eyes, and they said “We’ll see you in about a month. The cards will already have been sold, and they will already be being used.” And it was I think about 6 weeks later that I started getting final demands for payment of accounts. The accounts had been opened using my cards as an identity—

💬 Kris Faafoi: That’s your story anyway.

—and I am sticking with it—in shops that I had never ever been near.

💬 Hon Trevor Mallard: Which of the member’s identities? Which of the member’s identities?

I am beginning to wonder whether I should have embarked on this line, but it is very, very important, because we take things like security of identity as a given, whereas it is not. It is not like that at all. It is not a nice, honest life out there, and, no matter how naive I may be, there are people who want to do you ill.

This bill will help ensure compliance with the Anti-Money Laundering and Countering Financing of Terrorism Act 2009, and that requires banks and other financial institutions to undertake more comprehensive know-your-customer checks. It is an important tool in preventing identity fraud and reducing compliance costs.

There will be many other aspects of this bill, which is a nice tidy little bill. It will be very effective—I am pretty sure it will. Again, the officials applied themselves, I think assiduously, in ensuring that the questions diligently raised by members of the Government Administration Committee were answered to the fullest extent—they were assiduous and diligent. I would hate anyone to think that this committee, under Ruth Dyson’s chairmanship, was in any way—

💬 Hon Annette King: Impeccable!

It was, thank you for that. It was certainly not in any way casual about its approach. Although I can appreciate Opposition members saying “Oh, it would be different if it came up now.”, I am not completely sure that it would because I am not sure how much more diligent we could have been than we were. I will leave it at that because there will be other aspects of this bill that will come up under Part 2 that I will wish to speak on. Thank you.

I would like to say in the Committee stage on this bill, the Identity Information Confirmation Bill, that the first thing to do is to agree with the member opposite me about identity fraud and how important it is that we address that issue, particularly in the digital environment. It is a growing issue. It will continue to be an issue, and we have to have measures in place to deal with it. That is why, having not sat on the Government Administration Committee and listened to all the submissions but having read some of them and having thought about the issue, I certainly acknowledge the importance of it and the fact that we have to keep abreast of fraud, in whichever manifestation it appears. We have heard that the Privacy Commissioner was satisfied with the legal safeguards and the controls in this bill.

We know that it is a serious and growing problem, and I am sure a number of speakers have said how many millions of dollars it costs the country as every year about 2,000 New Zealanders are affected by online scams. No doubt if I asked people to put up their hands and say whether they had been scammed or they knew somebody who had been, probably most people would in one way or another, even if it is by having your Twitter account hacked by clicking on one of those connections that takes you to a rather unsightly, you know, unseemly image. That then means that all of your followers—[Interruption]

💬 Hon Trevor Mallard: Some of them are sightly but unseemly.

I guess it depends on which perspective you come from. All of your followers then get a message from you saying that they are being hacked and people are looking at or saying terrible things about them online, etc. Although there is a growing awareness amongst the population about these scams, including the scams that come from people purporting to be banks, etc., and people are becoming more careful, I think, about what they do click on online, there is still always going to be a percentage of people who are terribly affected by these sorts of practices. So I think it is really important that we acknowledge the importance of the issue.

When I spoke about this bill in its second reading, I said there were two things that we needed to take into account. One is the prevention, as I have just said, of identity fraud. The other is balanced with the ability of people to go about their business without feeling under surveillance, which I know is one of the issues raised by the Greens as being an important thing, and that is something we need to take into account, as well. Also, we have to be mindful, as I said in my speech on the previous bill, of the systems management that is occurring around the Government agencies’ use of information and communications technology, and the security of that. I suppose that is what I want to go to here. I think it is absolutely critical that there is a robustness across Government systems, and I am pleased to see that the Minister for Communications and Information Technology is in the chair, because there is no doubt that security of information, the privacy of individuals’ information, and confidence in the system used to manage those systems is absolutely paramount.

I made the comment in the debate on the previous piece of legislation that went through this Committee, the Electronic Identity Verification Bill, that in order for us to be confident about that, we have to know that we can trust the agencies that are interacting with citizens out there. I think, actually, that that has been compromised in recent weeks. I think that there are four major agencies in our Government that have been compromised. We have heard the issues around that. In order to address that, I actually introduced a member’s bill last week called the Electronic Data Safety Bill, which is around ensuring that there is a systematic inquiry into breaches in agencies around privacy so that the adequacy of information management can be trusted. This is what it comes down to: can the citizens of New Zealand trust the systems that are in place that are managing information, including their private information, and that can make that information public to people that it should not be made public to?

What I am saying is that before we pass pieces of legislation like this that are worthy and important, because identity fraud is important, we should actually have a good look at the adequacy of those information systems, that we do that through an inquiry, and we then ensure that we put in place systematic information management across Government, which includes a governance system that is not just agency based, so that that management system transcends the individual agencies, and then we look at these pieces of legislation that are coming before the House.

I have sought industry views around this, which is why I am pleased to see the Minister in the chair. I am being told that what we need is something more than what we have got. This is ultimately about public confidence. It is about confidence in the security of the information and the security of the systems that we have got, which will be restored only when the public can see that the ministries and the departments are working together and bending over backwards to ensure that that data is secure. Mistakes happen. There is no doubt that mistakes happen. In any development of any new system, etc., of course there are going to be mistakes. But on the kind of scale that we have seen—in the last few weeks particularly—it is just not on. The mistakes are systemic, and they are not just in one ministry or one department; they are across a number of agencies.

I am being told that we know that this is an issue, that this does need to be addressed at a different level. That might involve setting up a new part within, for instance, the Department of Internal Affairs, with—and I think it is important to say this—some sort of dotted line to the Privacy Commissioner. This is about privacy and people feeling that their information is secure. This new part would look after the rule-setting for Government agencies and public information, have the power to advise and require certain things before any system is launched, and investigate and test post any launch. I think it is important to note that the private sector has quite a lot of experience in these things. I think that the Government and the agencies affected should be looking outwards right now as to what experience they can draw on to bring in that experience and see what can be done about this issue, before we put these pieces of legislation to the House. Ultimately, they are about providing new systems, or extending systems that are small and making them bigger. It is about the privacy of New Zealand citizens’ information. That information and the trust that that information is not going to be abused and misused is really important. I would hope that the Committee recognises that.

I would like to see that future developments around how these sorts of developments are rolled out do ensure that there are provisions around security of personal data and that they are put to the top—put to the top. They are not at the bottom and they are not in the middle; they are at the top of the requirements list. There should be penalties around them not being carried out. I am not talking necessarily about penalties to individual companies. I am talking about accountability at the highest level—about the governance level, which is at the political level as well. That is where it should reside, and that is what we should be talking about today in the Committee, rather than about introducing yet another piece of legislation that is piecemeal and that is not part of a wider plan around the security of our information.

Thank you for the chance to speak to Part 1 of the Identity Information Confirmation Bill. It is a bill that has a similar title to the previous bill discussed in the Committee, the Electronic Identity Verification Bill, but it sets out to do something vastly different. It sets out to combat identity theft. The crime of identity theft is not a new one, but I guess that in the digital age, when we have much easier access and faster access to information, the prevalence of identity theft is increasing.

Some research said that there is an average of around 2,000 New Zealanders affected by online scams, identity theft, credit card fraud, and viruses each day. We have already heard from one member from across the Chamber, Mr Chris Auchinvole, about his personal experience when his bankcards were swiped. Unfortunately for him, being a victim of crime, the perpetrators sought to max out his credit card. He said on the record that he was the recipient of many final demands for the fun that the criminals had with his credit card. But it is a serious issue. In 2008-09 there were some statistics to show that there were more than 7,000 incidents of fraud and false pretences using bankcards. In 2009 the police identified 900 cases of identity fraud here in New Zealand, but they thought that that was just a fraction of what was going on but not being detected. That was some 3 years ago.

I think it was my colleague the Hon Ruth Dyson, the able chair of the Government Administration Committee, who said that these people are trying to use common situations to steal identities. That is what this is really all about. It is about the use of things like passports or other documentation that contains the basic details of an individual to steal an identity and make use of that person’s assets or their potential.

I think for the confidence of the New Zealand public, which my colleague Clare Curran has mentioned earlier—

💬 Hon Trevor Mallard: I raise a point of order, Mr Chairperson. I apologise to my colleague, but I think this bill was in the name of Nathan Guy.

💬 Hon Members: No.

💬 Hon Trevor Mallard: Well, the copy that is on the Table of the House is in his name.

The CHAIRPERSON (Eric Roy): No, it is in the name of Chris Tremain. That is on your Order Paper.

Trying to pick up where I left, it is inherent for the confidence of the people of New Zealand around documents like passports, like birth certificates, like death certificates, and like marriage certificates that we do have a credible database around them and confidence in that information. I guess this bill, which we have just learnt is in the name of the Hon Chris Tremain, is before this Committee because the validation of that information is very important. I guess this bill opens up for private organisations such as banks, if someone were to come in—if, say, Trevor Mallard came in to open up a new bank account and used a passport as his identifying documentation, then the bank could ask Mr Mallard whether it was OK to check with the Department of Internal Affairs as to the validity of his documentation. If he said yes and it all checked out, then I am sure the bank would quite obligingly help Mr Mallard open up a bank account. But if it did and it found that there was some irregularities, then it could pick up an instance, potentially, of identity fraud where someone was trying to steal the identity of Trevor Mallard—as strange as that may seem. But it has been pointed out by Mr Auchinvole, I think, also that the individual has to consent for the validation of this information, and I guess you would not rate your chances if your bank said “Well, can we check this information.” and the individual said no. I think the bank would pretty much turn round and say “Well, you can try somebody else, son.”

In terms of passports, I think the confidence in those documents is very important, and if people do turn up to—as an example—a bank with a passport, we need to make sure that they are 100 percent secure, and that we have confidence around that document. We have had, in my memory in the last maybe 6 or 7 years, a couple of instances where a few foreign nationals—I should say—actually got hold of New Zealand passports in a scurrilous manner. So, in order to try to combat identity theft and fraud, this bill seeks to allow agencies and private organisations such as banks to be able to verify the particulars that are offered up by individuals.

Just going back to Part 1 and clause 4, which is the purpose clause—if you will just allow me to read that—it states: “The purpose of this Act is to facilitate the use of an electronic service that allows agencies to confirm identity information about individuals so as to—(a) contribute to the prevention of crime …”—we have talked about that—“and (b) ensure that agencies can use and, if necessary, record confirmed identity information.” I think that maybe we should potentially look at making an amendment here to clause 4(b) and make it read “ensure that agencies can use and, if necessary, securely record confirmed identity information.”, because we have seen in recent months some concern amongst the public about the security of information that a number of Government agencies have. Again, to list the number of the instances, we have got the Work and Income kiosks where one individual, citizen journalist Keith Ng, was able to access some very delicate information—7,000 files of the likes of medical records—

💬 Hon Trevor Mallard: He could have used it for identity.

—yes, he could have it for identity—information around the fostering of children, and invoices for contractors. Some pretty serious information was available to a private citizen publicly in the reception of a Work and Income office. We have also heard of the email that went to Bronwyn Pullar, which contained information—[Interruption] I am sorry. I will carry on. That information pertained to 6,478 individuals, and that is a lot of individuals to be contained in one email and was a serious breach of privacy. We have also heard recently in the last week around some irregularities with the privacy information around Novopay. Again, this is a secondary issue for Novopay. The primary issue was the fact that people were not getting paid, and then the secondary issue comes through with the fact that some staff members’ information was being given to schools where they were not working. Obviously, that is a serious concern, and hopefully we can get some information around that. Then Dr David Clark has pointed out on a number of occasions that the private information of around 6,300 individuals was incorrectly released by the Inland Revenue Department. So I did just want to point back to clause 4 to say that maybe we should have a look at changing clause 4(b) to “ensure that agencies can use and, if necessary, securely record confirmed identity information.”

But we do support this bill. We support the effort to try to combat identity fraud. As I say, 2,000 people a day in New Zealand are the victims of some kind of scam or identity theft, and in this day and age, the digital age, where information is much more freely available, the prospect of identity theft is much, much higher. It has happened in the past. We have had one recent example in the last 2 or 3 years where someone who sat not too far away from us took the identity of a dead baby—

💬 Hon Trevor Mallard: Is it David Garrett?

David Garrett. So that goes to show that although identity theft is not a new crime, it is much more prevalent now because of the ease with which the information is transferred via the internet, so that identity theft is much more of an issue.

I do just want to point again to Mr Chris Auchinvole, our own victim of identity theft, as someone who had his credit card stolen. Was it recently, Mr Auchinvole?

💬 Chris Auchinvole: No.

It was some time ago, so I am sure things may have got worse. We have within this Chamber a prime example of what can happen if people get hold of your private information and things go haywire.

We do support this bill. We believe that it does take some good measures, but, again, we do have some concerns around the security of information.

I want to start off by thanking Ruth Dyson for the work that she did chairing the Government Administration Committee and by saying again that it was a committee that worked well as a group. Gareth Hughes made, I think, some significant contributions on the Identity Information Confirmation Bill and I look forward to his contribution in the Committee. Both Mr Auchinvole and Mr Bakshi were also, I think, part of a team that treated this on a pretty much non-partisan basis. But, unlike the bill that we were discussing earlier in the day, and without going back on to the bill, the Minister who was in charge of this bill when it was introduced just did not do his work properly.

Nathan Guy, who was the Minister in charge of the bill, gave us a bill where on every substantive clause, from clause 5 through to clause 16, we had to amend the bill and, in fact, we had to add some extra clauses in, in order to get it into the sort of shape that is acceptable. I know that the Minister is a relatively new Minister, but to introduce legislation to the House that is so badly inept that the whole substance of it—every clause that had any substantive effect—had to be amended is, in fact, something that is of major concern.

So you can start at clause 5, “Interpretation”—not that it is that substantive. To be fair, clause 6, which is within this part and which states: “This Act binds the Crown.”, managed to make it through unamended, and I congratulate Nathan Guy on getting that particular clause right. It is just a pity that he did not work as hard on the following clauses to make sure that they were accurate. Maybe he was just putting a challenge there for the select committee. Maybe what the Minister was doing was playing some sort of game with Mr Bakshi and Mr Auchinvole, to see whether they could find all the mistakes that he had made in the bill that was drafted and that he had introduced to the House. But I want to say to him that it is a bit of a waste of the time of the Parliament to introduce a bill that is so badly drafted and in such a bad form as he did.

The purpose of the bill is to provide a consent-based service to allow both private and public sector agencies to check identity information. It extends the use of the data validation service to public and private sector agencies, but it is very much on a need-to-know basis. There are also the intermediaries, which we will get on to. I think they are just referred to in this part, but in the next part the intermediaries are a much more important part of the bill—the major change in the bill is the intermediaries. They are in the interpretation clause and we had to put them in there, but their substantive role is outlined much more later on in the bill.

The bill allows checking whether the identity information provided by a customer is consistent with that held by the Department of Internal Affairs through the citizenship registers, the passport database, and the various registers of the Births, Deaths and Marriages registry office. For the purpose of this bill, there is a key official, and that is the Registrar-General of Births, Deaths and Marriages. That is a person on whom there is quite a lot of focus and, I think, is the person—yes, we have identified that person in the definition of “Registrar-General” in clause 5 of the legislation.

We are supporting the bill, as is obvious, because it does give Government agencies and the private sector an ability to use identity information in the fight against fraud. I think all of us know that there is a lot of identity fraud around. I do not think there would be a member of this House who is not invited 10 or 20 times a day—it might have something to do with the quality of the spam filters that we have got—to supply information that would be used for fraudulent purposes.

The Privacy Commissioner was satisfied that the legal arrangements and controls in this bill are adequate, but what we did do was a beefing-up of the responsibilities of the registrar-general and the intermediaries to work with the Privacy Commissioner on each of the contractual arrangements. We are concerned, as with the previous legislation, the Electronic Identity Verification Bill, about the security of private information. Frankly, I do trust the registrar-general and his team more than I do Novopay—or Paula Bennett, for that matter—with private information, but I think the lessons that we have had recently indicate that we should be eternally vigilant against people who break into systems, and against people who have systems that leave doors open for people to go into. That is why it is important to have a good person in that position of registrar-general as part of the team, and for the Privacy Commissioner, whose role is indicated in clause 5, to be actively involved in the area.

My colleague Kris Faafoi referred to the case of David Garrett. It was one that was an old case, it was a suppressed case, and he was someone who used the methodology that was outlined in The Day of the Jackal as a method of developing an identity. What we are told is that that sort of approach was quite common in the older days before there was a quality of electronic records and the ability to go back and trace. And what—

💬 Louise Upston: Back in your days, Trevor.

Well, back in my day, although—

💬 Hon Ruth Dyson: Better days.

I think Ruth Dyson might—no, probably not all other members of the House will remember the case of Malcolm Douglas. Malcolm Douglas was a short-term MP in this House, who was replaced in the Hunua electorate by—

💬 Hon Ruth Dyson: The Hon Winston Peters.

—the Rt Hon Winston Peters, who at the time was not even the Hon Winston Peters. But Mr Douglas was replaced when Winston Peters was first an MP. The electoral petition from the time was based on Mr Douglas voting gravestones. Effectively, the register of voters in the Hunua electorate was boosted by a number of people who had died. Some of them were put on the roll, and others had died and had never come off the roll, but by miracles these people were voting. As a result of that, Mr Douglas, who shared the approach to life of that family, was in the end no longer a member of Parliament. The point that I am making, or trying to make, is that I hope that over time we can work through these systems and make sure that as well as having a good identity arrangement for checking, it is extended to the electoral roll and, in fact, to the quality of the information on the electoral roll—the fact that people go on to the roll and, hopefully, stay on the roll, even if their addresses change. It could work there.

These cases are modern, as well. There is a case that I will not go into in any depth, because it is one where the woman is still waiting for sentencing, but she is a woman who has been found guilty of more than 20 charges relating to opening fake TradeMe accounts, gathering people’s Inland Revenue Department information, trying to access their bank accounts, and using other people’s credit cards. This is the sort of thing where we hope this legislation will make a difference. It will mean that that sort of fraud is harder to do in this particular case. Of course, the systems eventually work, but the fact that she had more than 20 charges—and I understand that they were representative charges, which means that there were quite a lot more—is an indication that our current systems are not working as well as they should.

The last case that I want to mention of this sort is the case of Te Rito Henry Miki. He was a sex offender who was employed in multiple schools as a result of changing his identity, changing his name—apparently legally, by deed poll—but not having continuity of record, which was very important in stopping this sort of offending.

I think it is important that we focus on who uses this register. I, for one, hope that the Teachers Council is an organisation that uses it and properly establishes information that tracks individuals, especially if they use changes in name in an attempt to avoid something that is bad in their past or, in some cases, to organise charges to be made in a different name from the one that they are normally known by. That, I think, is something that is quite dangerous, and, again, I think this legislation could help.

The other criticism that I make is that although this bill is going through unanimously now, I think, it is one that has taken some time. At the beginning of this legislation, the urgency of it was impressed on us, and that was quite some time ago. The select committee worked expeditiously on it—very thoroughly, as we can see from the number of changes that had to be made to the legislation—but then it just hung around on the Order Paper for an extraordinarily long time for a bill that is getting unanimous support from the House. I want to say in conclusion that I hope, with the other recent failures that had been identified in the management of the security of private information, that if there needs to be a legislative response to them, it does not take the Government nearly as long as it did in this particular case. Thank you.

I would like to take a call on this bill, the Identity Information Confirmation Bill, as a number of colleagues have, because it is an incredibly important bill that we are considering here tonight. It is one that does seek to get the right balance between the public’s right to know certain information about people and the right to privacy. As Trevor Mallard has just spelt out in an excellent speech—

💬 Hon Trevor Mallard: Eloquent.

—it was a very eloquent and excellent speech—this is a piece of legislation that has been worked on very hard at the Government Administration Committee consideration, largely in a cross-party way to make sure that we have the best piece of legislation. But it has taken a long time to get to this Committee. I think the time we are considering this is very timely, as it was with the previous legislation, the Electronic Identity Verification Bill, which we were just debating in this Chamber.

The issue of identity fraud and the issue of how it is that the Government or the State deals with people’s identity information are issues that are of prime concern to people. We have had people, not surprisingly, referring to the instances where this House itself has become implicated in issues of identity fraud—talking about David Garrett and his kind of Day of the Jackal textbook case of identity fraud. I think one of the things that this legislation is seeking to grapple with is not only the kinds of identity fraud that have always been able to happen, but how it is that this changes in the technological context in which we live. So added to The Day of the Jackal, if we are going to look for movie inspiration, I guess there is also The Net, a movie—and Clare Curran touched on some of these issues—about the way in which we are extra vulnerable around our information and our identity security in this technological age in the time of the internet. The purpose of this bill is to provide a consent-based service to allow both private and public sector agencies to check that information. The Identity Information Confirmation Bill extends the use of the data validation service to public and private sector agencies on a strictly need-to-know basis. I think it is incredibly important that this is on a need-to-know basis, because we do have to have these provisions there.

We all know that this is something that people are incredibly anxious about. We have people coming into our electorate offices and constituents talking to us regularly about their anxieties around the security of their data—who can access it, how it is going to be used, and, if they speak out, whether their information will be released by the Government as a way to silence them. What we saw is that an Australian security products company called Fellowes recently did a survey, as it does—it is into its sixth year now on these surveys—around how people feel around this issue, and it has found that 40 percent of New Zealanders are concerned about the threat of identity fraud. So this is certainly something that must be addressed.

A number of members have shared personal stories where they have been a victim of identity fraud or things that have happened in this House throughout time in terms of identity fraud, but I would just like to add a personal note there. As someone who has spent more time than is probably natural, or healthy even, in archives looking through the records of births, deaths, and marriages as a historian, I can speak about the amount of information that you can glean and piece together about a person and their life from that information. It is a tool of historians all over the world where such information is held. When you are a young postgrad historian learning the historical method, one of the first tools that you first learn to use is how it is that you piece together inordinate amounts of information from the sources about an individual. So I can speak from personal experience about the need to put these protections around this information, and to make sure that there is a need-to-use and a need-to-know basis, before people can just go in and access this information that is incredibly telling. Just as a footnote there, you will never get an historian talking about the use of Births, Deaths and Marriages records without talking about the $26 fee that it costs to access this information, and what it might do to the quality of historical scholarship in this country if there is not an exemption for research purposes.

Labour is supporting this bill because it is an important piece of the arsenal against identity fraud. We have seen over the last few months, and, actually, from this Government, which has a record of being incredibly sloppy with New Zealanders’ information, the litany of where people’s personal information has been leaked, or it has simply dribbled out of a Government agency, or where a citizen journalist has been able to walk up to a kiosk, put in a USB stick and download huge amounts of information about individuals that they should never have, or whether it be the bank account details and personal information of hundreds of the nation’s teachers being leaked through yet another one of the glitches with the Novopay system—or, as Ruth Dyson likes to call it, the “No pay” system—of the Ministry of Education. We are seeing it with ACC, we are seeing the obvious problems with Work and Income around security of data, and of course we have also seen that with the Inland Revenue Department. My colleague David Clark has spoken at length about some of the problems in terms of the department and what it has done around the breach in respect of the personal information of 6,300 people, where we have had the wrong information being sent. In the most serious case with the Inland Revenue Department 638 people had details like their addresses and tax numbers released, making them incredibly vulnerable to identity fraud. So although security companies such as Fellowes and the police will issue all kinds of advice to people about what they should do with their mail, what they should do with documents that contain their personal address and a lot of personal information—like shredding it and getting rid of it—this is all well and good, but if you cannot trust the information that the Government is holding about you, then the whole issue of your identity security continues to be a risk.

Labour will support this bill. It was pleased to have a positive input into this legislation and to be able to contribute to a lot of the changes that needed to be made to whip this legislation into shape, as Trevor Mallard has described it. We are pleased to be part of actually making sure that the 40 percent of New Zealanders who do feel anxiety about the security of their personal details might be able to take some comfort that this will not be something that will cause them this level of anxiety, and they will have confidence that the Government does have their personal information and its security at its heart, because it needs to. Thank you.

Part 1 agreed to.

Part 2 Provisions relating to confirmation service and miscellaneous matters