Identity Information Confirmation Bill

Thank you for the opportunity to speak on Part 2 of the Identity Information Confirmation Bill. As you correctly pointed out, it starts at clause 7 and goes through to clause 20. I just want to begin by expressing a little bit of disappointment in the response that the Minister in the chair, the Minister of Immigration, gave to my colleague Trevor Mallard, when he described the significant amount of change that was necessary to make this bill suitable for bringing back to the House. I was going to take a call on Part 1, but we suddenly seemed to have been voting, so I will just briefly refer to the fact that a critical part of Part 1 needed amendment, and that was the definition of “agency”. A big part of this bill is about ensuring that agencies are able to confirm identity, but the very definition of “agency” needed to be changed by the Government Administration Committee, because the bill that the Minister introduced did not include “intermediary”, and that was an obvious problem that the select committee alerted the officials to. The officials, quite properly, drew up very impressive revised definitions of both “agency” and then a new definition of “intermediary”, which, again, is described in Part 1. So two critical parts of making this bill work right—the definition of “agency”, you know, a sort of 101 of how this bill is going to work—needed to be corrected before the bill could come back to the House.

In Part 2, the part we are up to now, of course, we now have to look at the insertions consistently throughout of “intermediary”, which was omitted in the Minister’s first attempt at the bill, but then we have other quite substantial amendments as well throughout this part, including the exceptions, which are outlined on page 8. So again there were substantial deletions and rewriting by the committee. Then we get to clause 11, where the entire clause, which is a page and a half long, is deleted and replaced with appropriate wording that actually goes for—if I could just count—one, two, three, nearly four full pages of revised text. We are talking about a bill that is only 18 pages long and goes to clause 20 and then on to the schedule. This is not a big bill, yet five pages in this bill are total rewrites. That is over a quarter of the bill was rewritten. When my colleague Trevor Mallard referred to this pretty flawed, not great attempt at a bill that the Minister in the chair, the Hon Nathan Guy, had introduced, the Minister pooh-poohed it. He brushed him off. He dismissed his concerns, basically calling himself a pretty good Minister and saying that he had done a jolly fine job. Well, the evidence is before the Committee as we speak. I am very pleased that the Government Administration Committee and the officials did such a lot of work to make not a great bill but one where the intention was clearly supported by Labour into something that was fit to be returned to the House.

Obviously, clause 13 is another area that has had a complete rewrite. That is in relation to requirements of the Privacy Commissioner. If you are talking about people having confidence in a system, where an agency is able to use that service to confirm identity information that has been provided to it, then having a clear definition of “agency” is pretty fundamental. There cannot be anything more fundamental than that. Then, if you are talking about relationships and responsibilities, I would have thought—and I think that most members of the Committee would think—that the requirements of consultation with the Privacy Commissioner would be another fundamental. This is the second part of the bill that has had to be substantially rewritten.

Why do we think these issues are important? Well, I will tell the Committee why, from my perspective, we think they are important. It is because so many things have been going wrong with our departmental systems.

Mr Chairman—I thought you were going to push the buzzer there, and I was just anticipating. [Bell rung] Mr Chairman.

The CHAIRPERSON (Lindsay Tisch): The Hon Ruth Dyson.

That was a taunting little act, Mr Chairman—done in the best humour, I know, and actually on the grounds of accuracy, I am sure.

Some are systems that are in-house, like the shambles that we have seen at the kiosks at Work and Income, where a regular punter went in, did not hack into the system, just used it as it was intended, and the next minute was provided with copious amounts of information that nobody wanted him to have. Work and Income had been alerted to this security concern and, for some reason, did not seem to think that it was appropriate to tell its Minister, the Minister for Social Development. Maybe its Minister would not have been interested in such a potential security breach, but, in my view, that is the sort of activity that the Committee should be extremely concerned about not just because it was not hacking—it was just using the system as intended—but because it exposed some of the most vulnerable members of our community to potential abuse.

There was a breach of their privacy. Fortunately, the person who breached the security—quite legitimately, as I understand it—did not use that information for any purpose that could have done any harm. Thank goodness for that. What if it had been someone who had malicious intent and knew how to operate the kiosk? The kiosk was set up so that Work and Income clients—people who are receiving a benefit or people who are going there for information and support—can look up things like information about jobs. It was never intended to pass over information about children in foster care, their medication, their personal addresses where they are living, or other information that potentially is very damaging.

We have also had some discussion about the total shambles that Hekia Parata has—in a pretty intelligent move, actually—pushed on entirely to her Associate Minister of Education the Hon Craig Foss. I guess the temptation to pass on this sort of shambles to your associate is pretty strong, especially when you are in such a lot of difficulty. In my home town of Christchurch the Minister came into town and said she was going to close and merge a lot of our schools, and now people are wondering what on earth that is all about, because there is no logic to it and there is no intention to have better educational outcomes. It is all a bit of a frustration and stress inducer, actually.

But what the Minister Hekia Parata has pushed on to her Associate Minister is responsibility for Novopay. First of all, the problems with Novopay were pretty straightforward—immensely frustrating for teachers. Some of them just did not get paid. Then we found out that some of them had got paid, even though they had left teaching some time ago. Well, pleasant though it might be to get a big dollop of money in your bank account when you are not working for the person who has paid you that money, you have also got to pay it back. You feel pretty uncomfortable that you have taken something that does not belong to you. It is an additional hassle and stress for people who, frankly, do not need it.

But now we have found out that it is not just teachers not getting paid, or people who are no longer teachers getting paid, but that some schools are getting access to information—private details—about teachers who are not at their school. I noticed the Associate Minister’s comments about that. He said that every issue was being taken seriously. Well, that is jolly fine, but, actually, what we would like is the system fixed so that we do not have this ongoing problem for teachers, who are now going through their exam period, thinking about the Christmas break, and not knowing at all what their financial situation is going to be, because of this totally incompetent pay system. Having the Associate Minister say “Oh, we’re taking all these issues seriously.” does not actually cut the mustard, frankly.

It is not good enough. It is like the quality of this bill when it was first introduced. The Marshall Laing Primary School associate principal said that it would have been easy under the current Novopay system to divert money from a teacher’s bank account, through the breach in the system. How do teachers around the country feel about that? I do not think they would be very satisfied with it at all. This is just the latest in a series of very important and serious breaches, where people’s individual privacy has been threatened and where people have been sent the wrong information by Government departments. I do not think, frankly, that the Government is getting on top of this at all.

I rise to speak to Part 2 of the Identity Information Confirmation Bill and, firstly, to say that the Green Party would really like to be able to support this bill. If—hope against hope—we get support for our Supplementary Order Paper 148, then we will happily support this bill.

We do recognise that identity fraud is a significant issue, causes much stress and hardship within our society, and is something that is deserving of proactive legislation to redress. However, I guess for us it is a matter of balancing harms, and we have a concern that although this bill as it is currently framed talks about fraud—a lot—it also opens up a system for employers to provide pressure on people to have to provide information that they are currently protected from having to provide.

The Human Rights Act 1993 protects job applicants from discrimination on certain grounds. Employers should in the process of employing somebody ask only questions that relate to the requirements of the job and how qualified the candidate is for that job. We have recognised that there are very common grounds that people are discriminated on. It may be their date of birth, nationality, sex, gender identity, pregnancy, marital status, religious belief, colour, race, disability, age, political opinions, etc.

We have the Human Rights Act to protect people against that discrimination, because we know that it exists. My real concern is that this bill is going to open people up to having to disclose information that will trigger that discrimination, whereas at the moment they are protected from having to give it. As an example, when I apply for jobs I never put my date of birth on my CV. I know that age is a basis of discrimination and that for people over the age of 40 it is much harder to get a job. I never provide that information to give that in. And I know that in this country people have been advised to change their name, to Anglicise their name, to be able to get interviews. My concern is that this bill will open up that process and will give employers that information without having to ask for it directly, and they will therefore not be open to a challenge for a breach of the Human Rights Act.

I will give some examples of that to prove my case around, in particular, age discrimination and the discrimination on the basis of ethnicity. The Human Rights Commission has done a report, A fair go for all?, looking at some of the racism in employment practices. Within that they gave an example of a 22-year-old job seeker who had moved to New Zealand from Syria. He was told that he should change his name to something more Kiwi to be able to get an interview. Another example was an Auckland-based civil engineer applying for a graduate position within an architectural business in my home town of Invercargill. The hiring manager asked for more details around who he was, trying to determine his ethnicity—asking for a photograph, his country of origin, and how long he had lived in New Zealand. When the applicant asked why he was asking for that information he was told that, well, unfortunately, any southern New Zealand client would possibly think twice about dealing with anyone with a Middle Eastern name.

With this bill the employer is not even going to have to say that. They are going to ask for that information because it is about verifying their identity, whereas in this situation the person said “Why are you asking for this information?” and then was told, and got a clear indication of discrimination. That is not going to happen under this legislation, potentially, which is a very real concern.

Another basis of discrimination in this country is around age, and research that was done in 2006 through the Auckland University—

I wish to take a call on Part 2 of the Identity Information Confirmation Bill. It is interesting listening to the debate in the Committee tonight. I would like to make a few comments. First of all, I think it is important to realise that Part 2 is a very important part. I acknowledge the contribution that the chair of the Government Administration Committee, the Hon Ruth Dyson, made before. I acknowledge that the select committee did a lot of work on this bill, and I thank it on behalf of the Minister of Internal Affairs for that. Importantly, Part 2—

💬 Hon Trevor Mallard: Who introduced the bill?

I did introduce the bill.

💬 Hon Trevor Mallard: Very poorly drafted. Not the member’s best work.

I acknowledge, Mr Mallard, the good work of the select committee and the bill that we now have in front of us.

Importantly, Part 2 looks at the provisions relating to the confirmation service and miscellaneous matters—and I will come to Jan Logie’s Supplementary Order Paper 148 in a moment. It also talks about how to use the confirmation service, in clause 9. It talks about the parties to the confirmation agreement, in clause 10; that is an important part. It also talks about, in clause 11, the general requirements for the form and content of the confirmation agreement, and it follows right through to the terms and conditions of that agreement, and, importantly, under clauses 13 and 14, the safeguards that the Privacy Commissioner has over this particular piece of legislation.

If I refer now to the member’s Supplementary Order Paper—Jan Logie’s one, which is Supplementary Order Paper 148—I think it is, first of all, worthwhile mentioning that there are legitimate reasons why employers may need to confirm the identity information of a potential employee. There are no current provisions, as I understand it, in the Citizenship Act 1977 or the Births, Deaths, Marriages, and Relationships Registration Act 1995 for the employer to verify the citizenship status of potential employees. This bill allows employers to verify that a potential employee is a New Zealand citizen. That is an important part of this bill, and to read Supplementary Order Paper 148 from Jan Logie and to hear her comments that this part opens up a system to provide pressure on the employee, I do not agree. I also do not agree with her comments that it is going to trigger discrimination, because, ultimately, the individual has to consent. If I can find that part to try to reassure the member, it is covered under clause 8(1)(a): “the individual has consented (in written or electronic form) to the check before it is carried out ...”—

💬 Denis O’Rourke: What about pressure to consent?

—and it goes on to, I believe, clarify that the individual will not be pressured, because they have to consent to it.

So the Government does not support the Greens’ Supplementary Order Paper 148, because that is an important part that is included in the bill to allow the employer to clarify the status of the employee.

It is not very often that I agree with the Hon Nathan Guy, but I think in respect of the amendment in the name of Jan Logie I do take that position. I think it is fair to say that the operative part of this Identity Information Confirmation Bill was after two types of problems. One was people who take people’s identity for the purpose of getting money, and the other was the sort of person who takes someone’s identity often for even more nefarious purposes than that. I referred earlier to the case of Te Rito Henry Miki, who has appeared before the courts as a result of shifting from school to school and changing his identity as he went. I, as a former Minister of Education, had a lot to do with the Teachers Council as it was set up, and saw reports on absolutely awful cases of abuse—absolutely awful cases of abuse. What made it worse in some cases was that the individual, when they were close to being caught, used what are legal methods of deed poll and other arrangements to change their name, to move on in identity, and then they repeated their offences. That is something that this particular character did, and my hope is that having a proper identity verification service will stop an individual doing that, because it will supply a continuity of record of an individual’s name.

I accept that that will result in some prejudice against some individuals getting jobs because of their previous records, but my view is that when it comes to areas such as education and health, there is the trust that we put in people and the risks that we face with people who are not who they say they are—and we have had recent cases of medical practitioners who have pretended to be other people, and students who have pretended to be other people, and have had access to things that they should not have access to. This will not be the total solution, but a major part of the purpose is to have the continuity of identification of the individuals.

I understand what the member is saying. She is concerned that by giving an age it means that it will result in prejudice against someone because of their age. Well, if that is the case it is already and quite separately an offence—you are not allowed to do that—but at the moment date of birth, along with name, is actually a pretty good unique identifier. It is a way of checking that people are who they say they are and having that continuity.

Although I have got sympathy for the views of the member and I share her concerns at misuse, especially, of age information if it results in prejudice against the old or the young, because it can happen both ways—especially in these days when you have, you know, 2,000 people applying for five jobs and it can be used as a screening method like that—and that is a danger. But I also say that for a lot of jobs it is important to identify the individual and to verify them. Therefore, we will not be supporting that amendment.

As we indicated before, this part of the bill has had substantial amendment. The introduction of the intermediaries is something that was particularly important, and it has reshaped the bill as we worked through, but it is a piece of legislation, with all of that work, that we now support. In fact, we support it so much that we have agreed that the third reading be part of the extended sittings that we are looking forward to in December, to ensure that we can get the bill through and get it operative as soon as possible in the new year.

New Zealand First supports the Identity Information Confirmation Bill to help attack identity fraud and ensure that only identity confirmation information is supplied and only to approved agencies. Identity information means information about a person’s full name, gender, date of birth, place of birth, and other recorded information—for example, a passport photograph—and the status of the recorded information. The service can be used by an intermediary who is a party to a confirmation agreement with the responsible officials.

The purpose of Part 2 is “to allow an agency or intermediary to check whether an individual’s identity information is consistent with any recorded information.” That in itself limits the scope of the confirmation service, but I am glad to see that there are many other safeguards. In clause 8 there is a list of conditions for using the confirmation service, which most particularly, of course, require the individual to consent, whether in writing or electronically, and that is an important basis of the protections provided to the individual under this bill. It requires the agency or intermediary applying to give an assurance that the consent has been obtained and, of course, that it has also entered into the required confirmation agreement. There is also the ability for an individual to consent on a one-off basis or an ongoing basis, and to withdraw that consent, as well. We think those are all very important safeguards in the bill for the individual.

We also approve, of course, of clause 9(4), which states: “The confirmation service must not, at any stage, supply to the agency or intermediary any recorded information about the individual who is the subject of the search.” So it really is only confirmation information that is provided, and it is important that it be limited in that way. Clause 9, of course, provides a bit of an exemption in respect of, obviously, people who have died or where there has been a name change, or where the status of recorded information has changed as well, and those are necessary exemptions.

Clause 10 gives a long list of requirements in respect of the responsible officials, requiring a need to be demonstrated by an intermediary before they can enter into an agreement, and also they must have policies and practices in respect of the security of information and relating to the privacy of individuals. We think those are particularly appropriate and important ways of limiting the scope of the bill to make sure that it is focused only on what it is intended to achieve.

Clauses 11, 11A, and 11B contain very comprehensive provisions concerning what must be in a confirmation agreement and, in addition, how those agreements are to be used. I note the addition of new clause 11A, concerning how the agency must obtain an individual’s consent and how he or she may withdraw that consent. I also acknowledge the very important role of the Privacy Commissioner.

New Zealand First believes that the protection of the individual forms an important part of this bill, while at the same time it provides an efficient and valuable service for agencies and intermediaries to obtain confirmation information. So for those reasons New Zealand First is happy to support the bill.

I did finally want to comment on Jan Logie’s Supplementary Order Paper 148 to exclude the use of the service for employment processes. That should be supported, as well. Like Jan Logie, I agree that it is very important that we should do all we can to stop age discrimination and similar forms of discrimination. We think it is a serious problem. We think that it is often underestimated in this House. I think that Trevor Mallard and some other speakers have underestimated it, and I would really ask the question, in relation to that, of what harm it would do to pass that Supplementary Order Paper and have that provision. I think it is harmless, and I think it would make a contribution. I do understand that—

I would now like just to take this chance to address some of the responses to our Supplementary Order Paper 148, where the Minister in the chair justified this and said it could not be used, in effect, to hide discrimination because it was optional and people would have the ability to opt out of it. My concern is that discrimination happens primarily to marginalised groups. Marginalised groups are the least likely to be able to stand up and step out of what is seen as the standard pathway, because of the fear of discrimination on the basis of doing just that. On that basis, I really do not believe that the opt-out clause in this bill is going to protect those people.

We have also heard from my colleague Trevor Mallard saying “Well, it is an offence already. Discrimination is an offence already. This is not going to make a difference.” Well, my point is that employers currently have to ask questions to find out that information, and you can use those questions as evidence in taking a case of discrimination. This bill will mean those employers will not have to ask those questions, and you will have no evidence that you have been discriminated against.

I would just like to draw the Committee’s attention to how prevalent age discrimination is. The research from 2006 from the Auckland business group at the university showed that 25-year-old workers were six to 12 times more likely to be short-listed for a low-demand position than a 55-year-old-plus worker. That is six to 12 times. This is a really significant issue in our society, and this bill has the potential to hide that discrimination. I do not think that is good enough.

When Mr Mallard also said—taking an issue that is incredibly dear to my heart, protecting victims of sexual abuse—“Well, we have had this evidence of a school teacher going from school to school and changing identity.”, I am not going to say that that is not an issue. I do not believe this legislation is the appropriate response to that issue. What this legislation does is take away a kind of simple way of carrying on abuse when nobody has taken any action. The appropriate response to sexual abuse being done by teachers in schools is to act on that abuse and to take that to the courts, not to set up an alternative system that is going to undermine people’s human rights and rights to privacy. This bill does not protect fundamental human rights, and I believe that the older people in New Zealand and people born outside of New Zealand deserve our care and our protection in the employment market.

I thank the Hon Nathan Guy for taking a call earlier in the debate on this bill, the Identity Information Confirmation Bill. He was very noble to the chairperson of the Government Administration Committee, the Hon Ruth Dyson. He said that the committee had done a lot of work on the bill, and good work was being done by the select committee. It was cool because that committee fixed the bill. It actually made a raft of changes within this bill and absolutely improved the bill. Mr Guy should be thankful for the fact that the select committee looked through the bill and made a number of significant changes to it.

I did want to talk to Part 2, specifically clause 9(8), which gives an example. It states: “For the purposes of subsections (6) and (7), identity information may be treated as consistent with recorded information despite any variation between them because of pronunciation or punctuation.” It gives an example here within the bill. I just want to give a personal example. On my driver’s licence my surname is spelt F-a-’-a-f-o-i. But because of the trouble that the apostrophe has caused our family, we decided, when we are using it on a daily basis, to get rid of the apostrophe. On my passport it has the apostrophe, and when we have booked tickets to go overseas, the ticket agent has removed the apostrophe. So we have actually had instances where we have turned up to check in for the flight and they have said: “No, you can’t check in. Your passport says one thing and your ticket says another.” That was just because there was an apostrophe within the official document and the ticket has not had an apostrophe. That has been an issue for us, so it is good to see that a practical implication of this bill in clause 9(8) is going to give a little bit of leeway for the likes of accents and hyphenations. The Faafoi family—the Fa’afoi family—will be very, very happy about that.

I also wanted to talk about clause 7, which is around the introduction of intermediaries. We think that, as I said before when I was commenting on the good work done by the Government Administration Committee, this is a very good improvement, because the intermediaries will offer greater convenience and reduce compliance costs for those involved. During this debate I did ask Ruth Dyson whether or not maybe members of Parliament could be considered as intermediaries, because from time to time we do have people who come into our electorate offices so that we can act as witnesses and confirm their documentation. That may have some implications for members of Parliament in terms of acting as intermediaries, as has been pointed out throughout debate on Part 2 of this bill.

I also wanted to have a quick look at clause 17, which pertains to the Privacy Commissioner and the fact that they may require periodic reports on the operation of this confirmation system. The clause is very short and I will read it out for you: “The Privacy Commissioner may, at intervals not shorter than 12 months, require the responsible officials to provide the Privacy Commissioner with a report on the operation of the confirmation service.”

I do just want to go back to Part 1 of the bill and to clause 4, “Purpose”. Clause 4(b) states that we should “ensure that agencies can use and, if necessary, record confirmed identity information.” I think we should also have a look at inserting a word there or taking some action to make it “securely record confirmed identity information”, because, as we have seen in recent months, there has been a number of privacy breaches within a number of Government agencies, which have caused great concern to members of the public. Firstly, there was the privacy breach at Work and Income, where citizen journalist Keith Ng was able to access a kiosk that was freely available to any member of the public. He strolled into one of these offices, got out a USB stick, and pretty much helped himself to 7,000 documents of very sensitive information pertaining to suicide cases, to medical records, to invoices for contractors, and the like. I think most New Zealanders were aghast at the level of information that he was able to get his hands on at a publicly available kiosk in a Work and Income office. I think clause 17, giving the Privacy Commissioner the ability to ask for a report, certainly would help in monitoring those kinds of privacy breaches that we have seen in the likes of Work and Income.

Unfortunately, Work and Income is not the only instance of a privacy breach that clause 17 may be useful for in the future. We have also had the account of the Inland Revenue Department. I may stand corrected, and I may hear it from behind me, but I believe 6,300 individuals have been affected in the last year by breaches of privacy by the Inland Revenue Department. This is a department that does not like it when taxpayers get things wrong. The fact that in the last 12 months 6,300 individuals have been affected by privacy breaches is not a good look. If the Inland Revenue Department were to be part of this at some stage in the future, to help verify identification, I think the fact that clause 17 would be there to allow the Privacy Commissioner to proactively look at any breaches of privacy would be a good thing.

Unfortunately, it does not stop there. We have also got the case of the Accident Compensation Corporation, which I believe gave the details of 6,748 individuals to one member of the public, who went public in a big way and obviously caused a whole heap of ructions on the other side of the House. That is, again, another Government agency that is dealing with very sensitive information. It managed to release a lot of information of nearly 7,000 individuals in one email. So clause 17, which would allow the Privacy Commissioner to look into that whenever he or she wanted to, is a good part of what is contained in this bill.

Unfortunately, that is not where it ends. We have also got the Ministry of Education, with Novopay, and the fact that a number of teachers have had their private details or their pay details released to schools that they do not work at, as another breach of privacy. Of course, this is of much concern to the public. Clause 17, within this bill, would obviously give the Privacy Commissioner some leeway to proactively look into those privacy breaches.

We are painting a bit of a picture here that there is serious concern in the public about the level of security around information and the trust that the public have in Government departments, and whether they can be trusted with the security of this information. The current state of affairs, I think, if we were to ask members of the public, is that there is serious concern. But I think that a provision like clause 17 in Part 2 of this bill would ease some of those fears—the fact that the Privacy Commissioner could proactively look at any potential breaches or actual breaches of privacy within the realm of this bill.

Privacy is very important, and, of course, it is the confidence of the New Zealand public in Government agencies to hold private information secure that gives us a level of confidence in their ability to do their basic functions. I think it is fair to say that in the last year or so we have seen, in a number of instances, cases where the confidence of the New Zealand public has been pretty much rocked by what has gone on. I think probably the worst case that we have seen in the last 12 months is that of Work and Income, where that information was so easily accessed.

We are supporting this bill. I would like to thank whoever drafted clause 9(8), as that has eased the pain that I have felt for many years over a single apostrophe in our name. I also thank the Government Administration Committee for doing a lot of work to tidy up this bill from the state in which it arrived into the Parliament.

The question was put that the amendment set out on Supplementary Order Paper 148 in the name of Jan Logie to clause 8 be agreed to.