Electronic Identity Verification Bill, Identity Information Confirmation Bill

on behalf of the Minister of Internal Affairs: I move, That the Electronic Identity Verification Bill and the Identity Information Confirmation Bill be now read a third time. These two bills represent a shift in how New Zealanders’ identity information can be used for proving who they are. Both bills shift away from heavily paper-based models and allow identity services to be brought into the 21st century. The bills achieve this in different and complementary ways. The Electronic Identity Verification Bill governs the operation of the igovt Electronic Identity Verification Service. The bill will enable New Zealanders to verify their identity once the Department of Internal Affairs—sorry, to the Department of Internal Affairs—and then to be able to use the igovt services to prove their identity online.

💬 Hon Trevor Mallard: Do you want me to read it for you?

No, I think I will be OK. The bill itself is rather mechanical in nature, specifically setting out how individuals apply to use the service and what the legal effect of the service is. The Electronic Identity Verification Bill opens up the potential of the internet. It is hard to know who someone is online, even if they want you to know. The bill changes that. It allows individuals to prove who they are online, when they want to do so. This opens up the internet to allow Government and business to offer more online services, particularly services that involve risks, such as the handling of sensitive personal information. The service will become an essential piece of infrastructure for New Zealand.

The igovt log-on service has existed in a limited form for 3 years. This bill will enable it to be used much more widely and will encourage the uptake of online Government services.

The second bill, the Identity Information Confirmation Bill, governs a service for agencies to confirm that individuals’ identity information is correct. Identity fraud is a serious issue, and this is another tool to help us combat it.

💬 Hon Trevor Mallard: How many cases a day?

Heaps. The department holds the authoritative source of identity information for many New Zealanders through its Citizenship Office, Passports, and Births, Deaths, and Marriages registry functions. Agencies must gain the consent of the individual before using the service. Again, the bill is largely mechanical in nature to support the service. The Identity Information Confirmation Bill supports agencies when dealing with customers, through both online and off-line channels. The bill allows Government agencies and businesses to be more confident that they are not dealing with false identity information. This combats the increasingly sophisticated fake documents being generated and passed off by fraudsters.

It is important that employers are able to use the confirmation service during employment processes to identify fraudsters wrongly applying for jobs, especially in sensitive roles such as in the education sector. The service also enables employers to comply with the Immigration Act’s requirements that they not hire people who are not entitled to work in New Zealand. It also means that individuals do not need to show as much identification to prove who they are. Again, the service will be an essential piece of infrastructure for New Zealand.

These bills and the services they govern have a number of similar policy foundations. Both of the bills deal with the sharing of personal information that is central to verifying an individual’s identity. Privacy considerations have been at the forefront of policy decisions on these bills. In particular, both bills require the consent of the individual concerned before any information is shared. Both bills also enable the Privacy Commissioner to ask for reports on the services being regulated, so that the Privacy Commissioner can proactively monitor these services, rather than waiting for complaints before being able to act.

The bills also have other safeguards to ensure personal information is used responsibly by agencies. These safeguards are in line with the information privacy principles of the Privacy Act 1993. Both bills enable people to opt out of using the services, and require participating agencies to maintain alternative ways of dealing with people. The digital divide is an important policy consideration, and we have to accept that some people are not comfortable or able to use new technologies. A person should not be penalised for opting out of using either of these services.

These bills aim to reduce identity crime in our society. Identity crime has been an increasing problem, whether it is through the creation of a false identity or, worse still, stealing someone else’s identity. There are numerous high-profile examples, such as the convicted sex offender who committed identity theft in order to—

💬 Hon Trevor Mallard: David Garrett.

—I agree with the member—obtain employment in the education sector, or the fraudster who created 100 false identities in order to obtain millions of dollars in superannuation benefits. Sadly, these cases are the tip of the iceberg. These bills offer new tools for Government agencies and businesses to prevent identity crimes. In doing so, they also reduce the chances of innocent members of the public having their identity stolen.

I anticipate that both bills will be important for helping New Zealand businesses to meet their obligations under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009. When that Act comes into force in July 2013, banks and other financial institutions will be required to undertake greater checks to verify the identity of their customers and thus prevent identity crimes. These bills will help those businesses to do this. Importantly, the bills do this in a way that reduces compliance costs.

I would like to thank the Government Administration Committee for its rigorous consideration of these bills, and the 12 submitters to the committee. I appreciate the multipartisan approach that has been taken towards the bills and the constructive chairmanship by the Hon Ruth Dyson. I would also like to thank my ministerial colleagues the Hon Nathan Guy and the Hon Amy Adams for the work that they undertook to progress these bills during their times as Minister of Internal Affairs. I commend these bills to the House.

The Labour Party is supporting these bills, the Electronic Identity Verification Bill and the Identity Information Confirmation Bill, and I think we will be supporting them with a little more enthusiasm than the Minister for Courts, Chester Borrows, who has just spoken in favour of them. Some of us have thought about this issue before we came to the House. I have got a bit of advice for the Minister, who is a relatively new Minister, and that is it always pays to look beyond page 1 when you are handed someone else’s speech. In that way, you can work out whether there are any words you do not know or if anything is not clear. What was absolutely clear was that the honourable Minister, in delivering that speech, had not looked past page 1 before he started delivering it.

💬 Chris Auchinvole: Oh, don’t be unkind.

Well, no, I am being generous to him. If the Minister had looked beyond page 1 and delivered the speech like that, it would be very serious.

💬 Maggie Barry: Oh, faux gravitas has choked you, has it, Trevor?

Unlike the member opposite, I have not had as much to drink over dinner tonight as she has—as she has.

💬 Maggie Barry: Maybe you should.

Well, if drinking turned me into a person like Maggie Barry, I would certainly not take it up. I would certainly not take it up, because she is the evidence of the problem. She is the evidence of the problem when that sort of thing occurs.

These bills really come at the same issue from different perspectives. The Electronic Identity Verification Bill is an opt-in scheme whereby people can get into the system, get in there once, and stay in there and give permission for different agencies to use the authentication system in order to know whom the agencies are dealing with. I think that over a period of time more and more people will want to get involved this way, although I must say it is a matter of trust as far as Government agencies are concerned, and we have had quite a few problems with trust of Government and Government agencies in this area. One just says ACC and Judith Collins. We say Work and Income and Paula Bennett. We say Novopay and Novopay and Novopay and Paula Bennett and Judith Collins. What we have is breach after breach after breach after breach of privacy on the part of Ministers and of Government departments. I say that those people are going to have to clean up their act and they are going to have to clean up their agencies, or there will not be a chance of people willingly going into the system, because they know that Ministers will spray their private details around into the public—spray their details around into the public—in a way that is just not acceptable.

I agree with the comments that I presume were drafted by officials for Chris Tremain, the Minister in charge of the legislation, around the work of the Government Administration Committee. I want to acknowledge both Mr Bakshi and Mr Auchinvole for the work that they did do, but I think what people will generally agree on is that in the select committee on these bills, it did not really matter which party you were coming from. You know, we had different perspectives on some of the details and different angles on occasions—and I do want to acknowledge the work that Gareth Hughes did; he did a good job in this particular area—and we mainly came to agreement. I also want to acknowledge the Government’s flexibility in making changes to make the legislation work more carefully when evidence was produced in the select committee. As far as the punishment regimes were concerned, I acknowledge its willingness to shift from something that was, for multi-fraud on the part of a company, a bit of a slap with a wet bus ticket, to something that might at least be a ruler across the hand, rather than a wet bus ticket. So there has been some change in this particular area. There have been some powers granted to the Privacy Commissioner, who will be able to proactively require reports about the operation of the service, although I must say that having the Privacy Commissioner being able to ask for a report, or even asking for a report and getting a report that is available, appears to be a different thing these days. I will say no more about that.

Going now to the Identity Information Confirmation Bill, what this does is allow both public and private sector agencies to check identity information. It is my expectation that it will be used pretty extensively not only by a number of Government agencies but also, eventually, by banks and similar organisations. I think there will be a standardisation of the identity verification services. It allows agencies to check whether the identity information presented by a customer is consistent with what is held by the Department of Internal Affairs through its registers: the citizenship register, the passports database, and the various registers of the Births, Deaths and Marriages registry office—although I think probably it would be unlikely that many people would want their identity information confirmed through the deaths register. I think if they are doing that, it might be an indication of an issue for the person, and a possible fraud. Although if it was like—

💬 Chris Hipkins: Unless they’re David Garrett.

David Garrett. I was going to get on to David Garrett, the ACT member and, I understand, a very close friend of a number of people opposite, including the one with three names whom I have forgotten—Jami-Lee Ross. I have got it. He is a very close friend of Jami-Lee Ross, Mr Garrett. I understand that Mr Garrett actually gave Mr Ross’ mother advice on his name. You know, he got it off a headstone or three—got it off a headstone or three—and I think that is—[Interruption] Well, the members opposite defended him for so long. The members opposite defended David Garrett for quite a long period of time, and I just want to say this. They seem to say that there is not much of an issue—not much of an issue, they said. This was a guy who stole the identity of a dead baby. He stole the identity of a dead baby, and the National Party members defended him.

I am pleased that since that time they have confessed their sins. They have confessed their sins and said “We have got to have a system that is better, and we will not allow that sort of thing to occur in the future.”, and they have been involved in this legislation, weak as it was when it was introduced. But with the work of a number of people, it has got a lot stronger—again, especially Mr Auchinvole. I want to acknowledge the fact that he put a bit of backbone into the Ministers. Mr Auchinvole, in particular, was very clear. He gave us examples of frauds with his own credit card. The member had been slightly loose with his details, and they were being used on a basis that was absolutely inappropriate. He shared that with us, and I think a number of us—most of us, many of us—have been involved in things that have looked dodgy. It is slightly harder to do now, although I am informed that every day in New Zealand there are about 2,000 cases of online, or related, identity fraud. Credit card fraud, people using the—I suppose we are not allowed to talk too much. Oh, it is not before the court, is it? But there are questions about a member of Parliament and whether he used the cash card in the appropriate way or not. If that is proven, then that would be a very serious matter.

But there are privacy breaches all over the place. In 2011, probably because of the lax leadership of “Paula Benefit”—Bennett, sorry; that is the Wainuiōmata name. I have been in Wainuiōmata too long this week. “Paula Benefit” is what she is known as over there. Paula Bennett’s leadership led to a breach of privacy—a massive breach of privacy. She put a beneficiary’s details into the public. The Work and Income staff thought it was all right to do the same, and 10 of them were so bad last year that they had to get the sack. In 2011, 10 people from Work and Income followed Paula Bennett’s leadership, and they got the sack when, actually, she should have.

I rise to speak on the cognate bills, the Electronic Identity Verification Bill and the Identity Information Confirmation Bill, both of which are big steps forward in identity information management, making life easier for consumers and for businesses. It is always a pleasure to follow the Hon Trevor Mallard in a debate, and to try to work out how on earth something that was such a matter of agreement between the people at the Government Administration Committee has suddenly become a huge partisan issue, although I think he did say that partisanship was subordinated to common sense. These bills are an exercise in common sense and in consideration of what is sensible. The Electronic Identity Verification Bill will regulate and enhance the operation of the igovt identity verification service, including making it available to private sector agencies, as well.

I would like to acknowledge the initial efforts of the chair of the Government Administration Committee, Ruth Dyson, and the subsequent efforts of the select committee in her absence. We worked very well together, and I think everybody brought something to this bill. Indeed, I reflect Mr Mallard’s comment about Gareth Hughes certainly contributing with safeguards and concerns over verification processes. He was assiduous in follow-up work, and we were all able to contribute. We all enjoyed it, and when it came to penalties I think it was Eric Roy, the Deputy Speaker, who suggested that we should really lift the game, rather than leave it where it was, where people did not suffer too much as a consequence of stealing information. As the Hon Trevor Mallard said, each of us had something to bring to the table. In my particular case I well remember being part of a bank verification group that sold its files to a commercial company in America, which then contacted us about buying shares and that sort of thing. It showed complete disregard for the privacy of identification. This bill shows that this Government understands that it is time to expand the service to allow for a greater range of uses, so that people, the Government, and businesses can realise the benefit that internet technologies offer. The Department of Internal Affairs is partnering with New Zealand Post to commercialise its service and to make it more widely available.

We were—I think I speak for all the members of the select committee—particularly impressed by the work of the officials on this bill, in that they would listen to our concerns, they would go away, and they would come back with a complete description of how our concerns could be met.

The Identity Information Confirmation Bill creates a new service that enables approved agencies to check whether identity information—names, dates of birth, and that sort of thing—presented to them by customers is consistent with the records held by the Department of Internal Affairs. Again, I was able to instance the fact that I had had my bank card stolen. The only thing—

💬 Chris Hipkins: Who would want it?

Well, exactly. That is exactly what I thought—who on earth would want it? And when I was interviewed by the police I said to them: “Why would they want these cards? I have already cancelled them.” Mind you, that was an experience in itself—phoning the bank to say “I wish to cancel my cards. They have been stolen.”, only to have the bank say “What were the numbers?”. I did not know what the numbers were. I was standing in my gym gear. My trousers had been stolen and my wallet with them. Mind you, my tailor later, when I put in an insurance claim, asked “Were you in the trousers at the time?”. I was not; they were nicked out of the gym.

💬 Hon Amy Adams: Too much information.

Too much information, indeed. But the interesting thing was that those people used the cards as their identification in South Auckland to open accounts at department stores, and they were accepted. The only thing that prevented me from being charged and prosecuted for the bills was the fact that they were a different age from my age.

This new system that we are putting in will provide a safeguard against that. It will also help to ensure compliance with the Anti-Money Laundering and Countering Financing of Terrorism Act 2009, which requires banks and other financial institutions to undertake more comprehensive “know your customer” checks. In an earlier age, of course, we all did know our own customers and that sort of thing, but we live in different times now.

The Data Validation Service will be available only to organisations that meet strict security, privacy, and integrity criteria. We have heard on this side of the House endless criticism of breaches in security. For goodness’ sake, it is the exception that proves the rule. Things will occasionally go wrong. It is not the end of the world when there are breaches, but what it does normally do is ensure that safeguards are put in place.

These bills will enable New Zealanders to transact more easily online, and will give businesses and Government agencies confidence against identity fraud. They will give individuals confidence against identity fraud. The identity services will be able to be used by all New Zealanders for a wide range of transactions offered by Government and private sector agencies. The culmination of all this will be that New Zealanders will be able to prove their identity quickly and securely when dealing with Government agencies and businesses. Thank you.

I am very, very pleased to take a call on these particular bills, the Identity Information Confirmation Bill and the Electronic Identity Verification Bill. I have only one question for the member who just spoke, Chris Auchinvole, and that is if someone was going to steal another member’s identity, why on earth would they choose his? Clearly—clearly—they had not done their homework, if they chose Chris Auchinvole’s identity to steal. Clearly, they are proving the Darwin theory if they tried to steal Chris Auchinvole’s identity.

It feels a little like The Day of the Jackal here today because, actually, this legislation should have been passed quite some time ago, and would have been passed quite some time ago if the Government had not put it on the back-burner. Why did the Government put it on the back-burner? Well, let us go back. Let us rewind the clock back and try to remember why the Government might have put this legislation on the back-burner. I believe that it was dealing with a few identity-related issues at the time this legislation was languishing on the Order Paper. In fact, a member of Parliament who was part of the Government stood up in the House and made a statement confessing that he had stolen the identity of a dead baby. After he did that, suddenly the Government did not want to debate this legislation. It put it right down at the bottom of the Order Paper—

💬 Hon Judith Collins: He was not a Minister.

He was part of the Government. If all those backbenchers over there can claim that they are part of the Government, then David Garrett was part of the Government.

💬 Maggie Barry: What about Gareth Hughes?

Well, Gareth Hughes is sitting right over there, and I do not think Gareth Hughes has done anything wrong. I think Maggie Barry should apologise to Gareth Hughes for that absolute slur on his character. I believe that Gareth Hughes is an upstanding citizen. I do not think he has ever stolen the identity of anybody, and I think Maggie Barry should stand up and apologise. In fact, Maggie Barry has got no right to comment about identity theft, because she has never done it. Therefore, under Maggie Barry’s standing orders, she is not allowed to talk about it. If Maggie Barry has not stolen the identity of somebody, she should not be commenting on it. Apparently, according to Maggie Barry, you can talk about something only if you have done it yourself, and if you have not then you should not be talking about it.

Identity theft is an issue that all New Zealanders will have an interest in, because an average of 2,000 New Zealanders a day are affected by some form of identity scam. That is quite a significant number—2,000 New Zealanders a day are affected by some form of identity scam. I said in one of the earlier readings of this legislation that I think—

💬 Maggie Barry: Don’t worry, no one remembers it.

Nobody remembers it, says Maggie Barry. Well, I cannot remember a single thing Maggie Barry has said in the House this year, other than insulting all of the other members of the House, which she is quite good at. I have to say that Maggie Barry is quite good at insulting other members. I do not think she has made any other contribution to Parliament than sitting up the back after long, emotional dinners and flinging insults to the other members in the House.

As I said in one of the earlier speeches on this legislation, I think that issues around identity will be some of the most important issues that we deal with in this Parliament over the next few years, because, fundamentally, things have changed so much around the storage of personal information, the volume of personal information, and the propensity of people to release their own personal information quite freely, much, much more than they did in the past. If we look at social media, for example, people release huge volumes of personal information about themselves that once upon a time simply would not have been anywhere near the public domain. Many of the forms of identity verification that are currently used are actually widely available, so if someone wants to set up a profile on a website, on many of the websites they will be asked questions like what their date of birth is. Date of birth is used as an identity verifier in a whole host of online environments, and, actually, it is quite easy to get hold of. I think that leaves people quite open to the prospect of identity theft. Their mother’s maiden name is another one that is a piece of information that is not difficult to get hold of from many people and is often used as a form of identity verification. So one of the things that is quite important, and one of the reasons why the Labour Party is supporting this bill, is making sure that there are secure and reliable forms of identity verification available to New Zealand citizens so that they can have their identity verified.

I guess there is a question for the Government as to whether this legislation will extend only to New Zealand citizens or whether New Zealand residents might also be covered by this. If somebody wanted to verify the identity of a New Zealand resident—for example, verifying that they were, in fact, a New Zealand resident—would this legislation apply? This is very relevant to the Government, because its own spy bureau, for example, the Government Communications Security Bureau, may wish to verify whether somebody is a resident of this country, because it seems that the bureau does not actually know whether someone is a citizen or a resident and, therefore, whether it is allowed to spy on them or not. Mr Dotcom, who was not a citizen but was a resident, was, in fact, protected, but the Government Communications Security Bureau did not seem to know that. The Government clearly does not have any sort of identity verification service within its spy bureau. It seems to think that it can do whatever it likes without any sort of identity verification. Perhaps this bill might go some way to solving that problem.

However, all those things aside, one of the things that New Zealanders are very concerned about is what the Government is doing with their private and personal information. It is all very well for us to talk about what other people are doing with New Zealanders’ private and personal information, but, in fact, under this Government’s tenure, New Zealanders have no certainty that the Government itself is not using their private and personal information incorrectly. I ask the Minister who is sitting over there, the Minister for ACC—she is in the Chamber tonight—what the number 6,748 means to her. To Judith Collins, what does the number 6,748—

💬 Hon Judith Collins: It’s much less than my majority, honey.

It is much less than her majority. What does the number 6,748 mean to the Minister for ACC? Anything? Nothing. We are getting nothing from the Minister for ACC. That is the number of people whose private and personal information was released by ACC, and yet the Minister does not know that, because she does not actually care about ACC releasing people’s private and personal information.

💬 Hon Judith Collins: Was I the Minister at the time? No.

Oh, what happened to the member who was the Minister for ACC at the time? He is coming back into Cabinet after Christmas, apparently. I am sure Judith Collins will be there, welcoming him with open arms when he is restored to Cabinet after Christmas.

A total of 6,748 people had their private and personal information released by ACC. Then, of course, we have got the Work and Income fiasco. We do not know exactly how many people’s private and personal information was released by ACC, although we know quite a lot about two of the people whose private and personal information was released by Work and Income, because it was released by the Minister for Social Development. Paula Bennett released their private and personal information herself. She did not think that was problem. Apparently, if someone criticises the Government, this Government thinks it is OK to go and look them up and splash their private and personal information all over the media. That is OK, according to this National Government.

We move on to the Inland Revenue Department. The Inland Revenue Department is one of the Government agencies that has some of the most private information about people—huge volumes of personal information about how much people earn, what they pay in child support, a whole variety of those sorts of quite sensitive pieces of information. It actually probably has the best name and address database of any Government agency. The Inland Revenue Department, I would say without doubt, has the best name and address database of any Government agency. It is the most up to date. The Inland Revenue Department has this amazing way of finding people, and yet New Zealanders can have no confidence at the moment that it is actually treating that private and personal information with the care that it deserves, because we have seen the release of information by the Inland Revenue Department that really should have been held private.

There were 7,000-odd documents accessed from Work and Income’s kiosks. It did not even actually need to release the information. It just put its computers in the foyer area so that anyone could go and look it up. I think New Zealanders should be quite concerned—and rightly concerned—that the Government is not taking due care with their private information. And let us not get on to Novopay, because I am towards the end of a 10-minute—

💬 Hon David Cunliffe: It doesn’t work anyway.

It does not work anyway. I am towards the end of a 10-minute speech, and there is another 20-odd minutes of a speech about Novopay. Again, there is no certainty for people that their private information is being protected by Novopay.

💬 Hon David Cunliffe: “No pay”.

As David Cunliffe points out, it actually would be more accurately described as “No pay” rather than Novopay, because there is certainly no guarantee, even with all the private and personal information it holds, that people will get paid.

This is good legislation, but it does not deal with many of the fundamental issues around identity theft and around the release of private and personal information, which this Government is not dealing with.

Kia ora. Ngā mihi nui ki a koutou. Kia ora. I rise to support the Electronic Identity Verification Bill, but not the Identity Information Confirmation Bill, which the Green Party will be opposing. We have requested that the questions be put separately, so that our votes can be recorded subsequently.

Both these two important bills deal with electronic information at its heart and how we manage it. It is a big, important policy debate. I think it is only going to get more important as the years roll on. I want to point out and congratulate the parties. We have a collaborative process on the Government Administration Committee, which I was involved in with the Electronic Identity Verification Bill. I have heard the support of Chris Auchinvole and Trevor Mallard, and I would like to reciprocate and say that it was a very collaborative process—a very well-mannered select committee. This is select committees at their best, putting the politics aside and working out what is best.

But can I just touch on the deplorable comments of the member from National, Maggie Barry. I did not hear the actual comments that Chris Hipkins alluded to. If I had, I would have taken a point of order and urged her to withdraw and apologise. I understand Maggie Barry said that members like Gareth Hughes were stealing people’s identities. This is an outrage from the member that does no service to that member or that party, or the good work that all the parties have done on this legislation. I think it belittles Parliament’s poison ivy, Maggie Barry. If we are going to talk about identity, let us talk about common herbicide. Maybe we should give that member the identity of the “Roundup member”.

Back to the issues at hand, I just want to touch on the issues, which are that we hear about this stuff only when it goes wrong. We hear it from the likes of Work and Income, Novopay, and ACC, leading the Privacy Commissioner to call this year “the year of the privacy breach”. It is critical we get this stuff right, and it is critical, as I am sure the member Clare Curran would agree, that MPs get their heads around this stuff and understand it, because it is so critical and will be increasingly important as the years go on. I would like to acknowledge the work of Nikki Kaye, in particular, from the National Party, and Clare Curran from the Labour Party. Together we have worked on a cross-party IT group for the last two Parliaments, and I think we have done some good work. It is good that parties can work across the floor on that. Just to continue the good vibes, I would like to thank the officials at the select committee, all the submitters, and the Privacy Commissioner in particular, and InternetNZ for its very well-reasoned submissions.

This bill and the Electronic Identity Verification Service—or igovt, as it is more popularly known—give individuals using the internet the option of using a secure channel to verify identities and to access services from both Government and approved non-government agencies. It is desirable. It is beneficial. Many New Zealanders want to engage, and will find it more convenient to engage, with the Government through this channel. I note that the regulatory impact statement says that it has an economic benefit of $300 million, which is obviously very desirable. I would like to point out, though, that it is important that we do not entirely replace face-to-face interaction with Government departments. I am sure the housing Minister, Phil Heatley, could tell us about the problems when you get rid of face-to-face agents and you go to only a call centre or an online-based system. So it is obviously not the answer, and it is obviously not the way all Kiwis want to engage. There is a real digital divide in New Zealand. We know from the latest statistics that around 22 percent of New Zealanders still do not have broadband access.

💬 Hon Phil Heatley: I’m a Minister in learning.

It is good to see the National Government still learning, as Phil Heatley says. So we have seen where it goes bad. You can just see with the kiosks at Work and Income. Sometimes this relentless drive for efficiency can have real costs for New Zealanders, and not necessarily a good service. Sometimes it can just turn into a farce.

I want to quickly touch on how the Electronic Identity Verification Bill was improved at the Government Administration Committee. I think there were three big, fundamental changes. The first was changes to clauses 56, which increased the fines. Like we saw with the Rena, we had some pretty low traditional historical fines that were not really in keeping with the modern world. We have increased these to $1 million for corporate agents, which I think is more realistic and more up with the times. Secondly, we have changed the requirements so that information can now be accessed only via a search warrant to access someone’s usage history. Up until then, the bill had previously been drafted so that any official in the Department of Internal Affairs, if they were working with the concurrence or, I guess, the proxy of the chief executive, could access all that information, which is potentially all New Zealanders, as I believe more and more New Zealanders will choose to engage through this unique verification portal, the igovt portal. So it is good that we have got another check and balance, which is the search warrant.

Then we have got the changes to clause 65A, which deals with the deletion of data. Obviously we will collect a huge amount of data for the Government under this system in terms of identity and all the information and photographs of an individual, so having a deletion of data provision, I think, is very important. That was a clear message from the submitters to the select committee. What we have done is left it up to the Minister to decide through regulations, but with an important clause attached that the Minister must consult with the Privacy Commissioner. I think, given the year that we have had and given the increasing engagement with the Government online, we will see an increasing role for the Privacy Commissioner, and hopefully we will see increasing funding for that very important office. So, ultimately, this is a good bill with significant economic benefits. They are good benefits for New Zealand citizens. I think it is important, however, to note, while we are talking about the verification of identity, that anonymity online is also important. We should not lose that in a free and open internet. Obviously we need to do more to attack the digital divide, or else this Parliament will just see more and more New Zealanders left behind, not able to access the information or the assistance that we will see delivered through this service.

On the second bill, the Identity Information Confirmation Bill, the Green Party is disappointed that we cannot support this bill. We tried to improve it so that we could support it. Unfortunately, Jan Logie’s Supplementary Order Paper 148 was not supported. The key issue for us in terms of this bill facing the House is the need to address identity theft. We acknowledge that that is incredibly important. We think we do need greater legislative amendments to increase that. But what we were particularly concerned about was the potential that the system could be abused by employers, particularly as part of the requirement to disclose information to verify identity. The fear was that an employer could require an employee to disclose quite a large amount of information. The employee might be reluctant to, given, maybe, a history of discrimination. We heard numerous accounts from Jan Logie where this has happened or scenarios where it could happen. Normally, people in the current world do not have to disclose information where they feel it could put them in a discriminatory situation, and what we could see is this law overriding that. That was our great fear. We tried to amend that with that Supplementary Order Paper, which, unfortunately, did not pass. That is why we will be voting against that bill tonight. When the question is put, we will be voting for the Electronic Identity Verification Bill and against the Identity Information Confirmation Bill. Thank you.

It is my privilege to speak on the Electronic Identity Verification Bill and the Identity Information Confirmation Bill. These two bills are sponsored by the Hon Chris Tremain. Can I also acknowledge the chair of the Government Administration Committee, the Hon Ruth Dyson, and the other members of the select committee for their contribution. Can I also acknowledge the work of the officials in the select committee process. It has been a great pleasure of mine to be part of that select committee.

In this modern world, the changing technology requires a lot of new legislation, and this bill is part of that. The Government is rolling out ultra-fast broadband and people require the tools to use those facilities. The main aim of the bill is to simplify the interaction between individuals and Government agencies. However, I am sure all of us will agree that when information is exchanged by electronic means, it raises the issue of privacy. This legislation, introduced by our National Government, ensures that issues of privacy are attended to with the utmost priority. Only if the person provides consent to the relevant Government department does this allow for the exchange of the information. For any organisation that commits an offence under this bill, its penalty amount has now been raised significantly. The idea is to deter anyone from the misuse of these services. It is another step by this Government that reduces red tape and paperwork. I hope this will be a tool for people to enhance their ability to work with identification at different agencies. I commend this bill to the House.

The Electronic Identity Verification Bill is intended to regulate the operation of the Electronic Identity Verification Service to give individuals using the internet the option of using a secure channel to verify their identities, and to access services from approved Government and non-government agencies. The provisions of the bill expand the igovt services to all members of the public, and will allow more agencies to use the service to identify their clients. I think the current service is a great success, and, therefore, the expansion of it is certainly a good thing.

New Zealand First is pleased to see the anti-hacking provisions in the bill, and we are pleased to see the penalties for the misuse of information as well. It is very important, as the bill does, to distinguish between corporations and individuals. Organisations that hack information would be doing so for commercial gain and they cannot be imprisoned, so we are pleased to see that there are very high financial penalties for their infringements of the bill—of the Act, as it will be. We would have liked to see other penalties considered as well, such as the deregistration of a company in New Zealand for the most serious of cases. However, it is very good, at least, to see very high penalties for corporations that infringe. In respect of the regulation of information, New Zealand First agrees with the proposed new clause 65A concerning regulations to prescribe the length of time that electronic identity credentials, photographs, records of usage, history, status information, and technical codes are retained after their cancellation, revocation, or expiry.

We also approve, in particular, of the requirement for the regulations for these purposes to be subject first to consultation with the Privacy Commissioner. I think that is a very important safeguard. New Zealand First also approves of new clause 65A allowing a different duration to be set in regulations for electronic identity credentials issued to children under 14 years of age. This is simply, of course, because, as we know, children’s appearances change dramatically as they age, and they generally hold fewer identity documents, which can limit the effectiveness of biometric checks. New Zealand First further supports new subclauses 26(5B) and (5C) in relation to the situation where an individual’s application to amend their information has been refused by the applicable chief executive, by requiring that chief executive to take reasonable steps to indicate that the information recorded in a credential is disputed. That is the very least that we think should be done in those sorts of circumstances, because the bureaucracy does not always get things right and individuals need to at least have the opportunity to say that. So New Zealand First supports the bill, and especially the role identified for the Privacy Commissioner.

New Zealand First also supports the Identity Information Confirmation Bill to attack especially online fraud. The bill will achieve an important objective, to facilitate the use of an electronic service that allows agencies to confirm identity information provided to them by individuals with information held by the Department of Internal Affairs under the Births, Deaths, Marriages, and Relationships Registration Act 1995, the Citizenship Act 1977, and the Passports Act 1992. In relation to the definition of “identity information”, that includes information about a person’s full name, gender, date of birth, place of birth, other recorded information—for example, in a passport, or a photograph in a passport—and the status of any other recorded information. In clause 8 there is a list of conditions for using the confirmation service, which, most particularly, of course, require the individual to consent, whether in writing or electronically. It requires the agency or intermediary applying to give an assurance that the consent has been obtained, and, of course, that they have entered into the required confirmation agreement. There is also the ability for an individual to consent on a one-off basis or on an ongoing basis, and the ability to withdraw that consent as well. We think those also are very important safeguards.

I also approve of clause 9(4), which states: “The confirmation service must not, at any stage, supply to the agency or intermediary any recorded information about the individual who is the subject of the search.” It is, of course, just information that we are concerned with here. Clause 10 gives a long list of requirements in respect of the responsible officials, requiring a need to be demonstrated by an intermediary before they can enter into an agreement. Also, they must have policies and practices in respect of security of information and relating to the privacy of individuals. Clauses 11, 11A, and 11B contain, I think, very comprehensive provisions concerning what must be in a confirmation agreement, and, in addition, how those agreements are to be used. For all of those reasons, New Zealand First approves of the Identity Information Confirmation Bill.

We think there are satisfactory safeguards in the bills with regard to individual privacy. We think especially that the provisions relating to the role of the Privacy Commissioner, who will also ensure that the safeguards for the privacy of individuals are respected, are very important as well. So, for all those reasons, New Zealand First will vote in favour of both bills.

I am pleased that the House has returned to a level of calmness after the antics that we had earlier on in this debate. I think my Thursday morning sparring partner, Mr Hipkins, and his mentor, Trevor Mallard, were getting a little overexcited over there, invoking the ghost of David Garrett, but I am glad the House is back to normality.

The Electronic Identity Verification Bill and the Identity Information Confirmation Bill are very good pieces of legislation. They are all about implementing part of the Government’s Better Public Services programme—the result No. 10 that we have got there, which is about making it easier for New Zealanders to interact online with the New Zealand Government. The legislation enables an automated electronic service that authorised agencies can use to confirm the accuracy of individuals’ identity information. It can be used for a wide range of purposes, including meeting new anti - money-laundering requirements. The legislation also helps to combat identity fraud, by preventing the use of fake identities. It extends the use of the web-based Data Validation Service to public and private sector agencies on a strictly need-to-know basis. And it allows agencies to check whether the identity information presented by a customer is consistent with that held by the Department of Internal Affairs through the citizenship register, the passports database, and various registers such as the Births, Deaths and Marriages register.

This is good legislation, and I commend it to the House.

I would like to say that both the Electronic Identity Verification Bill and the Identity Information Confirmation Bill are actually very important bills, because they go right to the heart of the relationship between citizens and the State, which is essentially about the trust that is held between the information that citizens provide to the State and how that information is used and exercised. That is why Labour is supporting both of these bills. They are both important bills. I would like to commend the work that has been done on the bills in the Government Administration Committee, and the effort that has gone into these bills from members all around the House.

I would also like to make mention of what was just said by the previous member, Jami-Lee Ross, around supposed antics, with reference to the ghost of David Garrett. This is actually one of the reasons why these bills are so important. These bills are so important in terms of ensuring that there are provisions in place for the security of information and how information is used. I would like to read to you some words said around 10 days ago by our Privacy Commissioner, Marie Shroff, in terms of her annual report, about the importance of privacy and the importance of people’s information. She said that the public is increasingly suspicious of handing over personal information, as complaints reach a record high in our country. She said that in the year to 30 June her office had received 1,142 complaints, which topped a steady rise in the last 5 years. What those figures represent is that there is increasing concern amongst the public about how personal information is being used, and that the link between public trust and responsible stewardship has not been made in the minds of some people. She said that in 2012 the most complained about organisations were all Government agencies, with ACC taking the top spot with 173 complaints.

I did want to run through just a few of these, because they are important. As I said, they do go to the very heart of that important relationship of trust and how the Government chooses to deal with it on a systemic basis, right across the Government—not just at an individual agency, departmental, or ministerial level.

Marie Shroff, in her annual report, said that that data breach in March from ACC was a watershed moment for the public sector that exposed weaknesses at a systemic and governance level and highlighted the integral nature of data management in the public sector and at all levels of the organisation. She said that the lack of commercial drivers meant that public trust must be clearly demonstrated as necessary to effective government. I think that is very important, because when we are looking at these bills and what they do—and they do go some way to addressing some of these issues, but not nearly far enough—there is and needs to be recognition from right around the House of the importance of these issues and how they are dealt with. There needs to be—and it would be very good to see—clear support from across the House for law changes that require notification of affected individuals. I also would like to note that when the Privacy Commissioner released her annual report, the Government was yet to respond to most recommendations of the commissioner’s August 2011 review of privacy report.

I would like to make mention of the top complaints that were received, because I think the most important point that was being made here was that the privacy breaches that were appearing were all coming from Government agencies, including ACC, as we know, and the New Zealand Police department, the Department of Corrections, the Ministry of Social Development, the Department of Labour, Immigration New Zealand, the Inland Revenue Department, the Housing New Zealand Corporation, and the Civil Aviation Authority. They were the top agencies that were reporting breaches. The fact that those breaches were being reported is a good thing and it is a healthy thing, but the remedy—how they are to be dealt with—is the next important issue.

I would like to, I guess, make mention of—I think a number of my colleagues across the House have made mention of—the systemic issues that have occurred, particularly in the last year. We have had reports just in recent months about these, and we are up to, I think, between 30,000 and 40,000 individuals whose breaches of privacy have been notified as a result of some of these issues that have come to light. They have come to light not, unfortunately, because of self-notification; they have come to light because they have been exposed. The Inland Revenue Department had 32 breaches, which represented 6,379 individuals. ACC, as we know, is a well-known case where 6,000 individuals’ data has been made available to the public. In the case of the Ministry of Social Development, 7,300 files were made available. I do not know what the latest count is—maybe one of my colleagues can help me here—with the Novopay breaches and the information that has been provided, but the last count sometime in November was 8,000 individuals affected. That is more than 30,000 if you do a count-up around that.

I also want to make mention of—[Interruption] Well, it is the tip of the iceberg. It does equal a small town, but it is the tip of the iceberg. I also want to make mention of the really good work that has been done by my colleague Darien Fenton in the immigration area, around the breaches—and I am sure she will talk about them herself—that have occurred and the effect they are having on those individuals and what that actually means.

I think the major point to be made here is that when you do have—as I think is agreed around the House—issues of privacy breaches, of breaches of information and the impact on individuals, you have to deal with it at a governance level. That is extremely important. That is why there is a bill, which has been pulled from the ballot, called the Electronic Data Safety Bill, which actually follows on from what is being discussed here tonight—and there is reasonable support around the House for both these bills. It is about how to deal with these issues by, essentially, establishing a commission of inquiry into the privacy breaches that have occurred in the last few years, and, as I have just outlined, the effect of them here in the last 12 months and across all of those Government agencies. The bill looks at what the capacity across the Government is to respond to those breaches, it tries to look into how they have occurred, and then, most important, it looks at some remedies for dealing with them so that they do not happen again in the future.

There is no doubt that all of these breaches have been acknowledged, but, unfortunately, there has been a tendency, which we have heard tonight, from the Government side to try to say that things occasionally go wrong, that there is no big deal here, and that it is human error. Well, I think these issues are a bit more than just human error on an individual agency basis. There are systemic issues here. This is the digital environment. We do have to address these issues on a systemic level across the Government, and I do hope that when that bill comes up for debate there is serious discussion around it and there is support across the House.

I will take a short call on these cognate bills, the Electronic Identity Verification Bill and the Identity Information Confirmation Bill. The igovt service allows individuals to check their identity when transacting with Government departments. It has already been in use since 2009 to a limited capacity with regard to birth certificates, death certificates, and marriage certificates, and it is very much time to expand. The Identity Information Confirmation Bill creates a new service that essentially enables approved agencies to check identities against the Department of Internal Affairs database, if you like. This is a very good tool to help protect against identity fraud, which is a massive problem in many respects and on many levels. As for privacy concerns, this is not a compulsory system; it is an opt-in and opt-out system and requires the consent of those partaking. I think it is important to note that the Privacy Commissioner will be monitoring both these initiatives in real time. So, essentially, there are very good checks and balances in place.

This is very much part of this Government’s Better Public Services agenda. This is very much a part of what we are trying to do in terms of efficiency, effectiveness, and being pragmatic for the New Zealand public. I just want to take the time to commend the Hon Chester Borrows for the work that he, in particular, is doing in this area. He is a great servant of this place and of New Zealanders. I commend these bills to the House.

The ASSISTANT SPEAKER (Lindsay Tisch): I understand that this is a split call.

I am taking a call on the Electronic Identity Verification Bill and the Identity Information Confirmation Bill, which are cognate bills. It is fair to say that the Electronic Identity Verification Bill has had a much smoother ride than the other bill, the Identity Information Confirmation Bill. I put a lot of that down to my colleague Ruth Dyson and her excellent chairing of the Government Administration Committee. If you look back at the Identity Information Confirmation Bill, it dates right back to 2010, and the very unfortunate timing of its introduction, I think, as my colleagues have referred to. I think it was very embarrassing for the Government, actually, to have to debate the first reading of that bill not long after David Garrett was exposed for actually stealing someone’s identity—in fact, a dead baby’s identity. So it is a little bit ironic to be debating this bill tonight. I cannot help but refer back to that time, and also to the fact that we have had so many breaches by this Government—so many breaches by this Government. Again, my colleagues have listed them, and the numbers are really mounting now, are they not, of those breaches across Government departments: ACC, which was a massive breach; Work and Income; the Inland Revenue Department; and Immigration New Zealand.

We are just starting to get to the tip of the iceberg on Immigration New Zealand, and it is worth pointing out that the privacy breaches that are being identified are starting to come out. Immigration New Zealand holds enormous amounts of information from people, and, rightly, many people are concerned not only that their privacy is being breached but that they have not been informed of that breach. So I am certainly following that up.

I think it is very important that the Government is up front about this. I remember way back in the Government Administration Committee, when we first did the legislation relating to Births, Deaths and Marriages, which was in the good old days when Labour was still in Government. There was much suspicion about opening up the registers to New Zealand through the digital system. There was a huge amount of suspicion, and it was very understandable. Way back then identity frauds were starting to occur, but now look at today—an average of 2,000 New Zealanders are affected by online scams, identity theft, credit card fraud, and sophisticated viruses every day. According to Veda Advantage, for the 2008-09 year there were more than 7,000 incidents of fraud and false pretences using credit and bank cards and credit by fraud, and the New Zealand Police identified 900 cases of identity fraud in New Zealand in 2009. I think that those are just a fraction of the real figure.

It is very understandable that New Zealanders feel so anxious about their private information, because it can be misused, as other colleagues have referred to. It is also something very personal—our unique identity. It belongs to us, and our identities are precious to us. In the past we have held them in the form of passports, licences, and family documents such as family photos and diaries. Many of those, of course, get lost in things like the dreadful Christchurch earthquake. You know, some of those things like family photos will never be recovered. But the public records do hold on our behalf many of the most important things about our identity, and that means that the New Zealand State has a special responsibility to treat that information about our identity with particular care.

Every New Zealand citizen has something on the record. Technological developments mean that access to personal information is changing. Personal information has become a valuable commodity to be bought, sold, combined, sorted, profiled, and mined, meaning that the opportunities for misuse are expanding every day. So we have to recognise the real threat that there is around identity fraud. The State has to take particular care.

I am pleased that the Privacy Commissioner is satisfied with the legal safeguards and controls in this legislation. We hope that will hold true, and we hope that this legislation will see a real improvement in the Government’s igovt strategy and in the Government’s protection of private information.

I rise to speak to the Electronic Identity Verification Bill and the Identity Information Confirmation Bill cognate. As has already been discussed by my colleague Gareth Hughes, the Greens will be voting in support of the Electronic Identity Verification Bill and opposing the Identity Information Confirmation Bill. We would have loved to support both bills, actually, because we do recognise the importance and the value that they offer. However, as I will talk more about later, the privacy concerns in terms of protecting people’s human rights in the employment process overrode our ability to support the second bill.

The Electronic Identity Verification Bill, as has already been stated many times, in effect creates an online passport—a unique online identifier to verify somebody’s identity. It really opens up our system so that we can extend the current igovt process to further organisations or Government departments. I know that that is going to be a good thing for many people, particularly because I hear of so many clients of Work and Income whose access to their entitlements is delayed because they turn up for an appointment to access some service or access an entitlement, they find out that they do not have the right ID with them, they are sent away, and they have to wait until another appointment is available. The hope is that with this bill we will be able to streamline processes, which will make it easier for the staff in Work and Income and make it easier for the clients coming in to be able to access the services. That is certainly a very good thing. We note also the projected economic benefits of this bill, as stated by my colleague Gareth. There are potentially $300 million of savings from it.

But we would also like to be that reminder that we have to be always mindful of those who do not have access to online services. I have heard some very angry voices recently, particularly from older New Zealanders, who feel as if they are getting locked out. They have been into Government departments and they have been sent away to go and look up something online, which is completely intimidating for them and not something they feel able to do, even if they do have physical access in terms of broadband. So that is something we always need to be mindful of.

I shall speak a bit more about why we are opposing, sadly, the Identity Information Confirmation Bill. Although we really do support the intent of the bill and are very aware of identity fraud and the harm that it is causing, particularly in terms of financial fraud—and this bill certainly holds out the hope of being able to take action on that and decrease it, and that is incredibly important—our concern arises with it being used in the employment process. We have not heard much evidence of how common identity fraud is in terms of people going into employment. The Supplementary Order Paper 148 that we put forward excluded it from being used in the employment process, because of our concern for marginalised groups. There is certainly the ability to opt out, and that fulfils the technicalities in the Privacy Act as we know it for people to be able to have the choice to opt out. The reality is that for marginalised people who are worried about their ability to get a job to say “No, I am not going to provide you with that information.”—people are not going to feel able to make that choice. By not making that choice, they will, in effect, be required to give information that presents their date of birth and their nation—place of birth. Those are two points that we know are common bases for discrimination in this country, which is something we need to ensure people’s ability to protect themselves against. That is why we will be voting against this bill.

I am pleased to support both the Electronic Identity Verification Bill and the Identity Information Confirmation Bill. Both of these pieces of legislation are an important step forward in terms of enabling both consumers and businesses to transact more easily with the Government. Thank you.

Electronic Identity Verification Bill read a third time.