Privacy (Information Sharing) Bill

The debate on Part 1 is on clauses 3 to 10 and the schedule.

This is a very, very important bill and I regret the fact that the Minister in charge of the bill has not seen fit—has not seen fit—to take the chair in this particular debate. She is a Minister—

💬 Tim Macindoe: I raise a point of order, Mr Chairperson. This senior member knows better than to draw attention to the absence of a member from the Chamber.

Speaking to the point of order—

The CHAIRPERSON (H V Ross Robertson): No, the member did not draw attention to the absence of a member. He did not say the member was not here.

I regret the fact that the silly Opposition whip just drew attention to something that we are not allowed to draw attention to. [Interruption] Well, no he is not. He might be the Government whip. He might be the Government whip, but he will be the Opposition whip pretty soon. He will be the Opposition whip pretty soon.

The reason I regret that the Minister in charge of the bill is not in the chair is that she is the House’s expert at breaching people’s privacy. She is the Minister who has a lot of expertise at breaching privacy all over the place. Her record is appallingly bad, and no one knows that better than Nick Smith, who is currently sitting in the chair. It was as a result of her breaches of privacy that he had a spell on the reserves bench. It was as a result of Judith Collins’ breaches of privacy that he had a spell on that reserves bench.

Labour does believe in an effective and efficient public sector. We do need to share information properly, but we have also got to make sure that we trust the people who are sharing that information. At the moment I see no indication whatsoever that the people of New Zealand trust Paula Bennett, who breaches beneficiaries’ privacy deliberately and repeatedly. They do not trust Steven Joyce, they do not trust the Prime Minister, Hekia Parata breaches people’s privacy all of the time, but Judith Collins is probably the worst of the lot.

It is fair to say that this bill takes a very piecemeal approach to this issue. It may not stand the claims that have been made about the need for it. In particular, there is no sign whatsoever that it will do much to enhance the protection of vulnerable children. That is one of the very first questions that should be asked when people are considering this sort of legislation: as doctors are meant to do, first do no harm. And there is no evidence yet that this bill does no harm.

The Government has a habit of doing very low-quality cherry-picking in this sort of area. It is an area that does need comprehensive reforms. One needs only to look at the Official Information Act and the Government’s response to the reports on the Official Information Act and its prioritisation of issues here to indicate to the House, to everyone, that it places a very low priority on the privacy of individuals’ information. The Government cites the current fiscal environment as a reason not to do wholesale and proper reform, but it cherry-picks, it picks the bits that it wants. It actually picks the bits that will lead to less sharing of information and not more, and that is just not good enough.

The Government is, in particular, trying to hide a lot of information around how badly the economy is doing. What we need to do is to have a comprehensive piece of legislation. In March last year it was revealed that ACC had sent the private information of 6,748 people to Bronwyn Pullar. That is but one incident.

I was enjoying that contribution from the Hon Trevor Mallard so much that I was actually hoping that he would take a second call. I am very disappointed that he did not take the opportunity to have a second call in this debate. I share his concern that the Minister whose name is attached to this bill is not able to answer the questions in the Committee. Frankly, the Minister who is in the chair would have done a far better job. This bill, the Privacy (Information Sharing) Bill, is the sort of bill that a Government produces when it is in lots of bother, and actually over the last 12 months it has been in lots of bother, most recently with its disgraceful treatment of Canterbury schools, of our communities, and of our principals and teachers. And, of course, today we see the shonky deal between John Key and the Skycity convention centre exposed by the Deputy Auditor-General’s report. The reason I say this is the sort of bill that the Government would quickly put together to try to take the heat off other more troublesome aspects is that it is only a tiny little part of the job.

We know that this area actually requires a comprehensive approach rather than just cherry-picking the little bits that are easy. It is nowhere more obvious than the difficulty that the Government has been in—in fact, over the last 4 years, not just over the last year—in terms of privacy breaches. There are no examples that make it more obvious than if you introduce legislation to enable information sharing; you need to do it in a comprehensive and systematic way. The Law Society made a submission on this bill, as did others, that said that this was a very shallow approach and that it would have been far better to do that sort of comprehensive approach.

We have actually had the Law Commission look into this very area, and it said that this needed a comprehensive, systematic approach to the issue of information sharing. It is a huge responsibility of Government. It is actually a massive responsibility of individual Ministers. The Hon Dr Nick Smith will know that a lot of information comes over the desk of a Minister, and as Ministers you have to take it very seriously never to use that, never to breach the privilege that you have as part of the responsibility of being a Minister. That is why this issue is so important. People write to Ministers, and Government departments and agencies give Ministers advice that exposes personal details about people, on the understanding that that information will never ever be shared inappropriately.

Tragically, we have seen that privilege of ministerial responsibility breached. It was breached by Paula Bennett in a way that I thought was disgraceful. It has never ever been seen in our country before. Two women on the domestic purposes benefit criticised Paula Bennett, John Key, and the Government because the Minister’s decision was to scrap the training incentive allowance. That Minister herself had the advantage of going to university as a sole mother because of the training incentive allowance. I think it is a fantastic thing that we give particularly women who have the responsibility of bringing up a child additional State support so that they can have a better life and future for themselves and their children. The training incentive allowance was taken off for university courses from domestic purposes beneficiaries. So these two women on the DPB criticised the Minister for that decision. They said they wanted to go to university, get a degree, and therefore have a better future for themselves and their families. What did the Minister do? She said: “Look, we were desperately short of money. We’d just given a whole lot of tax cuts to wealthy people, so we had to claw back the money from somewhere, and who better to get it off than women on the DPB?”. I can imagine her saying that. Instead of engaging as a responsible Minister in a rational debate, the Minister gave to the media—not behind closed doors, but openly—personal, private details about those women. And the media published it. I think that is a disgrace. It is an absolute breach of the responsibility that goes with the privilege of being a Minister—a privilege that very few people in our country have—and being entrusted with such personal details.

I guess I have some anxiety about this legislation, because it has been introduced as a method of making access to services and support from Government departments and agencies more efficient and more effective, and who could argue with that? Anyone in this House would stand up and say they want the most efficient, most effective public services—of course, every single member believes in that. But this legislation to allow more sharing of information that may contain private, personal details of individuals is being brought to this House in an environment where it is, frankly, impossible to trust Ministers of the Crown with that information. So it is very hard for us to have confidence that rigour has been applied to this legislation within a frame of knowing that that privacy should be respected.

Of course, we have had some pretty horrific examples of where existing provisions in relation to privacy have not enabled individuals to have that respect maintained. We have had thousands of people being sent the wrong ACC files. I am sure the Minister in the chair, the Minister of Conservation, is well aware of that. There is nothing more frustrating as a Minister than to read on the front page of the paper that your department has sent a whole lot of files to the wrong person. But ACC has done it over and over again. It does not seem to learn anything from it.

In Canterbury I have had examples of the Earthquake Commission doing exactly the same thing. I had a constituent who came to me and said: “I’ve made a complaint to EQC. I’ve asked for my file. I’ve asked for my scope of works. I’ve asked for the assessment of my house, and haven’t got it, so I’ve complained.” I said: “Well, I’m happy to help you get that information if I can, but your complaint will go along a separate path. I won’t be doing anything in that regard.” So I asked what had happened to this man’s file, and I was advised it had been sent out that very day—an extraordinary coincidence, of course. What I found out, though, was that it was not his file that was sent to him; it was someone else’s file. So he rang me and he said: “Well, I’ve just got somebody else’s file. Should I take it down the road and give it to them—they have clearly asked for it—or should I sent it back?”. I told him I thought he should put it in an envelope and send it back because he did not know whether that man actually wanted it. I then rang the Earthquake Commission and said it had sent him the wrong information and that I wanted him to get his own file promptly. This is not sharing between departments; this is the incompetence of one agency. The commission replied in writing that it had sent him a file—it turned out it was the wrong one—it had closed his request, and that if he wanted his own file, he would have to start all over again and make another request. That is absolute nonsense. That is the sort of incompetence that is driven by the lack of concern, compassion, and attention to detail that Ministers in the current Cabinet are demonstrating.

And, of course, the biggest blunder of all—and it involves large numbers of breaches of privacy—is Novopay. I bet Steven Joyce wishes he had never heard that word. Craig Foss, I am sure, is delighted to have the responsibility for Novopay handed over to the “Minister for Everything”, the Hon Steven Joyce. We know that many teachers and support staff around the country have had the private details of other teachers and support staff sent to them in error.

So what we are seeing in the current system, regardless of this legislation, are breaches of privacy, either through incompetence or deliberate malice, as was the case in the example I used earlier of the Hon Paula Bennett deliberately disclosing private information. So as we go through the remaining parts of this legislation—I think there are three parts in all—I hope that the Committee can be given more confidence than I currently have that this bill, if passed, will not make the current situation worse. This has to be done as a means of ensuring that people get better service, that Government departments and agencies are able to share information appropriately for the betterment of the client—the New Zealand citizen—and that at all times their personal privacy will be respected.

I would like to take a call in the Committee stage of this Privacy (Information Sharing) Bill, and reinforce some of the comments that have been made by previous speakers on this side of the Chamber around the fact that this bill is being produced in a context of the most extraordinary privacy breaches that this country has seen, perhaps ever. The way that this legislation is proposing to address issues of privacy and information sharing can only very kindly be described as piecemeal—piecemeal. In fact, to be honest, this bill is actually a pathetic and very shallow piece of legislation when considered in the context of those dreadful privacy breaches, which, no doubt, will continue to be listed one by one by members on this side of the Chamber, because the fact is that this Government is not doing anything to address these issues. If you are going to make information sharing more possible, which is what this bill purports to do, then you have to ensure that there are commensurate protections for people’s privacy, and that they are put in place alongside that. Unfortunately, this bill does not go anywhere near doing that.

When you look at what the Law Commission said when it released its report on that 4-year review of privacy, it had over 100 recommendations for change. There were over 100 of those recommendations, and when you look at what has actually been incorporated in this piece of legislation, it is pathetic. It is tiny, and it does not go anywhere near doing what the intent was of the Privacy Commissioner—and after a very long and extensive piece of work. I think it is actually embarrassing for this House to be considering this bill in the light of that. I just want to mention what some of them are, because it goes very much to the purpose of this bill. But unfortunately the stated purpose of this bill is not really borne out by the reality of what is in it.

The privacy complaints process would have been streamlined if this Government had taken account of some of those recommendations. Essentially, it would have given the Privacy Commissioner more powers to ensure that there were binding decisions on complaints when a person had asked for information about him or herself and had been refused. Groups of people would be able to bring representative complaints, which are similar to class actions. Even being given the opportunity to discuss that at a select committee would have been a really useful thing to do, especially in the light of some of these privacy breaches that have occurred in recent times.

Take, for example, the 7,000 people whose documents were available from the Ministry of Social Development networks through the Work and Income self-service kiosks. They were just a fraction of those that were available, but the blogger Keith Ng was able to download those 7,000 documents to make the point that it was possible to do that. Those people need to be able to bring some sort of complaint around that. Are they able to under this proposed legislation? Bringing a privacy case to the Human Rights Review Tribunal, which would have been simpler—a more direct route—was another recommendation of the Privacy Commissioner. Two new powers were being proposed, which were the ability to issue a compliance notice where a Government agency or business was acting in breach of the Privacy Act, and also the ability to require an audit of a Government agency or business where there was a good reason. I will tell you what: there have been some very good reasons for an audit of Government agencies or businesses, particularly when you look at all of those privacy breaches.

There is a member’s bill in my name, which will be brought to this House in coming weeks, around setting up a special commission of inquiry into all of those privacy breaches, because we should not be dealing with this issue on a piecemeal basis, on an agency-specific basis. We should be looking at what the underlying reasons are behind these privacy breaches. What is it that is drawing us—

New Zealand First supports the Privacy (Information Sharing) Bill as amended, with changes recommended by the Justice and Electoral Committee. There are, of course, many positive reasons for better information-sharing amongst our public services to make sure that the information is used to the best effect, and to improve the operation of the Public Service. So that has to be acknowledged at the beginning.

There are, of course, many potential breaches of privacy that may occur, whether this bill proceeds or not. It is those breaches of privacy that we must seek to avoid. Although New Zealand First does have some concerns about the protection of personal privacy, we consider that these have been sufficiently addressed in the bill, through two means. Firstly, section 96N in new Part 9A requires the giving of notice to anyone against whom adverse action is to be taken as a result of information sharing under the bill. The individual may then take action to dispute any information used and may show cause why no such action should be taken because the information is inaccurate. Agencies should, however, understand very well that they will be on notice to listen to what those who make use of this right have to say about the accuracy of information and, where appropriate, to correct it.

Secondly, the new provisions for information-sharing agreements under new Part 9A are important. Agreements must specify safeguards for the protection of personal information, and they must provide for complaints to a Government department. Again, agencies should understand that they will be on notice to ensure that realistic and comprehensive compliance with these requirements will be essential. I note that section 96K(2) says that only the information necessary for an agency’s proper purposes is to be shared, and no more. The agreement must not unreasonably impinge on the privacy of an individual, and agreements will need to be scrutinised by the commissioner to ensure compliance with all these important caveats.

New Zealand First therefore supports the bill on the basis of the proper balance between the need for a robust information-sharing regime and the need for protection of personal privacy. In these matters we will be relying heavily on the diligence of the Privacy Commissioner: firstly, the commissioner’s oversight of the content of agreements and how they will operate; secondly, the commissioner’s reporting functions; and, thirdly, the commissioner’s consultation responsibilities. The Government must ensure that the commissioner has adequate resources so that the commissioner is able to carry out those functions properly, and we will certainly be taking notice as to whether that is the case.

I note that the Labour Party will also support the bill but seeks more implementation of Law Commission recommendations, especially empowering the Privacy Commissioner with more investigation and enforcement powers. But with or without those provisions, this bill is a significant improvement on the status quo.

I note also that the Greens will not support the bill without powers for the commissioner to issue compliance notices and to require an audit of agencies’ practices. I doubt the need for these measures, and I do not think they would have avoided most of the worst privacy breaches we have seen in recent times.

I think the bill as it is would be adequate to protect personal privacy, for all the reasons I have canvassed. But, as I have said, the commissioner’s functions are vital to the good operation of the new information-sharing regime, and agencies must always remember that they must take the specified actions to protect personal privacy and not just pursue their own interests. That is why I think new section 96L is so important. Firstly, it requires consultation by participating agencies with the Privacy Commissioner and with any person or organisation representing a class of persons affected and anyone else the agencies think should be consulted. But I think there is a glaring omission, and that is the Children’s Commissioner not being specified.

Kia orana, Mr Chair. I want to echo the sentiments of my colleague Mr O’Rourke, who is on the Justice and Electoral Committee, especially when he spoke about the concerns around breaches to privacy. We know that any breach of privacy not only is invasive for a client but also can often leave them vulnerable. So with that concern in mind, it has been really important in our select committee to ensure that in the conversations and in listening to submissions we had a balance around the safeguards, so that there was a balance of privacy as well as of flexibility. We know that, importantly, information sharing enables agencies to work together to examine and to understand the customer’s needs as a whole.

I was honoured to be at the consultations and engagements for the Green Paper for Vulnerable Children. What constantly came out through a number of the providers that were there was the importance of the barrier through which information was not readily shared. Although we have talked about the breaches of information, we do not often talk about the benefits that information sharing has. In fact, I want to echo some of those benefits in regards to this bill, the Privacy (Information Sharing) Bill.

On the other side there was some scaremongering, and David Clark was hearing people on the other side who were talking about the breaches, but can I echo the words of some of the submitters. The New Zealand Medical Association, Age Concern, the Privacy Commissioner, and the Nova Institute were clearly supportive of the current safeguards that the bill contains. This is straight from the horse’s mouth—from the people who actually work with the real people, not just the people in ivory towers. The Privacy Commissioner noted that the safeguards were mutually supporting and that none of them should be reduced.

We also consider that the protections in this bill strike a workable balance. The protections are not too onerous for agencies that wish to have information-sharing agreements and ensure strong, practical privacy safeguards so that people can be certain that the Government is acting as a trustworthy steward of their information—and stewardship is an important part of that.

I again want to echo the words from the Office of the Privacy Commissioner, which noted in its submission—so just listen to this, Mr Prasad—“The framework in the Bill provides a package of safeguards, which are practical, and mutually supporting. The bill currently represents a fine balance between providing the flexibility agencies are requesting, and ensuring that privacy considerations are given due weight.” These are submitters that work in the industry. These are agencies that deal with information and the sharing of information and want to strike that balance. Clearly, they are indicating that we have struck the right balance.

In order to do that, there are other safeguards. In regards to drawing up information-sharing agreements, agencies must consult with the Privacy Commissioner. The commissioner may provide a report to the relevant Minister on any related privacy issues before agreements are approved. The Minister must take the report into account before agreements are finalised. We have seen many situations where the benefits of sharing information have made a difference to the lives of a number of our children, our families, and clients who are in need. We support this bill. The bill has had huge support from agencies. We have heard them in the select committee meetings. There is a lot of scaremongering that is going on. There is a lot of talk about ACC breaches and so forth, and all we hear about are the things that have gone wrong rather than the things that have gone right. And many things have gone right.

So we do support the submissions that have come through. There have been many of them. There are a few of us who were actually there. Many of those on the other side who have spoken so far actually were not there to hear these submissions. So, you know, it is understandable that they do not have that sense of confidence that was given to us by the submitters as we heard them at our Justice and Electoral Committee hearings.

Finally, I want again to echo the sentiments and the support of New Zealand First in this regard. As we have seen, it does strike a balance. Obviously we will be ensuring that there is a safeguard. We will be monitoring this, as we do with all our legislation, to ensure there are safeguards—to ensure that there will not be breaches but, instead, benefits to the very clients, the children, the families, the people of our community whom we see in Aotearoa. Thank you.

It is a pleasure to speak once again on this very important piece of legislation, the Privacy (Information Sharing) Bill, and to remind the Committee once again that a citizen’s right to privacy is absolutely fundamental. In the type of liberal democracy that we have in this country, we cherish the ability of citizens to go about their tasks, duties, responsibilities, and their interactions with the Government, in such a way that their interests and their privacy are protected, and that they can have some confidence that it is going to be protected. None of that is to denounce the worthy objectives of this piece of legislation, which is why the Labour Party supports it. Nothing is to detract from the benefits that can be gained from a rigorous and proper information-sharing arrangement between agencies, noting, however, that the bill covers not just public agencies but private agencies, as well.

But let us understand though too that it is not just a question of achieving a balance. Members opposite talk about this balance. There are some rights that are absolute, and there are some interests that, if they are not absolute, border on it. The right of citizens to preserve information about themselves, either through not being compelled to disclose it, or, having disclosed that information, to have it protected and preserved from the prying eyes of the general public, is pretty fundamental. So we look at this bill through that sort of lens and we never take it for granted when the State says it will be good and proper in all it does with citizens’ rights and responsibilities—do not take that at face value. It is the role of this House and every member in it to ensure that legislation that passes through here that impinges upon, or has the potential to impinge upon or bear upon, citizens’ rights is given the utmost scrutiny. I accept the assurances of the last speaker, Alfred Ngaro, that the Justice and Electoral Committee did a thorough job, but now at this point the rest of the House gets a chance to have a look. It is important that those who were not on the select committee and actively involved in it get to scrutinise the work that was done and see what is brought back here.

The starting point must be that the personal information of every citizen must be protected to the greatest extent possible. And we know why. Look what happens when there are breaches of privacy—the public reaction is phenomenal. It is always emphasised and it is always emphatic, because people are fearful when their information is disclosed, whether to the public at large or to other citizens, in an improper way. We saw that with ACC. The Minister in the chair, the Minister of Conservation, knows that absolutely, and I accept that he respects the agencies like ACC, which are agencies gathering some of the most sensitive information that could possibly be gathered from citizens—not just in the conventional sensitive claims unit sense, but any medical information that is disclosed to a State agency is always going to be ultra-sensitive.

When information about individuals is disclosed, then that is a matter of considerable public concern and outcry, as we have seen—indeed, in respect of not just ACC but also the Inland Revenue Department. Indeed, in the educational sector we have had information disclosed through the hapless Novopay system. You can see it, actually, in the experience of the former Minister responsible for Novopay, Craig Foss, who, when he took up that responsibility, began discharging his responsibilities—nervous about it—by chewing his nails. Well, things have got so bad since, even since he has discharged that responsibility, that he is now down to chewing his right arm—that is how bad it is. That is how concerned National members are about the breaches of privacy entailed by Novopay. The previous Minister has stopped chewing his nails; he is now chewing his entire right arm. That is how bad it is. It is for that reason that we should be very concerned when we look at a bill that is about giving State agencies the power to share information.

I accept that by and large the regime that is set out in this bill for information sharing is a good one. It requires the agencies to be clear and explicit about the purposes of the information sharing, what it is going to be used for, and its oversight by the Privacy Commissioner. Anybody whose information has been shared, where that leads to adverse consequences, is to be notified and may have an opportunity to correct any misinformation that is involved. That is all good stuff, but there is at least one arbitrary power in this that concerns me, and that is the ability of the lead agency in any information-sharing agreement—

Can I compliment Mr Little on his thoughtful contribution and other members who have contributed to this debate on the Privacy (Information Sharing) Amendment Bill, and make a few remarks in terms of the context of this legislation. The first is that I would draw members’ attention to the annual report of the Privacy Commissioner that is tabled in this Parliament and would look at the track of statistics over privacy breaches in recent years.

Some of the Opposition members have attempted to present the argument that there has been this sudden big burst of privacy breaches. In fact, the annual report of the Privacy Commissioner for agencies such as the likes of the Department of Corrections, the Inland Revenue Department, and even ACC—the number of breaches has actually been reasonably consistent over the last 10 years, albeit there is a very honest acceptance by the Government that new information systems, whether they be those of Work and Income, or the Inland Revenue Department, or other agencies, do pose an extra challenge for Government agencies to do their job effectively and efficiently around the protection of privacy. I do want to—

💬 Clare Curran: Table it.

Well, it is tabled. It is required by law, actually, Clare Curran, for the Privacy Commissioner to table the report every year, and I would draw Clare Curran’s attention to the actual numbers in that report. For instance, some people would say that there have been—

💬 Clare Curran: Thousands of breaches—thousands of breaches.

She alleges a thousand breaches. No, that is not what the Privacy Commissioner’s report says. In fact, actually, the number of privacy breaches in an area like ACC was not that different last year from what it had been for the previous 10 years.

The second remark is that this Government takes a very practical approach. How many New Zealanders do you know who get really frustrated that when they change address, they write off to one agency and say that their address has changed, and then they get a bit of paper from another six agencies, and they say: “Hang on a moment. I’ve told the Government once where my new address is. Do I really have to fill out 10 different forms to tell them?” Sometimes, if we let the Clare Currans of the world run Government, that is exactly what they would do, because they do not take a fair-minded and practical view of these issues.

Members opposite have also put questions about the experience of Paula Bennett, and I have to respond in this regard. As a Minister the public is done a disservice when someone puts their personal circumstances into the public arena and wants to argue a matter of whether it is fair and does not put all that information there. I have been in that situation often as a Minister. The moment—and you will have members of the Opposition crying from the benches that this is grossly unfair—the Minister puts any information into the arena that provides some balance, there are cries of “foul”, and that this is a privacy breach. Well, what about the right of the public to know the full story? That is equally valid in these debates and I think that is very important.

It is interesting to note that with this bill, at the select committee, every one of the submitters supported it. Is that not an endorsement of the sensible approach that the Government is taking about information sharing and in respect of the protection of privacy?

The last remark is that I want to commend this bill for taking a practical view around questions—for instance, in the area of mental health—in respect of privacy information, because there are examples that the coroners’ reports have drawn attention to this Parliament of cases where people have inadvertently made decisions about the protection of privacy of information that have actually resulted in people being put at risk and people being hurt inappropriately. It is proper that this bill changes that legal threshold and makes it plain that while there is a proper respect for privacy, that needs to be balanced with other public interests and public goods such as the protection of safety, and that we do not want the Privacy Act getting in the way of ensuring people get the proper health care and that people are protected from risk to their safety as a consequence of inappropriate ways in which the Privacy Act can be interpreted and administered.

This is a good bill and a balanced bill. It builds on the work of the Privacy Commissioner. It also builds on the work of the Law Commission and provides us with the sort of sensible law that this Government favours, law that protects people’s privacy but also allows information sharing and also allows the public safety to be properly protected. It is the sort of law that this Parliament should support.

Thank you for this opportunity to speak to this bill, the Privacy (Information Sharing) Bill. I think Dr Smith’s contribution was useful and typical of the wide-ranging conversation that we are having in respect of the issues and principles underlying this legislation, and it was appropriate for the Committee stage. I want to dig a little deeper into the Government’s attitude towards privacy and context, which was an issue that Dr Smith raised. I want to use the concrete example of the Inland Revenue Department privacy breaches from last year to explore that theme a little, and I also want to be clear that I do not think that the Government’s response is adequate. I think this bill takes some steps in the right direction, but they are meek. We need a more holistic approach, a wider approach, not one that is so piecemeal. The Inland Revenue Department privacy breaches last year involved 6,300 people, and these were the ones that were revealed in October. There were 32 separate breaches that affected that many people. There is something going wrong in the system when that happens. Regardless of whether it has been happening for a while, it is a problem that needs to be addressed. What we do not see is a Government that is taking seriously that problem of addressing these privacy breaches.

If we look at the breaches at ACC, the breaches at Work and Income, and the breaches at the Inland Revenue Department, and we add them up, we see that 16,000 Kiwis have had their private details released to other people in just those examples. That is four out of every 1,000 New Zealanders. If you extrapolate that across, and you say that this can continue as it is, you pretty quickly—well, in 10 years—get to a case where 4 percent of New Zealanders have had their private details released, and that starts to undermine the whole system. When we talk about the Inland Revenue Department, we are talking about people’s most sensitive personal information—all of their financial records and all of their banking details can be in there. There are details about their history that nobody would want released. We need trust if we are to run Government effectively in this country.

What is more, of those 6,300 people whose privacy was breached by the Inland Revenue Department last year, we know that 5,700 of those people were never contacted. Those people do not even know that their private information has been released. I think this is a tragedy. This is a shambles. This is a Government that is not facing up to this privacy issue properly. We have a computer system in the Inland Revenue Department that we know is 20 years old. We know that it predates Facebook by 10 years, we know that it predates Google, and we know that it pretty much predates the internet as we know it today. That system is still expected to handle all our most sensitive information. It is no wonder that things are going wrong. Mr Dunne has been the revenue Minister for 7 years, and has failed to lay out a proper plan to address this problem.

The Inland Revenue Department is struggling in many other respects. We know that there is roughly $7 billion of tax outstanding. There are a million tax returns unprocessed. We have got a department that is not performing and that is under pressure, and we have got a Government that is mouthing platitudes about privacy but is actually not taking the concrete steps to address it. It is spending money, we are told, on consultants. Capgemini, I think, has pocketed about $20 million so far in consultants’ fees. But the Government has not yet laid out a cogent plan as to how it is going to update that computer system, which is a critical part in taking these privacy issues seriously. We cannot wait 10 years. We cannot wait another 10 years for all the private details of New Zealand citizens to be released in order to address this problem. We need the Government to step up and show that it is determined to actually address this problem, and to put its money where its mouth is. It is one thing for Bill English to say $700 million from the asset sales—

💬 Hon Ruth Dyson: How much?

$700 million, he said, will be going towards repairing the computer system. John Key estimated it would be a billion dollars, and the Inland Revenue Department and Peter Dunne have used the $1.5 billion figure. They are all over the show—they are all over the show. Ministers have been looking at this for 2 years, and they have not yet begun to outline a plan for New Zealanders as to how they are going to take their private details seriously. That is just not good enough.

We have also got another issue, in that the consultancy they are using, Capgemini, has an absolutely appalling reputation for tax avoidance internationally. The UK Government—we have seen in the last week—has said it will not employ the likes of Capgemini.

In my first speech to this debate on Part 1 of the Privacy (Information Sharing) Bill, I said I thought there was a glaring omission, and that is in proposed new section 96L, which requires consultation by participating agencies with the Privacy Commissioner, any person or organisation representing a class of persons affected, and anyone else the agencies think should be consulted. But the Children’s Commissioner has not been specified. Although it comes under the second of those three categories I mentioned—relating to any person or organisation representing a class of persons affected—I believe that the Children’s Commissioner should be specifically included in the section. I note that the Children’s Commissioner did make a submission, and said this: “I would also expect that my Office would be party to any consultation process under s96L regarding information sharing agreements that affect the rights and interests of children …” Why, then, has that not been done? It seems to me to be not only a harmless addition but one that may be of some considerable value.

I have therefore prepared Supplementary Order Paper 172, which would insert the Children’s Commissioner as a mandatory consultee. I would ask that all parties in the Committee consider that. I do so because I think the interests of children is a significant issue that must be very well provided for, because, of course, they cannot be expected to look after their own interests, and they need special treatment in this way. Minister Collins has told me by letter that she considers that where the interests of children are relevant, new section 96L already provides for participating agencies to consult “any person or organisation that the agencies consider represents the interests of the classes of individuals whose personal information will be shared under the proposed agreement;”. For that reason, she said that National would be unlikely to support my Supplementary Order Paper.

But I think her reasoning is flawed. The part of new section 96L that I read out refers to “any person or organisation that the agencies consider represents …” a class of persons. The point is that this effectively means that the agencies will decide whether there is a need to consult the Children’s Commissioner. Most agencies are not equipped to make that assessment and are not likely to consult, when it is, in fact, advisable to do so. My Supplementary Order Paper makes it mandatory for the Children’s Commissioner to be consulted, and the Children’s Commissioner can then decide whether a response is needed. That seems to me to be the way it should be—that the Children’s Commissioner decides whether in fact consultation is worthwhile, not some agency that may well not really know what it is doing.

I do not think that would be a very great imposition on agencies. After all, all they need to do in the first instance is to write a letter to the Children’s Commissioner to ask whether consultation would be appropriate in a particular case. The commissioner can then decide, and not the agency or agencies concerned. So I do not see any reason why the Supplementary Order Paper should not be adopted. It is not only harmless; it is likely to be of considerable value. The Government should think again about that small but important issue. So I call on the Government to adopt Supplementary Order Paper 172 for those reasons.

I would say that I have heard speeches from Opposition members today saying that they do regard the functions of the commissioner and the protection of personal privacy to be important. If that is true, they will have no hesitation in supporting this Supplementary Order Paper. If they do not support it, then I will no longer consider that their assertions about the protection of personal privacy, especially in that very important area of the protection of children’s privacy, are things that they really, in fact, hold dear. So this will be the test. This will be the test of whether in fact they are interested in those issues, or whether they just want to drive this bill through because they are more interested in public agencies being allowed to do what they like.

I move, That the question be now put.