Debate on Crown Entities, Public Organisations, and State Enterprises — Privacy Commissioner

It is a great pleasure to talk on the report on the financial review of the Privacy Commissioner. It has been a difficult time for the Privacy Commissioner. When she spoke to the Justice and Electoral Committee she prefaced her remarks with this, I think somewhat cryptic but very telling, statement: “It’s obvious to a blind bantam hen, of course, that there is an awful lot going on on the privacy front …”. We did not get around to asking whom she had in mind as the bantam hen, but I do not think it takes too much imagination. We think the bantam hen should be called fully to account for her ongoing blindness.

The truth is that the Privacy Commissioner’s office has had a funding freeze for 8 years—5 of those years under this Government—and in the same time it has had a 42 percent increase in the number of complaints it has had to process. That is 8 years—5 years under this Government—of a funding freeze, and a 42 percent increase in its workload. Of course, the telling thing about the workload is that the nature of the complaints is getting more complex and more sophisticated because they are no longer just single and individual breaches; they are multiple breaches. They are systemic failures and systemic problems, and, as the Privacy Commissioner herself noted in her report to the select committee, they are issues of culture in the workplace.

The way she described it in terms of her challenges in the future is that “… the moment has come where we’ve got to very much remember that we shouldn’t go for sort of band-aid solutions.” She is saying that just trying to crimp and squeeze a little more blood out of this very difficult stone is no longer good enough. The problems are too challenging, the problems are too great, and she needs more support and better resourcing. That is a challenge for this Parliament to get to grips with. When she describes an information and data climate that is now a revolution, we have to take seriously the risks of data breaches and privacy breaches that that poses, and ensure that our last bastion of oversight and assurance for the general public is properly resourced in order for her to do her job. That remains a major challenge for her office and, indeed, for the Government.

She said in her comments to the select committee: “I have to take a measured approach within my resources and capabilities and assess which of those breaches will require more action.” She is basically saying that she now has regular trade-offs to make about which matters she inquires into and which matters she simply has to let go of. It was interesting the way she described it. The metaphor she used—not to be confused with the bantam hen, of course—was: “… I feel a little bit like the little red tugboat that hasn’t got enough fuel: we’re there, but we can’t always go out into the harbour and do something about it and help. It’s like MSD or ACC are like big ocean liners full of people’s information, and there’s only so much the little tugboat can do.” Well, I think that is a very telling metaphor that she has used, and it is a cry for help. The very professional way that our present Privacy Commissioner conducts herself is something for which this House should be, and I know is, particularly grateful.

We had in the year under review some major privacy breaches in our Government departments, not to mention the private sector, but certainly the Government departments. The ACC breach is foremost amongst them. Over 6,000 ACC claimants had their information improperly disclosed. We had breaches at Work and Income and at the Ministry of Social Development, and the very chilling prospect that somebody can go into a Ministry of Social Development kiosk, a publicly accessible kiosk, and get information that ought to be confidential—likewise at the Inland Revenue Department.

Another I think very frightening and chilling experience was with the Ministry of Justice only this year, when a member of the public went through a publicly accessible channel and got access to confidential information about legal aid payments made to lawyers. The Government’s response was, of course, to accuse the good citizen who revealed that of being a hacker. Not only that but it referred the matter to the police, and we now have an MP on this side of the House under a police investigation because we have a Minister of Justice who wishes not to deal with a very serious issue.

I note that the Greens are seeking the call. Speaker’s rulings 16/3 and 16/5 expressly forbid the displaying of any slogans in the House, and no Green member will get a call while that is there.

The Privacy Commissioner is one of the Crown entities that is finding itself under increasing pressure, as we have heard from my colleague Andrew Little. I think my comments are going to follow on quite neatly from what he had to say. It will not be surprising for the Chamber to know that after the Privacy Commissioner’s reference to the “blind bantam hen”, which, I think, has been appropriately identified by my colleague, she went on to talk about the fact that she anticipated that we would be interested in asking her questions about data breaches. She said: “I have to say to the committee that, unfortunately, the sorts of data breaches that we’ve seen in recent months are actually nothing new. We have data breaches being reported to us all the time right across the public and private sectors. The intense media and public interest is, however, relatively new.” I think that is because of the scale of the breaches. We heard Andrew Little talk about—what was it? There were 6,000 included in the ACC breach. There were 98,000 claims affecting 83,000 claimants. That was the extent of the breach for which we did not get a snap debate in Parliament. I find that absolutely extraordinary.

But, anyway, the Privacy Commissioner said: “I’ve noted that in terms of Government responses to these breaches, there’s an element of resignation, perhaps an impression that human error is to blame,”—and, yes, we heard that from both the Prime Minister and the Minister for Canterbury Earthquake Recovery—“and that nothing can be done about that. Of course we cannot eradicate human error.”, says the Privacy Commissioner. “That will always be a feature of every incident that involves human beings or human systems. No system can be error-proof, and it would be unreasonable for me or the public to expect such a standard from the Government or from business all the time. However, I think the answer is bigger than that. It’s not a simple answer. These recent events have formed a cluster. OK, some of it arises from intense public and media interest, but they definitely form a cluster that we should pay attention to. And I believe it’s inappropriate to blame the staff at the front line in every case.”

I just want to comment on that, because that is what we got from the Prime Minister and that is what we got from the Minister for Canterbury Earthquake Recovery. They put up the straw man and then they knock it down. Not once ever did the Opposition call for anyone’s resignation from the front line on the breaches of privacy in the Earthquake Commission, in ACC, or in Work and Income—any of those. We expect Ministers to be accountable for their departments, and they are the only ones for whom that call would be made. I just want to make that crystal clear. It is inappropriate to blame front-line staff. Human error always occurs. You cannot have a systems breakdown in the IT sector without human error. The trouble is that human error occurs when you are dealing with computers, because computers actually do not do anything that they are not required to do by somebody who is feeding it. It will always be a programmer, an analyst, a user, or any combination of the above that will mean that there will be a breakdown in the systemic operation of the system.

The problem is that the spin doctors want to take it away from the reality, and that is that there has been inappropriate and inadequate attention paid to the culture of privacy. That is what the Privacy Commissioner went on to say: “What’s become clear following the ACC inquiry, which was a very useful case to look at, is that human error is more likely to occur in an environment where privacy is not given the weight or attention that it deserves. There needs to be a culture of privacy through every organisation. Staff need the tools, the systems, the support required to protect them and the personal information they work with every day. We need leadership, we need good management, we need good technology and good systems at every level to protect citizens’ data and the customers’ data in the private sector.”

And I believe that that statement from the Privacy Commissioner is what is unprecedented about our consideration of this matter. It is a criticism of the Government, because that Government is responsible for ensuring that there has been no leadership, that there has been poor management, and that there has been hopeless technology and systems, which the Privacy Commissioner has to address.

In a lot of the annual round-ups for 2012, privacy was at the top of the list of items of importance for this country. The Privacy Commissioner plays the critical role in terms of this country’s basic protection of privacy. So it has been very disturbing in this financial review to hear so directly and so clearly from the commissioner herself of her concerns about the Office of the Privacy Commissioner’s ability to fulfil that role. The office’s baseline funding has remained static, as has already been said, for the last 8 years, and it has been told to expect it to remain static for a while longer. It has funding of around $3.5 million a year to fulfil all its functions, except that it has told us that it cannot. It has told us that it does not have the capacity to do everything, and that it is having to prioritise protection of our basic privacy. That, I think, is something that most people in this country would not want compromised or not prioritised.

While in office, this Government has had the oversight of multiple, significant privacy breaches within Government departments—namely, the Inland Revenue Department, ACC, Work and Income, the Ministry of Justice, the Immigration Service, the Ministry of Education, and the Earthquake Commission. If you think about the people whom those different departments deal with, it actually occurs to you that that is potentially pretty much everyone in this House. It is pretty much everyone in this country who has potentially had their own private information shared inappropriately, or their privacy breached. That is quite an extraordinary situation. The Privacy Commissioner has noted that there has been a 42 percent increase in complaints to the office. We have been told, of course, that it is about human error and front-line staff, but the Privacy Commissioner herself—a very, very diplomatic woman—said that it was inappropriate to blame staff, that the answer is bigger than that, and that there are systemic issues.

People require a sense of security if they are to feel comfortable within this society. One important facet of security is the capacity to control information about oneself. If we cannot control information about ourselves, it is very difficult to operate in this world, and therefore the principles of privacy, as a means of controlling that information, are vital contributors to an individual’s sense of security and to our collective well-being. The Privacy Commissioner also pointed out that it is incredibly important for our economic development and security, because business is increasingly being done online. There is an element of business and information sharing that happens in that engagement, and we need somebody with the resources to be overseeing that, to protect us and our economy.

So what has this Government’s response been to what I think can pretty fairly be said to be a systemic crisis of privacy systems? Well, it has decided to continue to freeze the funding to the Office of the Privacy Commissioner, to our knowledge; it has introduced new legislation, with increased legislative responsibilities for the Privacy Commissioner, without an increase in funding; and it has decided to establish a new Government data hub. The new legislation, you could say, may have some good elements to it and may increase the protection of privacy, but unless there is somebody who is resourced to be able to actually secure that, you really have to question what the value of it is. You could say that a Government data hub is a great idea on lots of levels—and there was discussion on this just this morning on Radio New Zealand National—but if there is no resourcing of the commission to properly input into that process to ensure that the systems are secure and that privacy is central in this process, then, again, we have to question whether our rights and our information are being adequately protected.

The wonder and the beauty of select committees is that you get the checks and balances of the different views, and I want to acknowledge the view of Mr Little, who is over there. I did not quite hear the story about the blind bantam hen, though I did hear the comment about the little tugboat that said: “I know I can. I know I can.” I think he might have been recanting his own story and journey around defamation, but we are talking about the Office of the Privacy Commissioner, and what is important is that we know that the fact is that information is important.

The Privacy Commissioner talks about personal data becoming a critical area for business and for the Government. We know that Opposition members were interested in the Office of the Privacy Commissioner because they possibly would hear some meaty stories, which they could use in a press release, about all the things the office was doing wrong. But what the commissioner said was quite clear. In fact, she actually started off with the comment that what we have is equivalent to an ecosystem that is mutating and multiplying constantly before us. She was talking about the whole aspect of information technology and the challenges that it faces to us.

The Privacy Commissioner also said—and I want to put this in context—that data breaching of confidential information is nothing new. As the Hon Lianne Dalziel said, it is nothing new. In other words, it has been happening for a long time. What is new—and the commissioner is correct in saying this—is the intense scrutiny from both the media and the public. We are really clear about the fact that we, like the Privacy Commissioner, believe that it is important to protect information and to ensure there are rights and responsibilities in terms of protecting information. But, at the same time, data sharing is important in terms of the needs that are out there and in terms of ensuring there are opportunities for services.

The other question is about the aspect of funding being static for over 8 years. In fact, what the commissioner actually said is that over consecutive Governments—it is not one Government to blame, in one sense—there has been no increase in funding. But what there has been is an increase of 42 percent in applications—8,465 inquiries from members of the public and organisations seeking advice on privacy matters, and 1,142 complaints. That is an increase of 42 percent. But here is the statistic that the Opposition does not quote, and it is in commissioner’s the annual report. The Privacy Commissioner said that 95 percent of complaints have been closed—

💬 Simon O’Connor: How many?

—within a period of 9 months—95 percent. How do we judge an organisation on its efficiency and its effectiveness? We ask whether it meets its outcomes. [Interruption] Ninety-five percent, Mr Little, is what the Office of the Privacy Commissioner declared to us. So it does meet its outcomes. It is meeting the needs that it sees.

Look, when you ask an organisation whether it needs more money, whether it would like more money, of course it is going to say yes. But what the Privacy Commissioner said was that the fiscal constraints have been positive. This is what the Opposition does not say. The Privacy Commissioner said—and this is what the Opposition does not say—that the fiscal constraints have been positive, as they have allowed the commission to focus on its core business. And she said they are doing the business, with a completion rate of 95 percent.

It is quite clear that the commissioner also commented about information technology. It is a revolution, as she said. It is a global ecosystem that is both multiplying and mutating with incredible speed, so what we need to do is to take into account, and be cognisant of, the needs that we face in this. She also talked about—again, which you will not hear from the Opposition—shared responsibility and accountability. While the Opposition was looking for somebody to blame and was looking for someone to hold to account, she was saying that this is about shared responsibility and shared accountability.

💬 Andrew Little: It’s our job. It’s our job to hold you to account.

She wants a culture—and you are absolutely right, Mr Little—in New Zealand whereby when we find information that does not belong to us, we return it to its rightful owner, and where there is a sense of integrity about this. [Interruption] You will not talk about this, but it is about shared responsibility and shared accountability.

What we heard from the Privacy Commissioner was actually a balanced view. It was not all about the sense of concern—the horses were not getting frightened outside; there was no issue there. However, we also share the concern about the vulnerability of people’s information. That is highly important to us. So what we are doing, working with the commissioner, is ensuring that she is focusing on her core responsibilities and that she is meeting her key performance indicators—a 95 percent completion rate. She is also working with us on the Privacy (Information Sharing) Bill and on the other legislation that we are putting through. We have confidence in the Privacy Commissioner.

Report noted.

Genesis Power Ltd