Privacy (Giving Privacy Commissioner Necessary Tools) Amendment Bill

It gives me great pleasure to rise to speak to this Privacy (Giving Privacy Commissioner Necessary Tools) Amendment Bill, which is a small bill but could be extremely effective. I want to commend my colleague Sue Moroney for having spotted the gap in the Privacy Commissioner’s ability to do things about complaints. When the Law Commission made a recommendation to the Government in its review of the Privacy Act 1993, which was published in 2011, it said: “At the moment, enforcement of the Privacy Act is complaints-driven. People can complain to the Privacy Commissioner about breaches of their privacy rights under the Act. But the Commissioner has only limited powers to take action about breaches of the Act on her own initiative. Such a system is often not well suited to addressing underlying systemic problems.”

The bill does two things. It inserts a new section and a new subsection into the Privacy Act. One simply alters the functions of the commissioner, and it says that the commissioner will be able “to conduct audits of an agency’s practices and systems for handling personal information and the personal information maintained by that agency for the purpose of ascertaining whether or not the information is maintained according to the information privacy principles.” That gives the Privacy Commissioner an ability they do not have at the moment to audit an agency’s practices in respect of privacy principles. Secondly, it gives the commissioner the right to “issue a notice to an agency that is found to be in breach of this Act, requiring that agency to take action” to repair the breach and to get their practices in order.

As usual, these things do not come out of a vacuum. These things come out of the fact that we have seen a string of major privacy breaches by Government agencies over the last few months. If I could just list them for a moment—I have got only 5 minutes, so I will be as quick as I can. There is the Earthquake Commission and ACC. Paula Bennett, herself, as a Minister saw fit to disclose private information regarding beneficiaries, with no regard to the fact that she had all of the power of the State behind her and they had very little behind them. The Ministry of Social Development, Work and Income, Novopay, the Inland Revenue Department, Immigration New Zealand, the Department of Corrections, the Ministry of Education, Housing New Zealand, the Ministry of Justice—in all of these pieces of the apparatus of the State we have seen privacy breaches. It is hardly surprising then that this has emerged as something on the radar for ordinary citizens. It is that concern that my colleague Sue Moroney is reflecting in this bill tonight.

The bill does two things, and that is all. It would be really good if Government members could see their way clear to supporting this simply by giving the Privacy Commissioner the power to conduct audits, and then giving the Privacy Commissioner the ability to note breaches and to require remedial action where there have been breaches. This is not rocket science. This actually reflects something that many people consider to be really important. So many thousands of New Zealanders have had their privacy breached that the Government apparatus is becoming a laughing stock. This is a piece of legislation that could remedy that. The Government does not have to do much in order to remedy that, and this is the way it could fix it. Thank you.

Just taking on the comments of the previous speaker, Maryan Street, about rocket science, I say that the Privacy (Giving Privacy Commissioner Necessary Tools) Amendment Bill is a rocket that has no science. It has no fizz. It is a bill that we will not be supporting and here are the reasons why. I do understand the intent of the member in charge of the bill, Sue Moroney, which is to try to address issues. We are absolutely clear that there have been privacy breaches. We can talk about ACC and the Ministry of Social Development. Those things are actually out there. We have to own them. We know they are out there.

Last year in front of the Justice and Electoral Committee the Privacy Commissioner, Mrs Shroff, said—and these are the comments that she made, witnessed by the Hon Lianne Dalziel and Andrew Little—when questioned about the privacy breaches, that there is actually nothing new. Privacy breaches have been happening for an absolutely long time, long before us. It has been going on for some time. However, what is new—these are her words—is the attention of the public on, and the concern of the media for, our addressing these issues. So we do realise that they are absolutely important.

The Government agrees with the Law Commission’s recommendation to replace the Privacy Act with a new Act. That is currently in play, and we are looking at that. National wants legislation that balances individuals’ rights to, and need for, privacy with the need for particular Government agencies to continue to be able to share information that is out there. That is important to meeting the needs of our members and our community as well. We need to improve the way personal information is collected, stored, and used by people.

In order to prevent breaches of this magnitude, it is important that the Privacy Commissioner is able to undertake investigations and identify gaps. The main provisions of this bill, as mentioned by the previous member, Maryan Street, are twofold. Yes, those provisions are to ensure that the Privacy Commissioner has the power to issue a compliance notice—a notice to an agency that is found to be in breach of the Act—and to require the agency to comply with the Act. But here is the second part, and this, probably, is where we have a contention: the bill would also give the Privacy Commissioner an audit power to demand information-handling audits across the public sector. The Government cannot support the bill in its current form, and particularly in that second part. Although we agree with the Law Commission’s recommendation in its review of the Privacy Act that the Privacy Commissioner should be able to issue compliance notices, we do not support an audit power being given to the commissioner. Here are the reasons why. National wants to strengthen the Privacy Commissioner’s power to investigate of their own motion, so, yes, it will agree to that. But the Privacy Act is currently under review, so we are undertaking what we think is important.

You see, the thing is that this bill—and hence the reason why I refer to it as a rocket with no fizz and no science—addresses only one part of the Law Commission’s recommendations. What the Government is doing, however, is actually taking a broader approach. It is actually tackling a variety of different issues in this legislation. We want the legislation to be balanced regarding the rights and the needs of privacy of individuals. So here is some more about what we are doing. The Minister herself expects to take a paper to Cabinet later this year. It will cover the issues raised in this bill and the remainder of the Law Commission’s recommendations.

The other thing, too, is that the Privacy Commissioner is out there consulting. There has been a lot of concern about the lack of consultation—a lack of consultation. We have been out there, and the Privacy Commissioner has been out there consulting with all relevant stakeholders to ensure that we get these issues addressed clearly. All the recommendations of the Law Commission must be considered in combination with the privacy breach issues that have arisen from the Privacy Commissioner’s report.

We know that there are also issues with regard to technology. Technology has changed. Because of that change, I suppose that in this sense it is not just a simple issue of: “Well, we’ve got to issue these compliance notices, and that will solve the issue.” We do not believe that. There is a broader set of things that we need in order to be able to do this, and hence the reason why we are not supporting the bill.

One of the things that did come out from the Law Commission was about the language. Refreshing the language in order to clarify the provisions inside the Act will help users better understand its purpose in our modern environment.

We should also consider the international approaches to privacy as well. Although I do applaud the intent, the effort, and the energy of the member in putting together this Privacy (Giving Privacy Commissioner Necessary Tools) Amendment Bill—a bit of a mouthful there—I have to say, on behalf of the Government, that we will not support this bill. We do not think that it actually reaches all the key concerns that are there in the recommendations. I will not be supporting this bill in the House.

Can I, first of all, start by acknowledging and thanking all of those parties who have seen fit to support this bill, the Privacy (Giving Privacy Commissioner Necessary Tools) Amendment Bill, in the House, because I think the parties that have supported this bill show that they take New Zealanders’ concerns about privacy breaches very seriously and are prepared to act. That is certainly the reason why I put this bill forward into the ballot, and was fortunate enough to have it pulled out. But I am sorry to say that it is all too often that we are in this House and we hear the Government dragging its heels. The sound is very audible in the debating chamber, as the Government drags its heels yet again on an issue that is important to New Zealanders.

This Government has been guilty of breaching New Zealanders’ privacy. From ACC to EQC, or the Earthquake Commission, and every acronym in between, it has been breaching New Zealanders’ privacy. It actually started right at the top, because it was the Minister for Social Development, Paula Bennett, who was the first to start this trend. She deliberately breached the privacy of two sole parents, when they dared to question her cutting of the training incentive allowance. That is where it all started from. So the crocodile tears from the members opposite simply do not work, because New Zealanders saw one of their own Ministers deliberately breaching privacy for her own ends.

That gave the cue to all of those public entities that New Zealanders’ privacy was not paramount. Of course, what followed was all of these privacy breaches. The Ministry of Social Development—well, of course they were going to breach people’s privacy. Their own Minister had shown them that that was the proper thing to do. So these constant privacy breaches are endemic, they have been systemic, and they have been led from the Government benches. That is why this bill is important.

The previous speaker, Alfred Ngaro, said that it was a rocket without the science. Well, I would like him to actually say that to the Law Commission, because this was the recommendation of the Law Commission. Alfred Ngaro is promising that at some time between now, 13 November, and the end of the year—not that far away—the Minister is going to be taking a paper to Cabinet. Well, here is news for that member: his Minister got on her feet in front of a couple of hundred people in May last year and promised that she would be introducing that bill in the first half of 2013—the first half of 2013. Yet here he is admitting to us that she has not even taken the paper to Cabinet. It is 13 November and the paper has not even gone to Cabinet.

The sound of the Government dragging its heels on addressing these very serous privacy concerns is deafening and is audible in this debating chamber, and it came from the members opposite. So I am now going to let the voting do the talking, because we will then learn which parties in this Parliament take the privacy of New Zealanders seriously, and which parties do not. Thank you.