Intelligence and Security Bill

My comments are related to privacy and to the importance of privacy measures in the legislation. I think I started my comments last night by acknowledging the engagement of the Minister in the chair, Christopher Finlayson. I also want to acknowledge that there are more protections for privacy in this bill as amended by the Foreign Affairs, Defence and Trade Committee, in particular the removal of clause 109.

However, I do want to make some comments about the importance of the privacy provisions. I think it was my colleague Grant Robertson who last night used the phrase “uncomfortable concerns”. Well, I have some uncomfortable concerns about the state of our privacy legislation—our privacy provisions, generally—in New Zealand. Although this bill seems to go quite a long way to ensure that privacy is taken into account, it still leaves a lot of questions about the overall privacy framework, and I am wondering whether the Minister in the chair might want to comment on that in particular.

Today I am actually tabling an amendment to clause 101A, which inserts after clause 101A(3)(b) a new paragraph: “(c) the Privacy Commissioner.” Clause 101A relates to the register of section 101 certificates, where “(1) The Director-General of an intelligence and security agency must keep a register of all certificates issued …” and where “(3) The register may be accessed at any time by—(a) the Minister responsible for the intelligence and security agency: (b) the Inspector-General.”, and, if my amendment is accepted, then also by the Privacy Commissioner. The reason for that is that it is, I suppose, an extra check and balance. It is an extra set of eyes. It is an extra sense that there is more transparency and independence around the issuing of certificates and keeping the system honest.

I note that the Privacy Commissioner has to be consulted with in regard to the direct access agreements. This is in clause 105, “Consultation with Privacy Commissioner before entering into direct access agreements”: “must consult with, and invite comment from, the Privacy Commissioner on the proposed agreement.” That goes to, really, the intent of Part 5, which is around how information is accessed by other agencies. I note that that is actually quite a step forward, and I think it provides some significant comfort around how that information from public sector agencies will actually be shared—if the Privacy Commissioner is able to have some input and, particularly, to be consulted before it happens. That is why I have suggested in my amendment to clause 101A that the Privacy Commissioner also be given a role in relation to being able to view the certificates that are issued—essentially, the warrants that are issued. It would be good if the Privacy Commissioner could then do some reporting on the numerical number, or whatever, so that there is more transparency in the system.

This goes to, essentially—and this is one of my questions to the Minister—around how this piece of legislation fits with the existing Privacy Act. That Act underwent quite a considerable review—well, a fundamental review—by the Law Commission in 2011. It is now 2017, and there has not been any acting by this Government on the strong recommendations of the Law Commission to reform the Privacy Act. Here we have a sort of upping of the Privacy Commissioner’s role in this piece of legislation, but the foundation legislation for privacy in New Zealand is way out of date.

I note the comments that were made by the outgoing Privacy Commissioner, Marie Shroff, a couple of years ago. She described privacy and security—in other words, our intelligence framework—as being like twin pillars, and said that, really, a true, functioning democracy operates most effectively when those pillars are truly twinned, when they are equal. Well, in recent years, what we have seen is our intelligence framework—our legislative framework around intelligence, the gathering of information, the restrictions on telecommunications companies, and the role of the intelligence agencies—we have seen several pieces of legislation, we have seen significant reforms in those areas, but we have never seen any reform, yet, in the privacy legislation. I wonder whether the Minister has considered the impact of this, whether or not the provisions in this legislation that are giving the Privacy Commissioner more powers actually do somehow undermine the Act or conflict with the Privacy Act itself, and whether he could answer those questions.

The other point I wanted to make is the disconnect between this legislation and its information in terms of, say, clause 105, “Consultation with the Privacy Commissioner before entering into direct access agreement”. When it is anything to do with the direct access agreements with public sector agencies and the lack of attention paid to the private sector, that disconnect seems to be there.

I note that in clause 118—of course, I did not sit on the committee, so I was not party to the discussions—there are provisions made around telecommunications companies. It seems as if the work has been done on that and that there is nothing hugely controversial in the legislation. But where are the mechanisms for the information for the comparable relationships with the private sector, and what role does the Privacy Commissioner have there? Because people do not operate in just the public sector.

These are quite important and quite fundamental questions—the role that privacy plays in our country. Our provisions and protections around privacy are out of kilter with our intelligence framework, I think, and these are matters that I hope the Minister will address.

I rise in support—we have a microphone problem; no we do not—of the bill, but I do wish to seek some clarification from the Minister in charge of the NZ Security Intelligence Service of several aspects around Part 5. Part 5 opens by detailing the role of the agencies in obtaining business records, particularly of telecommunications network providers and financial service providers. If you think about everything that we carry on our phones these days, from our address book and our calls and emails to our banking, it is pretty pervasive. This part provides for the compulsory access and acquisition of business records by those who provide those services. It is, as with many other parts of the bill, I think, commendably balanced; however, it is not without questions and not without the need for monitoring.

The first thing that I think we need to note and put in lights is that the content of communications is excluded from the definition of business records of telecommunications companies. That is, in order for the services to obtain the content of a communication of a New Zealand citizen they need to obtain a warrant in all but the most specific exceptional circumstances that we detailed in the previous part. So this part, around obtaining business records, does not include the content of communications. Having said that—and this is where balance comes in—it does include details as to the numbers called, the time of the call, the duration of the call, where you called from, and where you called to. And it will not require too much imagination for people to understand that the metadata itself—the information about the call, rather than the content of the call—is fairly far-reaching in its implications in terms of personal privacy.

So I agree with my colleague Clare Curran that the role of the Privacy Commissioner needs to be clear, and we as a Parliament need to maintain vigilance as to the operation. We are, in that regard, I think, gratified that the legislation strengthens the position of the inspector-general, and we have confidence in the agencies and in the inspector-general’s role, but none the less vigilance will be required.

The second thing that I like about the way that this is drafted is that the framework is limited to individual requests for specific information, rather than bulk or class-based orders. So there is no requirement, as I understand it, for firms to collect or retain information that they do not already collect. I think that is also useful and, no doubt, will come as some form of reassurance to the industry.

A side point that is worth noting, because it has been discussed in the public domain, is the fact that, of course, telecommunications providers are global, and that includes social media. When one puts the compulsory acquisition of telecommunications metadata together with the opportunity for services to cooperate with partner agencies from other countries, of course that can include the countries that host the servers for things like Google, Facebook, Yahoo!, America Online—I think we are closing in on a jurisdiction here—and Amazon, for which it remains a domestic operation, because for those things such as Facebook, Twitter, etc., it is a domestic operation for them to intercept servers that are located on their soil. Therefore, a Five Eyes partner of ours can, as a matter of domestic practice, intercept, potentially, the content of communications from New Zealanders. That is a very important side issue alongside the restrictions that we have in this bill around the content of communications, because it places the emphasis on the need for protocols around the exchange of information of New Zealand citizens with friendly countries.

Clause 118B is the clause that defines “business records” as meaning “all information in the possession or under the control of the telecommunications network operator, and all information in the possession or under the control of the financial service provider.” It is germane to this that that is an entirely pervasive, broad definition, and it is in the exceptions to that universal power of access that we see the protections around the content of communications, information around the employees or the directors of the TELCOs or the financial service providers, and certain other carve-outs from that general definition. So it is important that we as a Parliament and it is important that the New Zealand public understand the way this law is written, which is that the agencies can, by compulsion, have access to everything that is in the possession of a telecommunications provider or a financial service provider, except for certain exceptions.

I would ask the Minister to clarify for us the extent of the exception around customer data held by a financial institution. It is clear on a plain reading that the content of a phone call or an email should be excluded, notwithstanding the possible exception around third-country exchange that I mentioned, but it is less clear to me—and I may have missed it; I probably have missed it, so if the Minister could clarify—the clauses that protect individual financial data. You know, anybody who could read everybody else’s bank statements or credit card records would have a pretty good idea about where they were, when they were there, what they were doing, and what they were consuming, and I would hope that there would be a high level of equivalent privacy protection around that.

The balance this bill seeks to strike is that it is to enable the agencies to do the work they have to do on behalf of all of us to catch the baddies before havoc is wreaked, potentially. But, in doing so, we have to do it in a way that protects the freedoms and the rule of law that our country holds dear, otherwise, we have already lost—otherwise, we have already lost. The act of protecting our physical security would be such as to diminish our democracy, and I am not sure which would be worse.

So I do want to commend the select committee and the Minister for the balance that they have sought to strike. I believe that they have, on all sides of the House, foremost in their mind the need for that appropriate balance between effectiveness and appropriateness. The fact that we are debating it—and again, I want to thank the Minister. He has consulted in such an open way, and I understand from my colleagues who have spent longer on the bill than I have that his consultation has been thorough and open throughout this bill and that the officials have done an excellent and conscientious job.

I think all New Zealanders can take comfort in that, and can know that our Parliament is working as it should and that there is actually unity of purpose around this House. Different parties will see that balance in a different position, potentially, and our Green colleagues, whom we respect highly, see the balance being at a different point, overall, on this bill. We respect the way they got to that conclusion, even though we differ from them in substance, and I think they would join with us in saying that, notwithstanding their reservations, the process has been of a high quality and that the points of difference are known and understood. As my good colleague David Parker said yesterday, when those all around us seem to be losing their heads, it is good to know that the New Zealand political system has retained its common sense.

So, with those few words of commendation and a couple of open questions—particularly around financial records, which I would seek the Minister’s clarification on—I end this short contribution on Part 5. Thank you.

I want to address Subpart 4 of Part 5, which is about the implications of giving approval to obtain business records. I want to explore an issue that has been raised with me by a journalist. A journalist phoned me to say: “Well, look, at the time of the last election, there was the controversy that arose from the emails that were disclosed by Nicky Hager and the emails that subsequently came into the public arena via Rawshark, and we still do not know who that person is.” The question that was posed to me by the journalist was: “Are we in some way, in this legislation, enabling the GCSB, either for itself or on behalf of another agency of the State, to investigate into a circumstance such as that, to try to find the identity of Rawshark?”.

The journalist concerned did not need to make the point, and indeed did not make the point to me, but I make the observation that the response of the Prime Minister and others, which was of course politically embarrassing to the Government, was to say that those emails should not be given any credence because they were the consequence of an illegal hack of the Whale Oil Beef Hooked computer system. The hack brought to public attention the nefarious things that Cameron Slater, Cactus Kate, and various other people had been up to, in league with, at times, Jason Ede in the Prime Minister’s department and Judith Collins.

All of that is now a matter of public record, and I do not think it reflects well at all on the people who were participants in it. But I am not actually here to make that political point; I am here to make the point that that having come out, would it be permissible for the GCSB to be trying to assist the authorities to find out who Rawshark was or to find out who Nicky Hager’s source was?

I looked at that, and in respect of the ability of the GCSB, for example, to assist the police—which is in clause 16 of the bill, which is a clause we have already done—I am satisfied that it could not do anything more than the police could do themselves anyway. If the police needed a warrant, then the GCSB could only do what the police could do under a warrant, and the authority for that comes under the search and surveillance legislation, not under this bill. So I do not think this bill creates another route for that here.

In respect of the last part that we looked at, which is the warranted route under either clause 55A or clause 55B, if the GCSB was attempting to find a New Zealander or an agent, it would have to either prove or have some good evidence that the person or class of person was an agent of a foreign power. I do not think it could show that here. Maybe it could show that at the moment in America, with the Russian interference with that election, but there is no such suggestion of that here, with Rawshark, so I do not think it could go under clause 55B. Under clause 55A, it would have to cross the threshold of national security, and I do not think it could show that this was a matter of national security—the hacking of that toe-rag Whale Oil’s website. I do not think it would get through, under clause 55A.

That then leads me to the only other route, which might be if it could go to the telecommunication companies, under Part 5 that we are now discussing. I would like a response on this from the Minister in the chair—whether the GCSB could obtain access to business records, under this new Subpart 4 that we have inserted at the Foreign Affairs, Defence and Trade Committee.

I just want to discuss that a little bit. The background to this, at the select committee, again in part comes from the Nicky Hager experience. It eventually turned out that after Nicky Hager was raided—and I thought this, again, was an inappropriate response from the police to a complaint by the executive at the time of the election. I recall that what happened was that he who was the person who published the book was the person who ended up with the long arm of the law looking at him, as if he had done something wrong. They exercised search warrants upon him. They grabbed his computer records. They grabbed other records. It was a matter of some controversy.

They did not actually go after Cameron Slater, and to this day no one has properly investigated the accusation as to whether—[Bell rung] Mr Chairman.

The CHAIRPERSON (Lindsay Tisch): The Hon David Parker. Can you just come back on to the bill.

This is absolutely relevant.

The CHAIRPERSON (Lindsay Tisch): I know it is background, but we need to tie it back into the bill.

Well, I am tying it back to business records, because what happened was that, in amongst all of that, the police approached Westpac and, without Westpac checking with Nicky Hager, they gave across his business records. That is one of the reasons why the telecommunication companies and the banks came to the select committee—to say: “Look, we’re increasingly nervous about this being done in an unregulated way, just on a request basis. We want some regulation around this, so that in appropriate circumstances, when we are required to cooperate, that requirement is laid down in law and has the checks and balances that it needs to have at law.” So this really is very, very relevant to the bill.

It is important to get these balances right. If we are going to maintain confidence in democracy in New Zealand, it seems to me that the person who should have been investigated is Cameron Slater. The suggestion of some illegal conspiracy to undermine the Serious Fraud Office and the Financial Markets Authority, which still has not been investigated, was to a certain extent sidelined by the executive saying: “Look at the theft of emails from Cameron Slater and investigate that.” Sure enough, the police hopped to and did that, and went to Westpac and got the business records.

That brings my question to the Minister: is the power to seek business records something that this journalist should be concerned about, or is it something at a superficial level, which would go to the level of detail that is prescribed pursuant to Subpart 4 of Part 5, which is more general in detail? We have already heard from the Hon David Cunliffe that it does not go to the content of communications. But could the GCSB, through that business record, go so hard that it was looking at the sources of email links that had come from Rawshark, going back to the overseas website link and the other website link, in order to trace it back to the anonymous route that Rawshark had laid out so as to protect his anonymity—or her anonymity; I do not know who this person is. Is this a back route to that?

I would hope not. I would suggest that some of the protections arise from the ministerial statements and the register that is required to be inspected by the director-general, but I would not mind hearing some specific response from the Minister. I have already gone through the more Draconian routes—the warranted routes—that I do not think would be open to the GCSB, and cooperation with the police does not add other routes to get that information. I think that in this sort of a situation, it would be inappropriate to use the powers of the GCSB against Rawshark. I just want to check that this business records approach is not an avenue to that same end.

Much of what the honourable member said—well, the issue raised by the journalist, which I am very aware of—relates to Part 4, and I will deal with that in any third reading speech in relation to clause 55.

The short answer to the honourable member’s question is no. I refer him to clause 118E(2) and the criteria that are set out there. This, in part, also addresses Mr Cunliffe’s point about the need for specificity. I come immediately to paragraph (c) of clause 118E(2), for the benefit of Mr Parker. The commissioner and the Minister have to be satisfied that “it would not be more appropriate for the Director-General to apply for the issue of an intelligence warrant authorising the seizing”, and then in paragraph (d) that: “there are satisfactory arrangements in place to ensure that nothing will be done in reliance on the approval beyond what is necessary and reasonable for the proper performance of a function of an intelligence and security agency;”. So I would be satisfied that the ability to go for a general trawl is simply not there. These are very carefully grafted procedures, which are set out, and it is not going to allow for large scale or bulk access to information. Every request is going to need to be made with reference to a specific person and so on.

As the honourable member correctly observes, there is also the requirement for the register. I ask the member to read clause 118E(2). I do think that answers his question. I also invite Mr Cunliffe to do the same because he will see the kinds of requirements that are set out there that prevent a general trawl taking place.

On the issue raised by Ms Curran, I looked at clause 101A(3). She is not there. I am not allowed to comment that she is not there. [Interruption] I have no particular issue with that, and we can go with it.

I want to say first of all that New Zealand First is very satisfied, indeed, with this part, which we believe does—more than adequately, actually—protect the privacy of individual information and the privacy of business information as well. I wanted to make that statement first of all.

I did want to raise with the Minister one quite minor point about clause 115. That clause is a particularly important clause in this part because that is the clause that provides for further criteria for permitting access to restricted information. Obviously, restricted information is the most sensitive information that can be authorised to be accessed under the provisions of this part. Clause 115 has a very important role in governing that. We must be very careful about what it says. What it does say is that that information can be accessed but that, under paragraph (a), it must be “necessary for the purpose of enabling” the agency to perform one of the functions that are very comprehensively set out in clauses 13 and 14. Under paragraph (c), it says: “the restricted information cannot be accessed by any other means.”

I am happy about those two things, but it is actually paragraph (b) that I have a little difficulty with, which I wanted to ask the Minister a question about. That provides that “the privacy impact of permitting access is proportionate to that purpose”—and the purpose, of course, is the purpose set out in (a). It is the term “proportionate” that could cause some difficulty. Bear in mind that clause 115 is mandatory and that it must be complied with on every occasion. The risk I see is that if a person is aggrieved about having their information accessed, they are likely to go straight to this clause to see whether they can get some reason to challenge the decisions made under it.

I would have thought that there is a bit of a risk with using paragraph (b)—and, in particular, using the term “proportionate”—because it would be subject to judicial interpretation. The term “proportionate” is a pretty difficult term to understand in this context, because it says: “What is the value of the private information as against the purpose?”. Of course, the individual would say: “Any restricted information is of huge importance to me, on a subjective basis.” It would be difficult to displace that. It is a very high bar that we are setting ourselves by having subclause (b) in there at all. The first option would be simply to eliminate it, because I would be satisfied with (a) and (c). But if (b) is going to stay there, I would have thought it would be advisable to replace the term “proportionate” with, at least, “reasonably proportionate” or, perhaps, “not disproportionate”, in an attempt to lower that bar a little bit and to assist the court to make sense of this particular clause.

Could the Minister have a look at that and perhaps advise us all whether he believes this clause may be problematic, whether it would be better to delete it altogether—I am talking about clause 115(b)—or, if that is perhaps going too far, then at least to replace the word “proportionate” with “reasonably proportionate” or, preferably, “not disproportionate”. I would like to hear his views on that.

It is my pleasure to take a call on this important part of this legislation. I have some reasonably specific questions for the Minister in the chair, Chris Finlayson. First of all, I want to direct my attention to clause 100 in subpart 1 of Part 5 of this bill. I note that this is a clause that has been strengthened through the select committee process, and it has some extra words that have been added. As a general statement, I would like to say that it is very pleasing, given that this is such an important part of this legislation, to see that so many changes have been made at the select committee stage.

But I note in clause 100 the words “believes on reasonable grounds” have been added into this clause. I am aware that the reasonable grounds test is something that appears commonly within the criminal statute. My question for the Minister, which I would like him to answer, is whether “believes on reasonable grounds” is the same as or different from “reasonable grounds to believe”, which is used in other parts of the criminal statute. I ask the Minister in the chair to give the Committee some direction around whether there are any specific circumstances relating to this legislation that are different from what occurs commonly across the criminal statute in terms of that use, and whether there is differentiation in terms of the wording that is contained in clause 100. Likewise with clause 100(2)(b), where the word “necessary” is used. What is meant, in the context of this legislation, by “necessary”? I think it would be useful for the Committee to have some clarity from the Minister in the chair around what is meant by those words.

The other clauses that I would like to refer to in this part—I would like to congratulate the Foreign Affairs, Defence and Trade Committee on the removal of clause 109. I think it was rightly noted by members of the select committee that this was going to be creating law by regulation. In such an important piece of legislation as this I think removing it was a prudent move and one that I certainly applaud, and I thank the committee for removing that ability to do that. I think one of the things that have allowed for this piece of legislation to achieve the support across the Committee that it has is that there are layers of transparency and there are clear rules. So I am very pleased to see the removal of the ability to make those rules by regulation rather than in the body of the statute.

The other clause that I would just like to turn the Committee’s attention to is clause 111. This, of course, is in the subpart around restricted information and the meaning of restricted information in terms of the Act. In subpart 3 of Part 5 “restricted information” means—the bill specifies some particular circumstances and meanings of restricted information—“(a) information that an Inland Revenue officer must maintain, and must assist in maintaining, the secrecy of under section 81 of the Tax Administration Act 1994; (b) information relating to national student numbers assigned by the Secretary of Education under section 343 of the Education Act 1989 to students enrolled with a tertiary education provider;”. Then there is the inclusion in here that the select committee did, and this was one of the changes that Labour pushed for at the select committee and was very pleased to see included, clause 111(ba): “information relating to an adoption held by the Registrar-General appointed under section 79(1) of the Births, Deaths, Marriages, and Relationships Registration Act 1995;”. Then under clause 111(c), the definition of restricted information also includes “photographic images used for driver licences that are stored under … the Land Transport Act 1998.”

What I would like to know as this legislation progresses is whether or not there is an ability to add to this, or whether this is an absolutely exhaustive list that is contained within the legislation. As we saw at the select committee—as the Labour members of that committee identified—information that is collected under the Births, Deaths, Marriages and Relationships Registration Act is information that should be restricted, but I think as the passage of this legislation is put into play, it could well be that other sets of information may also be seen as desirable to restrict. My question for the Minister is whether it is by amending the legislation and coming back to the House and doing an amendment on the floor of this House that we will have to do that. These are questions that would—

I want to acknowledge the Minister, Chris Finlayson, and thank him for the considered way that he has answered many of the questions that have been raised by members in this Committee. He will appreciate that, for many of us, this is the first time we are getting to have a look at the contents of this particular bill. I therefore want to draw his attention to clause 102, with regard to direct access to data information. It says that the purpose of the subpart is to enable an agency to have direct access to databases storing specified public sector information. I ask the question whether—and just thinking along the lines of public sector information—that would be information that would be gathered when I go in to get a driver’s licence. I suspect it would be information that would be gathered if I was renewing my passport. I suspect it would be information that would be gathered by local government if I was paying my rates.

Many of us, while we are engaging with the relevant Government department, will not know that, based on this legislation, the intelligence agency can now access that information. So what is the preparation that needs to be done in order for the general public to realise that any time they are engaging with a public Government department and information is given to a Government department, potentially that information can be seized by an intelligence agency. I refer to clause 104, “Matters to which Ministers must have regard to before entering direct access agreement”. In paragraph (b), it says that there are adequate safeguards to protect the privacy of individuals. I am not sure, having not participated in the select committee, whether those safeguards are the following clauses: clause 105, consultation with the Privacy Commissioner and the Minister responsible for the holder agency and the Minister responsible for the intelligence and security agency, who give authority to that. Is it consultation with the inspector-general before entering into a direct access agreement? Are those safeguards that he refers to in clause 104(b) adequate safeguards to protect the privacy of individuals?

My concern there is that there is a lot of power being given to this agency, and when we are giving the intelligence and security agency direct regard to have access to that information, it also includes information or activities that would be deemed illegal, as we heard in the previous part. Could not one of the safeguards be that—particularly when there are issues that could be of concern to the entire nation—those matters be tabled in this House? With so much power being given away, particularly to two relative Ministers, it just—and we are talking about the safeguarding of the privacy of individuals; individuals who may not have known beforehand that when they are engaging with a Government department, handing over their personal information to access a driver’s licence, a passport, whatever the case may be, under this legislation all of that personal information can now be accessed by security intelligence.

The other thing that I also just want to draw the attention of the Minister to is the fact that in clause 112 we are now including a New Zealand citizen or a permanent resident of New Zealand. Clause 112(2) states: “An application for permission must be made to—(a) the responsible Minister and the Chief Commissioner of Intelligence Warrants, if the person is—(i) a New Zealand citizen; or (ii) a permanent resident …”. I think there will be members of our communities who may be very worried about that, because when this debate started, there was some concern. There was an argument put forward that accessing information—

It is a pleasure to speak to Part 5, and can I begin by thanking the Minister in the chair, Chris Finlayson, in general terms, for his willingness to answer questions throughout this Committee stage. I think a number of my colleagues who have not sat on the Foreign Affairs, Defence and Trade Committee have posed questions because, I think, they are important ones to answer, in and around this important piece of legislation. I thank the Minister for his willingness to answer some of those questions, despite the ignorance of some of the members who are asking them—myself included—so I thank him for that.

My colleague Megan Woods has already spoken to clause 100. But I did want to ask the Minister in respect of clause 108, “Review of agreements”, where it says: “(1) The Ministers who have entered into an agreement must review the agreement every 3 years. (2) In conducting a review, the Ministers must—(a) consult—(i) the Privacy Commissioner; and (ii) the Inspector-General; and (b) have regard to any comments received from—(i) the Privacy Commissioner; and (ii) the Inspector-General.” My general question to the Minister is: how does he, as the Minister who will be responsible for this, see the role of consultation and also having regard to comments received from the Privacy Commissioner and the inspector-general?

I have been speaking to my colleague here, David Parker, and he and I both assume that consultation principles outlined by Justice Blanchard in the Wellington Airport case will apply in this instance. I am not sure whether the Minister in the chair heard that, but I think he would probably agree, because consultation can mean a lot of things to a lot of people. Consultation, in its nastiest sense could be: “I’m telling you this and that’s all I’m going to tell you.” That is one sense of consultation. Or you could take the opposite end of the spectrum and have a deep and meaningful consultation process, as I would hope would be outlined by the Minister, who I think is preparing to take a call on this.

The Minister, at the time, was talking to officials, and I and David Parker would assume that the consultation principles, in the sense, within this bill, will be the same as those outlined in the Wellington Airport case with Justice Blanchard, as I am sure you would agree. Ha, ha! So I would be willing to from the Minister in that case. But I think, again, having not been a member of that select committee, when we are talking about reviews of pretty important agreements and information that will flow between agencies and other entities, just how will those agreements work—the ability to bring in the Privacy Commissioner and the inspector-general, and also how are those comments or the consultation with those two entities going to be taken into regard? Because if the Minister was of the mind to just read them and say that they have been taken into regard, I am not sure whether or not that is the spirit of what would be intended—from members from right around this House. But I do not know that, because I am not the Minister, and I was not at the Foreign Affairs, Defence and Trade Committee.

So if in the fashion that he has taken so far during this Committee stage, the Minister might be able to inform us and inform the public about how he would hope to see, ideally, himself and other Ministers who have this power to consult and take regard to those reviews, that would be, I think, good for the public.

I can assure the honourable member, Kris Faafoi, that the general principles of administrative law will apply when it comes to consultation. It is not going to be pro forma consultation. Consultation, to be valid, has to have an element of genuineness to it, an element of openness of mind, and being prepared to change your preliminary view as a result of that, and so nothing in the legislation is going to derogate from that responsibility on any person who consults.

💬 Hon David Parker: Did he get his case reference right?

He got his case reference right. I think he probably got his judge wrong, was it not Justice McKay? But anyway—

💬 Hon David Parker: No, no—Blanchard.

It was Justice Blanchard—well, then I am very proud of Mr Faafoi.

I do not want to, sort of, chill the works, but I have been giving a lot of thought—because, initially, my inclination was to support Miss Curran’s proposed amendment, but I have had a good look at it and I actually do not think it is necessary, for the reasons that I will now elaborate on. If one looks at the registers that are established under clause 101A and also clause 118K(3), one sees that both the Minister and the inspector-general can access the register, and so the issue arises of whether the Privacy Commissioner should be able to do the same.

I think the answer is provided by section 72B of the Privacy Act 1993, which deals with the referral of a complaint to the Inspector-General of Intelligence and Security. If the Privacy Commissioner receives a complaint under this section that is more properly one within the realm of the Inspector-General of Intelligence and Security, then section 72B(1) provides that the commissioner shall forthwith consult with the inspector-general in order to determine the appropriate means of dealing with the complaint. Then the commissioner would determine whether or not the complaint should be dealt with in whole or in part. So I think that what would happen, if there was any issue, is the inspector-general would consult with the commissioner and could well take over the particular complaint herself—that is provided for in section 72B(3).

With respect, I can understand exactly the rationale for the proposed amendment, but, in terms of the Privacy Act arrangements, I do not think it is necessary, because either the commissioner would do it or, if it was felt that it needed to be done by the inspector-general, then, in terms of that particular section, that could be done that way.

The question was put that the amendments set out on Supplementary Order Paper 264 in the name of the Rt Hon Bill English to Part 5 be agreed to.