Urgent Debates — Social Development, Ministry—Report of Privacy Commissioner into Collection of Client-level Data from NGOs

I have received a letter from Carmel Sepuloni seeking to debate under Standing Order 389 the Privacy Commissioner’s report Inquiry into MSD Collection of Client-Level Data from NGOs. The release of the report is a particular case of recent occurrence. The report deals with the activities of the Ministry of Social Development, for which there is ministerial responsibility. The Privacy Commissioner raises serious concerns that the collection of NGO client data will “deter some people who are most in need from seeking support or assistance”. The commissioner recommends that the ministry take an alternative approach that is not inconsistent with privacy principles. Having carefully considered this application, I believe it requires the urgent attention of the House. I therefore call on Carmel Sepuloni to move that the House take note of an urgent matter of public importance.

I move, That the House take note of a matter of urgent public importance. We are here considering and debating urgently today the inquiry that has been undertaken by the Privacy Commissioner on the Ministry of Social Development’s collection of individual client - level data from NGOs, because of the fact that there are damning recommendations in the Privacy Commissioner’s report against the Government, and because the Government, a year ago, despite being warned—despite having all the social services out there telling the Minister that this was not going to work, telling the Minister that collecting this data would deter people from accessing their services or from going there for support, telling the Minister that this was not the right thing to do—the Minister ignored all of those voices. The Minister ignored all of the experts in the field, not only the social services but academics advising against it, and people who were accessing the social services for support saying that they would not go to those social services if this went ahead. The Minister ignored all of that and now here we are, and she is trying to fix it after the fact.

The biggest issue that comes out of the Privacy Commissioner’s report, I think, is that even though the Minister has said that this client-level data collection will be all about making social services more effective, it will not make it more effective; it will deter the most vulnerable people from accessing support. The Minister has gone ahead and said: “No, people won’t be put off.” She has even said publicly that this is not sensitive data that is being collected. She said that on Radio New Zealand this morning. Well, actually, if a woman goes to a women’s refuge with her children and all of their names, their addresses, and their dates of birth are then passed across different ministries in association with having gone to the women’s refuge for support, then that is sensitive information.

The Minister has said that it is not sensitive information and that it will not deter people from accessing these services, and yet we see in the report that a provider who deals with male survivors of sexual abuse had 17 of its clients say that if this data was to be collected and shared in the way the Minister is proposing, then they would not go to that service for support. How can she say that it will not deter them from accessing support, when we have got all the evidence to show that it actually will?

I think one big statement in this report that we have to take on board is that the Privacy Commissioner has said that the Government’s agenda of collection of individual client - level data from NGOs is actually not in the public interest. I think that is a really important note to keep in mind, because, actually, everything we do in this House should be in the public interest. So when the Privacy Commissioner tells us it is not, then we need to hold up and check ourselves, and think whether, actually, we should go ahead with this.

The problem is that the Minister did not think this through carefully from the start. There was no privacy impact assessment. So here we have the Privacy Commissioner having to undertake an inquiry, after the Minister has already started it. Now she has said that she is going to hold up, with regard to the portal—that she has shut it down because there have been security breaches. But she went ahead with this already. It is not like the information is going to be collected from July. There are budgeting services and other services that were already expected to collect this information, as of last year.

We see in this report too, which was timely, that the Privacy Commissioner has pointed out the fact that if the ministry is to do this, then we need to make sure that whatever portal—however we hold this information, we need to be assured that it will be secure. The report came out yesterday, and just the day before, we saw that the portal is not secure. The Minister is now trying to tell us that it is not her fault, that she is annoyed at whoever created the portal and gave her the assurances that it was safe. But, actually, the buck stops with the Minister. She cannot blame it on the people who created the portal, because she is responsible for it. She should not have gone ahead with pushing ahead with this agenda if she did not know that she had the systems in place to protect the information. We saw in the last couple of days that there have already been breaches.

The problem is that the Minister has given us assurances in the House, time after time after time, that the ministry has all those measures in place to assure the public that their data will be protected. But how can anyone in here, let alone out there in the public, believe that, when we have seen privacy breach after privacy breach under this Government’s watch?

It is not just through the IT systems where we see breaches. We have seen people being able to access other people’s information through Work and Income kiosks. We have even seen the former Minister for Social Development purposely—on purpose—leak the information of two solo mothers, in this House. So how can we trust that Government with any client-level information? The Minister is trying to say here that she can assure us that there will be no level of matching the data collected here with anything else, like Work and Income. No one believes her. We do not believe her at all. It is about the fact that people will be deterred from accessing the services. It is also about the fact that they do not have the systems in place to be able to provide an assurance that they can protect people’s confidentiality and privacy.

It is also really interesting to see that the Privacy Commissioner has said that the data they are looking to collect will not actually assist them with being able to provide any better services than what they could do if that data was anonymised. So he has actually said that it does not need to be collected in the way that they have asked. He has made it really clear that it could be anonymised information that is run through Statistics New Zealand, through the Integrated Data Infrastructure, and that way people’s information would still be private information. It would still be protected, and the Government could get the information that it wants.

My real concern here is that the Minister is trying to say on Radio New Zealand and through the media that it is about coverage. She is trying to say that it is about making sure everyone has access to the services that they need. But I actually think that the truth is that it is about denying people access if the Minister or that Government think they have had too much help from social services. They want to be able to draw a line and say: “Actually, you’ve had your quota of help. Go away. Help yourself.”

That is not the responsible thing to do, given we know that in many situations families do have to seek the support of more than one social service, for a range of reasons but usually because they have such complex needs that they cannot get them met by just one social service. The Minister is trying to be a bit sneaky here, making out that it is about providing more effective services. But it is not about that; it is about cutbacks.

I want to move to that because I think that this is one of the big points that needs to be made from this. The Government, not just the Ministry for Social Development but the Government—and this is Bill English’s pet project—has been pushing ahead with its social investment approach. We know it is heavily underpinned by the collection of data—data like we are talking about here. This really throws a spanner into the works, with regard to the Government’s social investment approach. It has been pushing ahead with this social investment approach, and if you read anything from Bill Rosenberg or Michael Fletcher or anyone who knows anything who has written about the Government’s social investment approach, you would see that it is not about long-term outcomes. There is no cost-benefit analysis, in terms of social costs or financial costs for us as a country, moving down the track. It is about short-term cost-saving measures.

This illustrates that social investment approach very clearly. It is not about ensuring that families are better off in the long run; it is about the Government’s attempt to save money by cutting funding to the social services and cutting access to social services in the short term, so that in 1 or 2 years’ time it can say: “Hey, look, we’ve saved a couple of million dollars here.” Meanwhile, down the track, we are going to have to spend more money because the families who need support are not getting the support that they need under that National Government.

The three things that I have raised so far are, firstly, the big issue that people will be deterred from accessing social services; secondly, that the data the Government is seeking to get through this system is not necessary, as the Privacy Commissioner has said that, actually, it can get just as useful information if it is anonymised; and thirdly, that it does not have the security measures in place to be able to collect and store this information. This move from the Government is not in the public’s interest at all. That is the most important thing.

I want to go back, again, to the fact that we have seen so many social services come out concerned about this move. They have their backs against the wall because they have, basically, been held to ransom by that Minister with regard to their funding, and have been told “Like it or lump it.”, with regard to the insertion of these provisions into their contracts. Important services, like the Women’s Refuge, are told: “We don’t care if you think this will deter women and children from coming to you for support. You will give us that information regardless, or you will not get the funding.” What choice do these organisations have but, in many instances, to just say yes, because they know that they provide such important services and that they have to exist despite the fact that they are going to be expected to pass on this information?

The final point that I do have to make about the Privacy Commissioner’s report is that he has pointed out that because of the conditions in which the Minister and the Government are expecting this information to be collected, it actually risks that information being skewed and unreliable. That is because you will have a whole lot of people, firstly, who do not want to go and seek the support despite needing it. Secondly, you will have organisations that are not necessarily going to report on every case, because they are worried about the fact that they could share this information and it could be passed on. The information you would want the Government to have be reliable is at risk of not being reliable because of the unreasonable expectations that the Minister has placed on these organisations.

She has ignored the budgeting services. They went ahead—they were the first ones to have this put in their contracts last year. She has ignored the Women’s Refuge. She has ignored the addiction and mental health organisations that have raised concerns about this, and problem gambling services that have an issue about this. She has ignored it to her own detriment, because now we have here a report that states really clearly that, actually, the Government should not be able to push ahead with this, given the concerns that have been raised.

We had been raising concerns about this as soon as it came to light last year. I will not put all the blame on the Minister for Social Development, because we do have to acknowledge that this approach is all part of the bigger social investment approach of the Government, and the person behind the bigger social investment approach is actually Bill English. The big data-grab agenda is all about Bill English. So it is not just the Minister who is at fault here; it is the leader of the National Government who is at fault here. That is not leadership—when you do not do the checks and balances before you follow through with an agenda. It is a clear case that not only the Minister for Social Development has failed here. The leader, our Prime Minister, has actually failed in this regard as well.

I make no apology for wanting to make sure that the most vulnerable in our communities get the services from the Government, which the taxpayer funds, that will help them live better lives. I make no apology for that. I went to a meeting with a group of NGOs working in a small poor rural district a couple of months ago, and the telling thing for me was that as they talked about an individual family, they asked people in the room to stand up to represent each of the agencies that was working with that family. There was a room of something like 30-odd people, and something like 18 people stood up as they called the roll call of the agencies working with that family.

I do not know about anyone in this House, but I sat there thinking this family had high, complex needs. Some people might call the family dysfunctional, but there were six children in that family and all of those people in that family deserve to get the services to help them live better lives. But how could they deal with all of those agencies parked up their driveways, all with good intentions, trying to give the services to them? This organisation that was talking to us had formed a group that got together, shared information, and designated one person to develop a relationship with that family and to organise all those other agencies.

What I am describing is the way that children’s teams work around this country. What I am describing is the way that many iwi social services are working around this country. I am describing the way Whānau Ora works around this country. In order to do that, and to work in that way, which we know is effective and we can prove is effective, we need to be able to share that information. So this is not something to be afraid of. It is not to be used as a weapon. It is not to be used as a way to punish people. This is a way to share information so that families can get the help they need without having to have that sort of complex assistance adding to their dysfunction.

This Government spends $330 million every year on social services out in our communities. Hand on heart, I cannot say that that $330 million is effective, because I have no way of judging that. In fact, family violence is on the increase. The number of children in State care is increasing. The number of children being abused is still increasing. The number of families that are in dysfunction is still increasing. So that $330 million every year is clearly not effective, and the Privacy Commissioner, in his summary, makes a point—[Interruption]

💬 Mr DEPUTY SPEAKER: Order! The member has already had a very high-volume, 15-minute contribution. I would appreciate it, if she is going to have another one—she gets another right of reply; oh no, she does not, thankfully. But anyway, later on in the night—[Interruption] I am on my feet. I am on my feet. You can, at some stage, seek whatever you like. The House will be in charge of its own business. However, the member made a very strong, impassioned statement. It is being responded to. She has had her go. The odd, well-timed, well-intentioned interjection is part of the play of the House. I suggest that she stick to that convention.

The Privacy Commissioner states in his executive summary that “it is not only legitimate but important that Government takes steps to ensure the efficacy of any programme it funds. It needs good information in order to do so.” So the question then becomes: what information is required?

I agree with the Privacy Commissioner’s first recommendation, which is that if we were looking only for the effectiveness of the programmes, anonymised information may well be enough. Unfortunately, that is not all we are interested in. We have heard a lot about the people who might not come forward. There are assumptions that people might not come forward if they know that their information is going to be shared—not their personal information, but the details of who they are and the shape of their family—with the funder, which is the Ministry of Social Development (MSD), or, as it will be in the future, the Ministry for Vulnerable Children, Oranga Tamariki. But nobody has talked about the people who are getting no services and no coverage whatsoever, and nobody is talking about the family that I have just been talking about, where 18 different agencies were providing services to that family. That does not make sense. That is not a good use of taxpayers’ money and, actually, it is not helping the most vulnerable people.

So what we would like to do, and what we are proposing to do, is to gather information on who NGOs are working with, so that we can see that we have good coverage. You cannot do that with anonymised data, so, unfortunately, in my discussions with the Privacy Commissioner, I have tried to explain to him that we do need to know whom we are working with. I have said to him that if Statistics New Zealand can provide a way to give us that information, I would welcome that. Unfortunately, to date, it has not been able to do that.

His second recommendation I have certainly accepted, and I have asked MSD to find a way to create an exemption. His recommendation is that it must ensure that our “information collection practices do not deter vulnerable individuals from receiving necessary help.”, and nobody wants to deter people who need help.

So, yes, we are designing into this system an exceptions regime, so that NGOs—and I have to say, most NGOs that I have talked with receive not only Government funding but also receive much philanthropic funding. So there are opportunities, and I have talked with some NGOs that have said: “It is very simple. You only want information on the people whom the Government is funding. We have opportunities to work with people in a different way, and we may well take advantage of that.” But I have heeded the recommendation of the Privacy Commissioner, and we are developing an exemptions regime for a certain percentage.

His third recommendation is that we “must ensure that the purposes for collecting, holding, using, and disclosing information are specific, relevant to [the] functions, and clearly conveyed, and the information is necessary to achieve these purposes.” That is incredibly important, and I have asked MSD to make sure that people know exactly what we intend to use this data for.

So it is not for matching, and it is really mischievous of people to go around telling vulnerable people that their information is going to be shared with Work and Income and they might lose their benefit. That is outrageous. It is absolutely outrageous to say that to people, because there is no intention—absolutely no intention—to share that information in that way. It is designed to make sure that we have the right people receiving the right services at the right time.

💬 Sue Moroney: And to deter them from getting them.

Oh, absolute nonsense. We want—

💬 Sue Moroney: That’s what it is.

You would not be talking about coverage, and you would not be talking about identifying gaps and duplications, if you wanted to deter people from getting services. We want to help our vulnerable families, unlike those people sitting over there, who do everything they can to stop people getting these essential services. Those members are full of talk, and when it comes to what is actually happening on the ground, they are absent. They love making a noise, but they hate actually going out and doing the work themselves.

Then the fourth recommendation of the Privacy Commissioner is to “ensure that its security procedures for holding, using and disclosing ICLD are robust, well-documented and transparent.”, and I agree with him, 100 percent—100 percent. That is why I said to MSD, “This is unacceptable. This is not acceptable. You’re going to close down all of that portal and you are going to start again.”, because none of this can be achieved if we do not have security of the private information of these people.

So I want to say that this Government is absolutely—the evidence is clear that by using good information, intervening early and effectively in families’ and in children’s lives, but, more importantly, working collectively not just with NGOs but also with Māori organisations and iwi, I am confident that we can make a difference in New Zealanders’ lives. I am confident we can do that. We are seeing that already with organisations like the children’s teams making huge changes in families’ lives, but they do that only where they share the information. If I refer to the two family violence trials that are happening currently—one in Christchurch and one in Waikato—the essence of what those trials are showing is that the sharing of information shows us a much broader picture.

One of the stories from the children’s teams is pertinent, I think, in that they found 12 different agencies had been working with this family over a period of time—quite a lengthy period of time. Yet it was not until that child was referred to a children’s team, a lead professional was appointed, all the other agencies were cleared out, and a relationship was developed with the family that we actually found that at the heart of the dysfunction was family violence. So sharing of information leads to better decisions about what services are needed for those families. Social investment is a way of working that is proving to be effective with our families, but it is only as effective as the information that it is based on, because if you have got only half the story, you can only ever give half the answer. In fact, I would suggest that you cannot give even half the answer, if you have not got all the information.

Finally, I would say we have some superb NGOs in New Zealand. They do a tremendous amount of work and there is no intention to cut back any of the $330 million that MSD spends every year on community-based services. But we do need to know that everyone who needs the services is getting the services that they deserve that will make a difference for them, and in order to do that we need to share data, and in order to share data we need to have the trust and confidence that that data will be respected and will be protected. Thank you.

I have got to say that I read this report, which I think can be fairly characterised as a damning report, with a lot of discomfort, and it raised many questions for me. Some of the questions are about how we got to the point we are at at the moment, and other questions are about where we go next. So I just want to address some of the questions that were raised for me by the report, about how we got to this point.

What this shows us is that, in the words of the Privacy Commissioner, a system was put in place prematurely, without adequate consideration of privacy risks or mitigation of those risks. And it is not as if the Opposition and the community organisations that were being told they had to do this had not raised concerns about these issues. We have been, since at least October last year, and we have had in response from the Minister for Social Development constant assurances that there is nothing to see here, that Opposition members and community organisations and the public could have absolute confidence in the roll-out of this individual client data information-sharing, that we should just trust in the process, and that the Ministry of Social Development (MSD) was on to it.

Well, this report tells us that, actually, we are validated in our concerns—that already there has been a privacy breach, and that the basics of oversight were not done. The Privacy Commissioner said that he would have expected a privacy impact assessment to happen before this process was initiated, in order to consider what the privacy risks might be and how they could be mitigated. But that work is still not completed. This is something that was started in March last year, and we have had assurances that this Government is all over it and that it is holding privacy concerns and keeping strong oversight of that.

Yet the absolute first step was never done, and has still not been done. The Privacy Commissioner was briefed on the intention for this programme in June last year, and the Privacy Commissioner was told at that time that there was going to be an ability for sensitive services to opt out of sharing this individual client data and that it was going to be aggregated data for research purposes. Then somehow, between June and December, the actual plan changed significantly, to the point that in December it became clear that the policy intent was then for individual client data to be able to be used for sharing and matching with other agencies. And this is quoting from the Privacy Commissioner’s report—this is not me being mischievous; this is not a misrepresentation of what the policy is. And we—I will speak for myself—have never insinuated that that may have been matching or sharing with Work and Income. It was with anyone, because the initial intent was that it would be anonymised data for research purposes, and that changed. It does not seem as if the Privacy Commissioner, who we have been told has been kept in the loop along the way on this, was told of that change, which is a fundamental one. It is a completely different policy with significantly more privacy risks. It does not sound as if he was told, and if he was—well, we can gather from the Minister’s answers this afternoon that the Minister never checked to see whether the Privacy Commissioner was told or what his response to those changes might have been.

So we have a very significant issue, and I would say it is one of competence for a Minister. We have a Minister who has come to this House repeatedly giving us assurances that the privacy of individuals would be protected, and yet she did not ensure that a privacy impact assessment was done, and she did not check to see whether the Privacy Commissioner had been informed or what his response was to a massive, significant change in the policy. She cannot even have found out the method for collecting the information in that first stage, because surely—surely—the fact that MSD was collecting information through a spreadsheet would have raised alarm. Then, I would have thought it would raise alarm to hear that MSD was planning on collecting individual data information via spreadsheet. And then, if we will just give her the benefit of the doubt for not having asked that question—which, again, is a competence issue, but just say we let that go—she got this report, or surely would have asked around some detail of that data collection in that initial stage from her briefing, or expected that from officials, and found out that the Privacy Commissioner said that this is not secure and identified significant risk, yet she waited until there was a breach before she stopped collecting that information.

This was despite significant clear, direct warning that the method that was being used was not secure and not safe. That is a massive confidence issue, and I think it should be worrying everyone in this House, as well as the public, because if we are to have faith in the process going forward, if we are to have faith in the protection and the well-being of New Zealanders, then we need to know that the Minister who has oversight of such significant reform knows what questions to be asking and will be making sure that she is getting the right answers. If she does not know what questions to ask, if she is not actually making the effort to ask those questions, then how can we be sure that there is going to be safe implementation of such a radical policy? We cannot be sure.

And that brings up some of the other issues that we are seeing, and the inconsistencies I heard from the Minister earlier, where she was saying that, yes, they need to collect the individual data, because without it they cannot be sure that people are getting the right services. She quoted examples of the children’s teams and Whānau Ora, as if those systems do not have information-sharing capability at the moment—they do. There is no actual translation of how that could translate to knowing whether an individual is getting the right service if that information is going to some data analyst sitting in an office in Wellington, and they still have not given agencies an assurance that there will be no adverse consequences for people from that information being shared.

It has identified that there will be the ability for MSD to share that information with the Ministry of Health, the Ministry of Justice, and the Ministry of Education. Within MSD, the Minister also mentioned Oranga Tamariki. We know at the moment that people are not accessing healthcare—I have been told of several examples of victims of domestic violence not accessing healthcare services because they are scared of reports going to Child, Youth and Family, and losing their kids.

So here we have a very valid concern that people will potentially not access services if information is being shared in that way. Yet the Minister has given us no assurance that that will not happen. It has not been said. We are hearing that it is about making sure that services are not being duplicated or that people are getting the right service. That gives an indication that, actually, if that is to be relevant or meaningful, they would actually intervene if they found an individual was not accessing a service, and go to them and tell them “We think you should be accessing a service.”, or, if someone is accessing many services, they are going to go in and try to reduce the number of services they are accessing. If people have chosen to access those services, then that is an adverse outcome, I would suggest. The Minister is saying that it needs it for the information to be meaningful, but now it is going to bring in some exemptions—but if it is not complete information, then, again, how is it meaningful? If it is saying that it is not going to collect it all but it needs to know whether everyone is accessing it and whether the services are going in the places they need to, but it is only partial information, then, again, how is it meaningful? How will it achieve the goals that the Minister is saying it will? Again, it raises significant issues of competence, and we have no ability to be secure that people will have their rights protected.

Before I begin, I just want to pick up on a couple of things that the Minister for Social Development said during her speech. One of them was that she talked about vulnerable kids and how important it is that the organisations support those vulnerable children and find the best way of doing that. Nobody in this House is going to disagree with that. The disagreement that we have as a party—and as a collective Opposition, I guess—is the process by which the Minister wants to achieve that. It is the fact that since day one of this new implementation process and all of the overhaul and legislation going through the House that the Government wants to do—we have said from the start that we are concerned with the processes that the Government is going through, and how on the one hand the Minister can stand up, with what have been proven to be empty words, trying to convince us that everything will be OK with the data collection specifically, and then the results are obviously quite the opposite.

One of the things that the Privacy Commissioner actually said in his report was that the Government runs the very real risk of not only losing the trust of the clients who want to use the services of the Ministry of Social Development (MSD) but, actually, the people of New Zealand losing trust in the Government—and that is exactly what has happened.

The second thing that the Minister said was that “none of it can be achieved if they don’t have security”, and she was mentioning the data collection or the system that they were using, and that is why she shut it down. She said that none of it can be achieved if they do not have security, and if she is saying that today, that means she must have known that it was the case previously. So why has it got to this point in the first place? If she knew that security was of paramount importance, if she knew the consequences if that security were breached or if that security were questioned, then why did she not go and ensure that the ministry—and all her officials in it and everyone else throughout the ministry—went through the processes that ensured that this situation could not occur?

I do not think it is any coincidence—well, I guess it is more of an irony—that the day the Privacy Commissioner released his report was the exact same day that there was a privacy breach that occurred. I think that just highlights the entire issue. I think it is a very important issue, which the entire Opposition has been talking about for months, and this is a good opportunity to speak about it.

This whole, entire situation is just a culmination and a manifestation of the utter arrogance of the Government. It establishes and shows just how out of touch and disconnected the Government is—especially the Ministry of Social Development and the Minister for Social Development—with the reality of the provision of essential services at the grassroots. It has been mentioned before, but just a few weeks ago Rape Crisis came out and said that it is not going to accept any more funding if this data collection keeps going, because of the fact that it knows that the most vulnerable people it works with will not give their data and that it will not be able to provide effective services to those people. That is the reality, the day-by-day reality, that those people on the ground are dealing with. What this example shows, and what this situation that we are talking about today shows, is that the Minister and the ministry and this Government are so far out of touch with the reality of what is happening on the ground today—every day.

The entire premise of what the Minister stood up and said about data collection—and I am sure it is what members of the National Party have been given notes to talk about—is that no matter what they say, this entire thing is just ideology. If we have a look at the actual facts of the matter, if we have a look at the consequences of where things go wrong and the processes where things go wrong—because they have gone wrong already—you can see that it is not based on fact. It is just ideology. The biggest problem that this Government has is that the data-collection processes and the ideology with which they are moving forward are the absolute foundation of the social investment approach. It is using the social investment approach carte blanche across the entire social service, and that, in itself, is based on ideology and not on facts.

What the Government members like to try to hide behind is standing up in the House every day and saying how well they are doing with their Better Public Services targets, how they are achieving them, and rattling off a whole heap of information and data, with no context whatsoever. When you start digging deep down a little bit more into the Better Public Services targets they mention, you can tell that they are failing. If this philosophy of the Government had been actually working over the better part of the last decade, then why are the most fundamental things that are intertwined into the social fabric of our country failing? I am just going to list a few of them: youth crime is up; homelessness is up; child poverty is up; youth unemployment—the “neet” rates are increasing exponentially—is up; house prices and living costs are up; domestic violence numbers are up; and child abuse is up. If this philosophy was working, if this social investment approach was working, if this approach that this Government has to social services and the provision of social services was working, then why are all of the fundamentals in the “bad” columns up?

But do we hear about that stuff? No, all we hear about is the targets. If the targets were working so well, then why does this Government not actually get them audited? Why does it end up setting them itself and reviewing them itself, and then Government members stand up in this House and say how much they actually achieved?

Today, before I came into the House—because I pre-empted, a little bit, the urgent debate—I asked the Parliamentary Library to gather the number of privacy breaches or complaints that have been reported, just over the last 8 or 9 years. Just reported ones—just reported ones. This is in the media, so this is just the tip of the iceberg of what has happened. You can see it is quite a large stack of papers. It is in the vicinity of 40 to 60 breaches or complaints over the last 8 years. If the Government was very serious, was taking this data collection seriously and ensuring and understanding, like the Minister stands up and says, the importance of the security of that data collection—with the history that MSD has of not being secure, you would think it would want to get it right.

Just in the last couple of minutes, I would actually like to go through the most important part of the report that the Privacy Commissioner has released, and that is the conclusion. He has seven points, and I will just briefly go through a few of the most important ones. The first one, he says, is that “Implementing a significant new information gathering policy without sufficient evidentiary basis and without adequate consultation amounts to a serious deficit in the policy development process.” That is the first one that he says in his conclusion.

The second one is: “My view is that MSD has executed the collection … prematurely without adequate consideration of the privacy risks involved and appropriate mitigation of those risks.”

The third one goes on to say that this policy that the Government wants to implement is a new direction for the Government, and it needs to proceed with caution. There was, again, an inadequate development process through this entire process.

One of the most important points—there are seven, but one of the most important points is where it says that “the success of MSD’s policy is in jeopardy.” This entire policy is in jeopardy. “The reach of these consequences are not limited to MSD and could threaten individuals’ overall trust of the Government”, which is what I was saying before. Like I said before, it is a bit too late for that.

There are a number of issues that, unfortunately—I guess the most unfortunate part is that New Zealand First and the other Opposition parties have stated from the start of this entire process that we were concerned with the way in which the Government was approaching the big changes that it wanted to make, for the right reasons. We stated that we had issues with the process and that we had definite issues with the data collection, and the extent and the purpose of that data being collected. Unfortunately, it has come to a head this week. We have had a privacy breach, and we have had the Privacy Commissioner come out with some very, very serious concerns.

This is not a bad report; it is an ominous report for the future direction that the Minister and the ministry want to take social services. I think that the Minister needs to sit back and have a real rethink about the entire direction of the social investment, but, in particular, the data collection part. Thank you.

Is it—just checking. Yes? Thank you, Mr Deputy Speaker—I was just a bit unsure whether it was my call. But I am honoured to take the call this afternoon, addressing this issue with this debate. This debate has been raised because there are concerns. It is a valid debate that has to be had because it is to do with the issues around the care and concern of our communities. It is a valid debate—that is why we are here today. It has been raised, and there are concerns in regard to information that is required.

I just want to remind us that with this debate, we have been talking about the genesis of this debate—the whole theme and thrust of the social investment approach. At its heart, and at its core, it is about two key things. The first thing is about data and evidence. We want to know that the fact is that we are asking the right questions. If we are investing or if we are putting taxpayer funds into the appropriate approach, whatever service it may be, do we know we are getting the right return? That is a question that every single New Zealander would want us to be held accountable to, and that is absolutely the right thing.

The second thing about the social investment approach is that it is about investing early. In other words, early intervention and prevention is the key to ensuring that we address those issues of concern, and that is at the core heart. So regarding the concerns that have been raised about the social investment approach, I think and I believe that all New Zealanders who are listening here today will agree that those are appropriate questions to ask. That holds us to account and makes sure that we are asking the right questions. But, more importantly, are we using taxpayer funds, which are given to us to be held to account, appropriately and in the right way? That is critically important as well.

There has been some talk about the fact that in this, and especially the issues around the Privacy Commissioner, which he has raised—I want to just remind the House, and those who are listening, that this relationship with the Privacy Commissioner has been one that we have welcomed, and we have ensured that the Privacy Commissioner has been a part of the process and also engaged in all parts of this development. We know that in December of last year he was invited to a workshop with other key officials and other key stakeholders. We talked about the importance of the approach that we were taking. We have not discounted the issues that the Privacy Commissioner, by right, in his role of responsibility, has taken. He has asked us to ensure that we are accountable. He has asked us to ensure that we protect the privacy of that information and that we have taken it seriously, hence the reason for the report. We have welcomed the report. It has identified four key issues. The Minister for Social Development has talked about those issues, three of them in particular, which we have addressed. We have talked about them and we welcome them, and we think that they are absolutely important.

I know that my colleague and friend over there, Mr Darroch Ball, has actually gone out to the library to seek information about breaches. But one of the things he may not have done is gone out and talk with the people in the community—the key stakeholders, the providers. I have been out there to talk with them. Why? It is because it is not just about sending officials out; it is about the face-to-face conversation. Why? [Interruption] That is right—you may not want to hear it, because it did not come from the library. You may not want to hear it, because it came from outside of your Google and Wikipedia. This was a face-to-face conversation to talk about the issues that we are taking. We talked about Oranga Tamariki. We talked about the approach. Was there a concern? There were no concerns with where the Government was going. We talked about the inclusion of the voices of young people—having an opportunity where their concerns could be heard. For the first time, under this Government, we have an NGO that has young people who are at the heart of this, so that they can have their concerns right at the heart of Oranga Tamariki. Then we also talked about the importance of them engaging, as the whole of New Zealand is—looking at what is important. It is a “whole of” response that we took.

Yes, I will admit that the issue of concern that was raised—and I will put this in context—was about client-led information. People wanted to know what the information is for. What is it going to be used for? As we began to discuss and talk about this, there were similar concerns that were raised by the Privacy Commissioner in regard to who will use the data and how it will be used. There were concerns by other NGOs, who said: “Well, will people stop from sharing their data if they know that they will not sign the privacy waver?”. They had valid questions to ask. So what was important, and what has been done by both the Minister and the department, was to walk step by step through that with the people. No one disagreed with the intent, or the direction that we are going in. No one disagreed.

But the fact is that we need to know that we are holding ourselves to account. We need to know that the services that we deliver—let us think about Diane Robertson from Auckland City Mission. I talked about this at one of the NGO meetings. In her research, she talked about the 100 clients that she had. She talked about the client data that came out of that, in which they found out that in one case, with one family, there were 22 organisations that they had to contend and deal with. In the end, because there was a lack of information, there was a lack of appropriate response. They did not get the help that they needed. Surely that is enough for everyone in the House to be able to say this: we need the right information. But the concerns are right: we need to do it carefully. We need to step through this appropriately. We have done that. We are doing that. So for all the talk and all the discussion here—from the face to face with NGOs in the community, the only response that I have had back is this: just give us assurance. Give us assurance so that we are confident and know that the data that we share is going to be used appropriately.

The member over there, Darroch Ball, talked about 80 breaches in 8 years. You have got to say, if you then went and did the research on how much data is shared—you would go into the tens, maybe even the hundreds, of thousands. You have had 80 breaches over 8 years—that is 10 a year. You can do the fearmongering and you can talk about the issues, but let us go back to the heart of what this is actually about. The heart of this issue is about this: are we doing the right thing, in the right place, at the right time, for the people who ask us to serve them? And are we doing it in a way that we hold ourselves accountable, as a department, as organisations, and, dare I say this, even to providers? Are we doing the right thing to serve those who are most in need?

We know that there are a number who have come and shared those concerns, and I welcome that the Minister has taken the lead in ensuring that she has immediately addressed three out of the four concerns, and is continuing conversations around that. That is critically important as well. This is a solution that we feel is important. It is giving us the data that is vital for us as well. We know that there are 136 providers who have already signed up to this approach. They have been invited to upload the data. [Interruption] There are 10 at the moment—10; that is right—who have come along to upload this information.

But that is what we are saying—when we noticed that it was not quite right at that moment, we shut the thing down. So what do you have to say to this? When we found that there was one that was wrong, the response by the Minister and the department was to shut the thing down and make sure that we got it right. Why? It was because we wanted to give confidence regarding the concerns that were raised.

We believe that we are acting responsibly in what we are doing at the moment. We know that the Minister also has had conversations with those who have had concerns about the special sexual violence services. In their case, they have had those concerns—how has she addressed this? She has addressed this by allowing for a period of a year, so that they can continue to again work through those concerns step by step.

No one disagrees with the intent. No one disagrees with what we are trying to do, which is to make sure we have the right information and to ensure we provide the information service at the right time for the right purpose. I have heard no one at all disagree with that. What we are concerned about in this debate is to make sure that we have stepped through all of those concerns. We welcome that. We are working through that. We think that is absolutely important as well—

💬 Hon Member: What do you think we’re having an urgent debate for?

Well, that is why the urgent debate is here—to provide for that provision as well. I think the work that we are doing at the moment is critically important. We are working through—

💬 Carmel Sepuloni: Round it up, Alfred. You know you have nothing else to say.

Well, the member may think that, but these are the face-to-face conversations we are having in communities up and down the country. We are talking to the people, and this is what they are sharing. We did not send officials; we went along ourselves. The Minister has also gone along and talked to different community groups—those who have had concerns. We have addressed them. We are walking through it with them, so you cannot say that this is a Government that is out of touch, as has been commented. You cannot say that this is a Government that is not stepping and walking through those concerns. In fact, you would have to say the opposite. We do not go to Google and we do not go to the library to get information. No, we do not. We go out, we meet our stakeholders, and we talk to them about the concerns they have. We know that at the moment the concerns are there. We are being responsible as a Government to ensure that we walk through those concerns with them. If there is a breach, then we immediately shut that breach down until we have addressed it in the right and appropriate way.

We are continuing to listen to the concerns. We are working with the Privacy Commissioner. We have got the report; we are working through that. So we believe that we are acting responsibly. We are doing all the right things that are appropriate. I welcome the approach that the Minister has taken, which is the appropriate one. We are confident in what we are doing. Again, I want to reiterate this: the heart of this issue is about getting the right data and the right information to make the right decision. I confirm this debate.

Where you find incompetence, arrogance, and ideology meeting, you will find this National Government. That is what we have learnt from the Privacy Commissioner’s report today. This is a shambles. The Privacy Commissioner, an officer of this country’s people, has made a report—and I do not think I have ever seen one more damning from that office. For the Government and Alfred Ngaro to stand up and say “You can’t say this report shows we’re out of touch.”—that is just what it shows, Mr Ngaro.

Community organisations right around New Zealand have been raising concerns about the individual client - level data collection from day one and no Minister—no member of that Government—has been prepared to actually listen to that. Instead, they barge on with their ideological approach to social investment, which I will return to shortly, and nothing can stop that, because it is all they have got. It is all they have got after 9 years of social problems growing around them. All they have got is this approach. Anne Tolley says: “It is growing. All I’ve got is this, and I have to carry on no matter what the damage is that I’m doing.”

It is very important for people listening to understand exactly what we are talking about today. The individual client - level data approach makes the provision of personal, identifiable client data a requirement for receiving Government funding for these organisations, and there is no ability to opt out. Just think about that. The names, the addresses, and the contact details of vulnerable people and their children are being collected, and there is no ability for a community organisation to say: “That’s not appropriate for us.” So Alfred Ngaro says: “There’s 100-odd organisations that have signed up to that.” They had to—they had to do it. What kind of control-freak Government are we dealing with here that says—

💬 Hon Ruth Dyson: A nanny State—a police State.

Yes, exactly. It used to complain about a nanny State. This Government has caused the Privacy Commissioner to issue the most damning report I have ever seen his office issue, because this Government is perpetuating on these organisations some of the most damaging actions that they need to take to get funding, and that is a disgrace.

I want to be absolutely clear too about what the Privacy Commissioner has said. The Privacy Commissioner has said that his view is that requiring the information to be collected in this way is excessive, disproportionate to the Government’s legitimate needs, and is, therefore, inconsistent with information privacy principles. That is it. It is fundamental. The programme is out of control in terms of the basic values around privacy that New Zealanders hold dear. The Privacy Commissioner goes on: “As the policy currently stands, individual clients are required to share their … information.” There will be negative consequences. Individuals may choose to stay away from seeking help at all. Alfred Ngaro and the Minister have both said: “Oh, that’s just people’s fears. That’s not real.” It is real.

My colleague Stuart Nash has got just one example of how real this is. An organisation based in Napier called DOVE delivers a number of programmes aimed at giving perpetrators of domestic violence strategies to modify their behaviour. Some of these people are referred by the courts, but others self-diagnose and undertake the programmes because they want to improve themselves. DOVE’s management has told Mr Nash that it believes the Ministry of Social Development’s (MSD’s) new policy requiring them to disclose clients’ details will dissuade a number of clients from accessing its services.

This is an organisation doing exactly the work we want to see done, and it is telling the Government that the people who would come to it will be dissuaded. The Privacy Commissioner is telling the Government that people will be dissuaded from getting the services that they need. And Alfred Ngaro says it is listening. It is not listening. It is refusing to listen to the very organisations, like DOVE in Napier, that are trying to do the right thing by New Zealanders. That is arrogance. That is incompetence from the Government, and, unfortunately, it is what we have come to expect from this Government.

The Privacy Commissioner went on to say that one of his fears is that people will actually become more invisible to the Government as a result of this, rather than more included, because people will avoid having their names collected or organisations will find ways of making sure that they do not collect the data. So people become more invisible. It is perverse. It goes against the outcomes that the Minister and Alfred Ngaro have told us today they believe are important.

I want to talk briefly about the Minister’s response today around the question of the security of data and the portal that the MSD has. It is ridiculous for the Minister to stand up today and try to claim the moral high ground—that she shut the portal down once she found a breach. Where was the work before the portal was set up to ensure that it met the rules that the Privacy Commissioner himself set down for the Government? It did not test it. It stuck it up there. Unbelievably, organisations have been asked by MSD to provide the information on a spreadsheet. Get a bit of Excel out, send it in to the Government. That is not going to be secure. Anybody could tell you that, but the Government forged ahead, because the Government has got nothing else on the go. It is all about this approach; this is the only way that it thinks it can get it through.

Any New Zealander who has been following the news in the last couple of years knows that this Government’s record around privacy is appalling. The Office of the Privacy Commissioner received 121 data breach notifications in the past financial year. Judith Collins, a few years ago, actually said “We need to do something about this.”, but Amy Adams, most recently, has told us that the laws are robust and no changes are needed. Think about the breaches that we have had just in the last couple of years: MSD—multiple breaches—ACC, the Earthquake Commission, Housing New Zealand, the Medical Council of New Zealand, Immigration New Zealand, the Ministry of Justice, and the Southern District Health Board. These are all public agencies with significant data security problems. This Government has a problem when it comes to protecting the privacy of New Zealanders, and it is in denial. It is refusing to acknowledge that.

That portal has been shut down after the fact. The Minister cannot guarantee New Zealanders today that that information, which has been brought in from all of these agencies, can be protected. She said she does not trust it and neither should New Zealanders. Well, that is the situation the Minister is in, having already implemented the programme. That is a disgraceful way to go about this kind of work.

The Privacy Commissioner has an excellent section on page 37 of the report entitled “How could MSD have done better?” I want to quote from it: “For a policy of this size and significance I would have expected MSD to take a precautionary approach, clearly identifying its purposes, considering the full range of options to achieve these purposes”. It did not do it. For something as fundamental as capturing the names and addresses and the personal data of people, it failed to take that precautionary approach.

The Privacy Commissioner goes on: “MSD has not clearly articulated its objectives for collecting [the data] … Nor has it explained how the data it receives … will achieve its aims … This failure has negatively impacted on the trust and confidence of NGOs and the people who will be affected by the policy.” It is an absolute failure. It is a failure for the most vulnerable in New Zealand, who need these services. The agencies who work for the Government have told it they will not access services under these circumstances, but it does not listen. It is out of touch, it is arrogant, and it is, in this case, totally incompetent.

The Privacy Commissioner goes on: “I would also have expected MSD to identify and mitigate risks early on including by undertaking a thorough privacy impact assessment prior to implementing contractual changes and information collection processes. It is disappointing that a privacy impact assessment still has not been completed (as at 4 April 2017)”. Alfred Ngaro stood up and told us that the Privacy Commissioner has been involved all the way through. He has been calling for a privacy impact assessment, and the Government has not done it, and, as at 4 April, it still has not done it.

Every member of this House wants to make sure that the most vulnerable New Zealanders get the protection and the support that they need. In order to do that, we need a Government that is sensitive to the privacy needs of those people and that is competent in what it does in going about its work. This report today is evidence that it has completely failed those vulnerable New Zealanders. It has been incompetent, it has been arrogant, and it has been driven by ideology. That is why this Government has got to go.

I call Marama Fox—5 minutes.

You know what? I really, really want to work with this Government to support the establishment of Oranga Tamariki in a way that is beneficial for all New Zealand—I do. I know that the members of the Opposition also want to work to secure the future of our most vulnerable children. There are just a number of things that give us grave concern, and this is one of them—the sharing of information.

The Minister spoke about Whānau Ora being an example of where information is shared, but, let me tell you, the clear difference is that the Whānau Ora navigator comes and sits with the whānau and asks them: “What do you want? How can we assist you? How can we make that happen, and then whom do we need to get involved in order to do that and navigate the bureaucracy that has become our system?”. That is clean, because it works with the whānau, and if there is information to be shared, they are fully aware. It benefits their purpose, and they understand what it is going to be used for. What is happening here is a collection of information that is going to follow those people around forever, and I am not clear—it is not clear to me—what information they are asking for. Is it just their name, just their address—but, even then, is it coming from somebody, like they have pointed out, who said: “If I had known that my name would be passed on to other people, I would not have come.”?

Last week I had the opportunity to travel with the Justice and Electoral Committee to Australia and attend the Royal commission of enquiry into the institutional response to children who had been sexually abused. We had a moment to speak with the chief commissioner of that inquiry—which has been happening for 5 years—and he said that, on average, if a male has been abused, it takes him 30 years to build up the courage to present and tell their story. On average, if a female child has been abused, it takes them 20 years to front up and tell their story.

We talked about the statute of limitations being moved. If there is more pressure being put on people who are voluntarily trying to fix their own pathways because of the sustained abuse that they have had in their past and that information might inhibit them coming forward, then that cannot happen—and I know that the Minister has said that we going to put that section on hold. Well, on hold for what? On hold for how long? I do not want to be overly damning, because I actually want to go and help, but we need to be on the same page, and sharing information from one agency to another when it is to the detriment of those people who are involved is not something that we can sign up to.

There are a number of objections that we have had along the way—and I know the intent and the heart of the Minister is very real. I know that. I have sat and spoken with her, and I get that, but there is definitely a difference of opinion on how we come to the end point. It starts with the name—the Ministry for Vulnerable Children, Oranga Tamariki. The logic behind that name would have us call the Ministry of Health the “Ministry of Sick and Dying People”. The logic behind that name would have us call the Ministry of Education the “Ministry of Dumb Folks Who Need Some Learning”. There is no logic behind that.

Surely we must be aspirational, and be aspirational in the information that we share. If saving a child is at the heart, then the whānau who surrounds them also is at the heart. We are tarring people with a brush for risk profiling so that we can come in and save them from themselves before they have even presented with an issue. Have some faith in our people. Stop breaking families apart. Put support around them. That is what Whānau Ora is. That is what we advocate for. And that is what we are asking the Minister to do. Thank you.

During the last session, my general debate speech raised this very issue that we are debating today. In that speech, I talked about how Rape Prevention Education and Wellington Women’s Refuge had successfully negotiated a stay where they would not be required to provide the level of information that other services would be required to for a further 12 months—and in the words of the Minister—so that they could ensure that they would get the system right for that sensitive information that Rape Prevention Education and Wellington Women’s Refuge would have to provide. So that leads me to ask the question: if that information is really sensitive, is it still going to be sensitive in a year’s time?

What I was really concerned about was what I heard today from the Minister in response to this very, very real urgent debate—that the Minister appears to have a real lack of understanding of what happens in the real world with providers delivering services to real people. I raised Rape Prevention Education, but I also want to raise my own experience of having run a community outreach service, which was right on the main street of Henderson—I have spoken about this before—where it would take several times for women going past our shopfront before they would actually come in the door.

What that spoke to is that it takes a lot of courage for people to actually own up to the issues that they have and to seek that help—to reach out and get help—but particularly when it comes to issues of family violence and sexual violence, because the mamae that people have, the shame that they hold, is there for a long, long time, and it is not rational. It is not rational. When I have done tours of the country talking to community organisations, they have told me—every single one has raised this as a matter of concern—if you cannot establish a relationship of trust with your client, you are unable to work effectively with them, and you cannot establish a relationship of trust if they cannot even come in the door. You have to be able to be that safe place for people to come in and disclose their most intimate of issues.

One particular service said to me that they provide services to teenagers and young people in high school—people who do not have the age of consent. How, then, are they going to be able to consent to provide their information to a party, which is then going to hand it on to the Ministry of Social Development? This particular service—and I will not name it—deals with young people who disclose issues of family and sexual violence, which under the rules of the Ministry of Social Development will require their parents to sign off the notification for that information to be passed on to the Ministry of Social Development. In some cases, those parents are the ones who are perpetrating the abuse upon these children. So that is not going to work.

I have been hearing those stories up and down the country, and when I last spoke about this issue the Hon Jo Goodhew challenged me and said to me that you would only be required to give information that you would give to your local school. Let us see what that information is. The information is: name, date of birth, iwi, ethnicity, address, the details of your children, and the services that you access. When you are going to school the services that you access are educational services. If you are actually receiving mental health support, or support from the community for alcohol and drugs, and you are a parent and you are disclosing that you need that support, then there is a very real fear in people who access these services that that information will then target them as being risky parents.

That is a very real fear. It may not be rational, but in terms of what is going to be required by the Ministry of Social Development it is creating fear, and we cannot allow that to happen. We have to have trust in our relationships if we are going to work effectively with people. This does not allow for that to happen, and I for one am really grateful to the Privacy Commissioner for actually raising this concern with us. Thank you.

I want to take a very quick call on the importance of sharing information when it comes to the protection of our vulnerable children and people who are within the system. I can say that I have the experience of working in an organisation where the sharing of information was absolutely critical. However, the systems that were in place at that time never allowed for that to happen. We had too many people keeping their hands around the information, and, therefore, the people who were actually losing from the whole situation were the ones whom the issues were affecting.

When we start looking at the right time, the right place, and the right types of people who are delivering the services, those are the things that underpin the reason that this Government is doing what it is doing. Our Minister and this Government took the responsible pathway. When it was learnt that there was a breach in the system, she shut the system down. I have seen on many occasions, from the other side, when I was working out in the community, the many things that went wrong when it was not shut down when it should have been.

Therefore, in the short contribution that I have today, I want to talk about this and to support the process that we have gone through, which has worked very, very closely with the Privacy Commissioner, the Minister, and the group of people within the Ministry of Social Development to make sure that we get this process right. Shutting down that system was getting it right. Sharing information is getting it right, because at the end of the day, with agencies all understanding the same story of the client, it means that that client does not have to relive the trauma that they have been going through by having to repeat it 18 to 20 to 22 times. It is that that is actually off-putting to clients.

I have met some of those clients. I have sat in the room and I have listened to them. What they have said to me is that they are really hōhā with the way things are going for them. So without any further ado, I support what this Government is doing. May we keep going, as this responsible Government, dealing with the situations that need to be dealt with. Thank you.

The debate having concluded, the motion lapsed.