Customs and Excise Bill

Madam Chair, thank you very much. It’s indeed a privilege and a pleasure to oversee the ushering of this very important bill, the Customs and Excise Bill. By way of opening the discussion, can I first acknowledge the former Ministers, the Hon Tim Macindoe and, of course, the Hon Maggie Barry, who definitely had a hand in this bill that we are discussing tonight. I’m looking enthusiastically for the contributions that I know are going to appear as we deal with it theme by theme. Despite the time, I know that there’s going to be a lot of contribution given to this very important legislation. This is a non-controversial piece of legislation, but it’s a very important piece of legislation.

We are attempting to modernise the Customs and Excise Act, which hasn’t been modernised for up to 20 years. In some parts of the Act, it’s about a hundred years in which it hasn’t been touched, so this is an attempt to bring it into the modern world. The legislation will be more flexible to respond to a changing global environment and changes in business and border management practices, and the bill will balance the protection of the nation with individual rights. Just for members’ information, the bill carries over most of the current Act, with, of course, the key policy changes to bring the legislation into line with modern technology and business practices.

For members of the House, I want to acknowledge that business have been involved throughout the policy development stages of the bill and consulted on the draft. If there was an exemplar bill that we would put up where stakeholders have been actively involved in its crafting, then I would definitely nominate this one. The Customs Service will continue to engage with business in developing regulations, customs rules, and staff guidelines.

The major policy change is in relation to greater information-sharing between customs and other Government agencies: disclosing information on people and goods and crossing the border for national security, law enforcement, public health, and safety purposes. Information will also be able to be disclosed to implement or guide Government policy, such as free-trade agreements or to maintain regulatory regimes.

To increase certainty about how customs must manage its information and circumstances and conditions under which information may be disclosed, the bill provides for information-sharing agreements made at the ministerial level for domestic arrangements, or chief executive level for international arrangements. Agreements will specify protection for personal and commercially sensitive information, and give a more efficient and transparent process for the sharing of information.

This bill attempts to be better for businesses. It will be easier for traders to do business and to interact with customs. The bill also is attempting to provide greater certainty around excise liability and greater certainty for the fuel industry around when excise is due, and collect an additional $5 million per annum in Crown revenue from avoiding future litigation. It also clarifies when excisable goods are subjected to the control of customs. It’s also about modern and flexible powers to protect New Zealand. This bill confirms the majority of customs’ existing powers, while recognising privacy concerns. It also provides greater scope and flexibility to address smuggling and national security concerns. The bill also introduces a modern sanction framework. A range of penalties have been increased and made consistent across the bill and other legislation to ensure ongoing compliance.

In terms of opening statements, I think it’s important that the members are also made aware that the Privacy Commissioner and the Law Society made submissions on many of the substantive policy changes in this bill, and these submissions have informed the Foreign Affairs, Defence and Trade Committee’s report back to the House.

I now turn members’ attention to theme one and its title of information disclosure. Focusing on this particular part of the bill, just for the benefit of members, I inform them that the bill provides a coherent legislative framework for managing information while protecting privacy. This part of the bill continues the information-matching arrangements contained in the current Act, which are working well. Permitted information matches relate to matters such as student loans, fines enforcement, and child support. Any information disclosure agreement made by customs under the new provisions must be consulted with the Privacy Commissioner prior to it being approved by the relevant Ministers within domestic Government, or the chief executive for international and private sector agreements.

Sensitive personal information, such as the passenger name record data and biometric information, can be disclosed only under restricted circumstances. To increase accountability and transparency about how customs must manage its information, the bill provides for agreements with other Government agencies, including for direct access to customs information, to be made at the ministerial level for domestic arrangements. The Privacy Commissioner will have active oversight. Greater information disclosure by customs to other Government agencies will contribute to national security, law enforcement, and public health and safety.

The bill retains the ability from the current Act for customs to disclose information to overseas authorities under a formal written agreement. Checks and balances are written into the agreement. The bill also retains the ability from the current Act for customs to disclose information to an overseas authority outside of a formal written agreement. This ability is restricted to a limited range of functions of the overseas authority and in the type of information that can be disclosed. This form of information disclosure is necessary to meet operational considerations when the trade flows between New Zealand and the other country are not sufficient to warrant a formal written agreement.

The select committee considered in their view how best to balance the need for transparency in the collection, use, and disclosure of information with parliamentary oversight. I want to acknowledge the work of the select committee and, of course, the officials who have brought this bill to this stage. I look forward to the contributions from the House.

Thank you very much, Madam Chairperson Tolley. It’s a pleasure to be able to participate in the debate on the information disclosure aspects of this Customs and Excise Bill. I intend to speak with some particularity to clause 293, but before I do that I would like to make some general statements about the information disclosure aspects of this bill. Obviously, our Customs Service has the power to collect an enormous quantity of information and data, not just about goods and items that cross our border but about people as they cross our border. It is a rich source of information, and it is appropriate that the Government judiciously make that information available for other purposes. But it is certainly incredibly important that “judicious” is the keyword here. We must take extreme care and caution with the information that is gathered about people, how that information is shared with other Government agencies and with the private sector, and how that information is used. I believe that these aspects of this bill warrant significant scrutiny by Parliament.

It may appear to some members that this is reasonably non-controversial. There’s certainly agreement across the House about these aspects, but I think it is our duty as representatives of the New Zealand public to ensure that we scrutinise this bill closely, given the nature of the powers that this legislation provides to not just the Customs Service but other Government agencies and our ability to use the information that we collect about people. For instance, information that is collected by the Customs Service can be used in the administration of the Student Loan Scheme Act—you know, personal information about people to be able to enforce aspects of that legislation.

💬 Simon O’Connor: You’re doing well, mate—keep going.

💬 Alastair Scott: Only two minutes and 26 seconds to go.

There’s considerably more than two minutes to go, I can assure you gentlemen. It also can be used in the recovery of financial support under the Child Support Act. It can be used in verifying people’s benefit entitlements. So it is very personal and private information—absolutely appropriate uses, but it’s very important that we as a Parliament are satisfied that this legislation is carefully crafted and able to ensure that we protect people’s privacy and we use that information appropriately.

As I said, I wish to speak particularly to clause 293, which deals with the direct access to information for purposes other than the specified purposes that other clauses relate to. This allows for Government agencies to share information that supports the detection, investigation, prosecution, and punishment of various offences; the detection and investigation of suspected or actual terrorist acts or the facilitation of terrorist acts; the protection of national security; the processing of international passengers; the protection of border security; the protection of public revenue; and the protection of public health and safety. Obviously, as Minister of Immigration, I have considerable interest in this information-sharing ability. As Minister, I am regularly briefed on action that is taken by our border services to ensure the integrity of our border, to ensure the integrity of our immigration system, and to ensure that people who wish to attempt to enter New Zealand for unscrupulous purposes or who are unable to verify the validity of their intentions for trying to enter New Zealand are able to be, in some cases, turned away or are able to be processed in an appropriate manner.

Now, the ability to do that is, of course, incredibly and heavily reliant on the ability to gather data from various sources about those people—heavily reliant on the ability to collect that information. So the ability to collect and share that information is important, but it is, as I say, vital that we have the right protections in place. I am pleased to see that the Foreign Affairs, Defence and Trade Committee saw fit to elevate the responsibility for entering into these types of data-sharing agreements from the chief executive level to the ministerial level. We, as Ministers, as elected members of Parliament, have that accountability to the people of New Zealand in a much greater way than even a chief executive, as senior they are, as great the level of accountability that they have, the levels of responsibility—[Interruption] Two members are heading off to a leadership meeting, I think. It is important that it’s actually the elected officials, the elected representatives, who are able to enter into this type of arrangement.

It’s also important that the Privacy Commissioner must be consulted—so it’s not an option for Ministers entering into these agreements. The Privacy Commissioner must be consulted, and Ministers must have regard to any comments received from the Privacy Commissioner on the proposed agreement. Again, I think, in the 21st century, when people’s data is one of the most sought-after commodities available in the 21st century, it’s incredibly important that we make sure that those safeguards are included in there.

Legislation also prescribes what these written agreements between Ministers must include, such as which databases may be accessed, the particular types or class of information that may be accessed, and, importantly, the purpose for which that information can be accessed. We have seen this in the past—previous Governments that have been a little loose with the purpose for which they were using information. Perhaps, frankly, they have misused and abused the access to information that we have as a Parliament and as a Government, and it is important that the exact purpose for which information can be shared, for which that information can be accessed, is set out in those agreements and that we don’t have creep beyond what those specified purposes are.

If, once an agreed purpose is set in place, it is determined that maybe it would be useful for the Government—that there is a genuine and useful reason for going beyond the purposes that are agreed in those initial agreements between Ministers—then Ministers need to come back to the table, set out that new purpose, and work with the Privacy Commissioner to make sure that that is a reasonable and sensible purpose, because we cannot allow information to be used incorrectly or inappropriately by people who are in a position of significant power.

Those agreements must also set out how the information is to be accessed, the designations of the people within the Government agency who will be able to access those databases, the way the records are to be kept, safeguards that are to be applied, etc. So this is all about making sure that we have the appropriate level of oversight, the appropriate safeguards in place to ensure that where this information is being shared, it is for the specific purposes laid out in the Act. The Act is actually quite precise in terms of the exact reasons that this information can be shared. I think that is incredibly important, and I think that the improvements that have been made, the changes that have been made by the select committee, do improve the bill and they do go a long way to protecting the privacy of individuals.

So with those comments on this specific part of the aspects of the bill that deal with information disclosure, I’m happy to conclude my contribution there, but I suspect that other members have considerably more to say on this part of the bill.

Tēnā koe, Madam Chairperson Tolley. It’s a pleasure to speak on the Customs and Excise Bill in the committee stage as a member of the Foreign Affairs, Defence and Trade Committee. I want to commend the debate and the themed debate that we will be having, and what it does provide is a real scrutiny of the select committee’s work. Actually, in this particular area—in the information disclosure area—I want to commend the select committee. They made numerous amendments, particularly to clause 288—which I will speak to—clauses 293 and 294, and I’ve got some special comments for clause 297.

So if we start at clause 288, this provides customs and the Ministry of Justice to share information to enable recovery of fines. The amendment that I specifically want to focus on is actually an increase in the threshold in the definition of what a “serious default” means. Under the previous legislation, it was people who owed at least $1,000 who could be stopped. Obviously, that was our opportunity to recover the debt that these people had to society, and I know the Minister has talked about that in her opening address. But what we did do, I believe, is futureproof that particular clause in allowing, by Order in Council, that amount to elevate up to $5,000 over a period of time. Now, I think that is a really good attempt at making sure that this piece of legislation is fit for purpose going into the future, but I would appreciate from the Minister some clarification about that figure. How it did you come to that? Was that something that the officials with the select committee were able to set?

Regarding clauses 293, 294, and 297, again, I think the select committee did a fantastic job in focusing on the issue of privacy. I found a little quote just before about where privacy came from, and I’ve found a paper from the European Digital Rights commission on the evolution of the concept of privacy. Actually, privacy—as they’ve noted—started, essentially, in 1776 when John Adams, who was the second President of the USA, made a comment about the British, who at that time seemed to think that they had a right to search houses without justification. So the whole concept of unjustified violation of privacy is in a state of evolution, and what I’ve enjoyed reading in the select committee report has been the thinking around those particular amendments to those particular clauses.

As a principle, what those clauses have said is that—and I just want to focus on some principles of privacy that our Privacy Commissioner has published on their website. Private information—the whole issue of privacy—is actually about how we collect private information and how we use private or personal information. There are 12 principles. We should think about the purpose of the private information or personal information we are collecting, the source of that personal information, the collection of that information from the subjects themselves—that is, do people know and are they aware that the information that they are contributing, even if it is ticking a box, is actually being collected?

So it then becomes about the manner of the collection, the storage and security of personal information, who has access to that personal information, is it readily retrievable, is there an opportunity to correct personal information—so, if you find that your personal information has been stored and you find out that there’s a problem with it, you are entitled to confirm that that information is correct but also to change it if it isn’t. So there is an issue about the accuracy of the private information, and the people who collect it should also check it and verify that that private or personal information is, in fact, correct.

It should not be kept longer than is necessary, and, obviously, there are limits on the use of private information. It must not be used for any other purpose than that for which it is collected. In fact, it’s within these clauses that we see the extension of the use of that personal information from one ministry—that is, from the Customs Service—to other ministries such as the Ministry of Justice, the Ministry of Social Development, the police and a variety of other agencies. The intersection of the use of that information then becomes about issues such as police vetting and security issues, and do they also relate to issues about some of the substances or commodities that people are wanting to bring into the country?

So there obviously are limits, and should be limits, on the disclosure of that personal information. Also, we should make sure that there are never unique identifiers in the system, so that people’s personal information isn’t coded in other ways so that we actually know who they are and all their details.

The reason that I highlight that particular framework around privacy is because everything that the committee added to clauses 293, 294, and 297 has been about protecting that personal information and the integrity of its use. So requiring Ministers, for example, to have information-sharing agreements elevates it to a level that is beyond a chief executive to chief executive relationship. It then says that the safeguards attached to the sharing of that information must be complied with. So, for example, in new clause 293(3), there are now some criteria that Ministers will have to sign off before those agreements can actually be entered into, such as “(i) direct access to the information is reasonable and practical … (ii) there are adequate safeguards [including audit requirements] to protect the privacy of individuals, … (iii) the agreement will include appropriate procedures for direct access to and use, disclosure, and retention of the information;”.

So it’d be really good to hear from the Minister specifically about clause 297(5B), where we are requiring a review of any privacy agreements, and the Privacy Commissioner has an opportunity to “have an active oversight of information disclosure arrangements.” This is, specifically, arrangements with overseas authorities, and the reason I want the Minister to comment about it is because having a review clause like that actually goes back to my point about the paper that I highlighted about the evolution of—sorry, where is it; I’ve lost my reference—this whole issue of privacy. It’s such a changing world, and privacy is a concept that will change, based on data and information and technology.

One of the issues that has been highlighted recently, for example, is the whole Edward Snowden revelations and the National Security Agency in the United States and their ability to collect data from multiple sources. So in this technology space, things are happening at such a pace that I know the Privacy Commissioner—given it is their primary function—will be able to provide that oversight, which means that we can update this particular clause, if needed, or those particular arrangements.

Information and the access to information and who and how information is collected is actually dynamic. It is part of the dynamic society that we live in today because it’s a global society. It’s one where we can purchase things online, and someone may be able to monitor our IP connections and what we like and don’t like. I mean, that certainly happens with our Countdown cards. They know what specials to send you.

I just, again—in concluding—do want to highlight the work of the select committee, and I actually congratulate them because these amendments we should be proud of as a Parliament. Kia ora.

Thank you, Madam Chairperson Tolley. It’s with great pleasure I stand to support this very substantial bill. I must say, it’s a much-needed bill, because the law prior to this was very confusing and had layer upon layer of reforms. So this consolidation of all of those reforms, and a re-expression, is indeed welcome.

It does give significant powers to the Customs Service, and for good reason. On the Foreign Affairs, Defence and Trade Committee, we’ve had occasion to look at what customs does, and they face an extremely onerous challenge of protecting our borders. It is, I think we must recognise, a battle that is fought not necessarily simply with boats and with border controls and the like but also with data. So I can see the enhanced powers in respect of the searching of electronic devices—and it is worth querying the Minister on some of those powers. They are powers that are indeed much needed, because, obviously, in battling against the evils that sometimes cross our border, whether they be drugs, other illicit goods, or even simply people avoiding duties, we do need that information and that data.

So clause 207 does allow the searching of electronic devices. However, it’s all very nice to say that customs has the right to search an electronic device, but as we all know with our devices, they are often locked down, and asking nicely sometimes simply won’t do it. So my question, really, is whether the powers go far enough, because whilst we need to be very cautious in interrogating someone’s personal device—whether it be their laptop or their mobile phone—when we must, we must do it thoroughly and we must do it properly. When a phone is encrypted, as indeed has been discovered in a recent case in the United States, it’s more or less impossible to interrogate that data without destroying it. So my question, really, is this: do we need to be able to compel not only the holder of that device but also the manufacturer of that device to provide access to that information? If someone won’t give you their password, someone won’t give you their encryption key, or whatever it might be, the question then is: where do we go now? We have, essentially, a stand-off, and, as sure as night follows day, some people in those situations simply will not be prepared to hand over—

CHAIRPERSON (Hon Anne Tolley): I don’t like to interrupt the member, but I think you’re on the wrong part. We’re actually on information disclosure rather than powers and obligations. [Interruption] I know it’s a—

Madam Chair, there’s a lot of overlap there, because the real question there—

CHAIRPERSON (Hon Anne Tolley): Are you arguing with me? We are in a themed debate, so bring your discussion to the theme of information disclosure. I’m sure you can do it, Dr Webb.

Yes, absolutely, Madam Chair. Thank you for the vote of confidence. The information on that device is critical and the question is about the protection of that private information. I didn’t want to overlap with the previous speaker too much, but that really is the question, about protecting that information and ensuring that information that is interrogated, the private information, the non-relevant information, is protected and it is not disclosed to the wrong person—that it’s not interrogated and, in fact, that it’s put entirely to one side. As the previous speaker noted, privacy is a critical concern, given the extensive powers that exist here.

So, really, in respect of this bill, yes, it’s an absolutely necessary consolidation. But there are some residual questions there about the balance to be struck between the powers we’re giving customs and their need to get that information and the privacy rights of the owners of that information—the individuals concerned. Thank you.

Madam Chairperson Tolley, thank you very much. I just want to rise and answer a couple of questions—very good questions—that have come from the right side of me. Of course, there is always an open invitation to the left side to ask some questions.

In terms of the member Louisa Wall, I just want to pick up the question she asked in relation to clause 288, around the $5,000 upper limit threshold. Her question, I understand, was the rationale behind that $5,000. Suffice to say that—well, what I’m getting advised is—the $5,000 is regarded as a reasonable upper limit to the $3,000, and it’s amended so that it’s no longer open-ended. So there was, obviously, an attempt to kind of bring it in within a reasonable amount so it wasn’t open-ended. So, in terms of that—just, initially, answering your question—I also want to say that the Regulations Review Committee raised concerns about the fact that it was open-ended; hence the reason why we’ve got that $5,000 limit. The Regulations Review Committee identified it, and I think that’s where we’ve got to the $5,000. So that’s just in response to that particular question.

In terms of your further question, to the member Louisa Wall, around clause 297, particularly around the Privacy Commissioner—her question around the guarantee of protection of privacy information-sharing between agencies—under clause 297, we’re talking about allowing the Privacy Commissioner to require chief executives to periodically review an agreement. So, just for the member, the Privacy Commissioner may request a review of an information disclosure agreement on any grounds he or she sees fit—for example, changes in data practices, non-technology. A review would look at the agreement’s reasonableness against the changed circumstances—so just another layer of certainty for the very important question that the member raised around guarantees of the privacy of that information. So just a short call to answer and respond to the member’s questions in the committee.

Thank you. Just to continue, in terms of clarifying information disclosure, there are two main points that I’d like to cover in the time I have to speak tonight, the first being general comments around information disclosure, and the second being more specific discussions around direct access to information, particularly around clause 293. The main reason that we’ve reviewed the Customs and Excise Act 1996 is that the world has changed and we have come to learn the fact that for New Zealand, as an island nation, our border is special, very special, not just in terms of our identity as a nation but also in terms of our economic state at the moment, and it’s important to protect that.

It’s important to protect it because customs is the only agency that collects information about all goods and people that come in and out of New Zealand, and that’s an important function. It’s not important just because of those goods and those people. We’re in an age where it’s the information surrounding those entities that has become even more interesting over the time that we try to strike a balance between making sure we have transparency in the collection of that information and its use and dissemination but also in terms of protecting that border—making sure that we retain the importance of being an island nation with a border. That’s why this piece of legislation is so important. It enables us to move, as a country, with the times and to make the most of who we are as a country, make the most of the fact that we are an island nation. That’s why it’s really important to keep us moving with those times.

One of the most important things that this piece of legislation does is clarify the direct access to information for certain purposes. In the past what we’ve seen is—well, for want of a better term—a bit of a free-for-all in some ways. We haven’t had a clear framework, in terms of transparency, as to where we are accessing information. There’s been no clear measuring up of who’s getting it and where, so it’s good to see that now if we’re wanting to access thing like the passenger name record, which is the list of people coming into New Zealand—if there are agencies that need to access that information directly, we need to know why and we need to make sure that our Ministers are aware of the reasons why. It’s really encouraging to see that before entering into any written agreement about information sharing, those Ministers must be satisfied on three clear factors, and I’m going to iterate those now because I think it’s important that we know what those factors are that Ministers must be conscious of before written agreements are entered into to enable that direct access of information into customs information gathered at our borders.

The first is that the “direct access to that information is reasonable and practical”. The second one is that “there are adequate safeguards, including audit requirements, to protect the privacy of individuals”—and how important that is. Thirdly, is that “the agreement includes appropriate procedures for direct access to, and the use, disclosure, and retention, of the information.” Can I just say that at a time when we’re recording biometric information—that’s information about people’s identities that are recorded; their faces, their irises, their fingerprints—it’s important to know how long that information is being retained. So while we move with the times, while we need that more accurate data, we also need to conscious of how we are retaining that information to make sure that that privacy is adequately protected.

One of the main objectives behind this bill—and they are listed out in the introduction at the very start—is the “facilitating [of] greater information-sharing between Customs and other agencies.”, and that is so important. We do need to be a joined-up Government, we do need to be making sure that we understand who is coming into New Zealand and who is leaving, and that is why we need to make sure that—

Sorry, the member’s time is up.

Powers and Obligations