Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1698846130898.pdf (New Zealand)
Electronic Data Safety Bill Member’s Bill Explanatory note General policy statement Recently, a member of the public was able to download 7 000 documents from the Ministry of Social Development’s (MSD) computer network through the Work and Income self-service kiosks.
The documents included sensitive information (such as medical invoices) about children in the care of Child, Youth and Family (CYF), per- sonal information about people receiving benefits, the names of people being investi- gated for benefit fraud, the name of a person who had committed suicide, and pay rates for individual contractors employed by MSD.
Previous breaches in other agen- cies have highlighted the need for a systematic inquiry into the adequacy of informa- tion management systems in all government agencies.

Various government agencies hold extremely sensitive personal information and it is absolutely imperative that the public has full confidence in the Government’s ability to manage that information without allowing unauthorised access.
This Bill establishes a Commission of Inquiry into various privacy breaches that have occurred in the past few years by and within various government agencies.

The Com- mission will also examine the agencies’ capacity to respond to breaches in the future and how best to prevent further future unauthorised access to private information.

Clause 1 is the Title clause.

Clause by clause analysis Clause 2 is the commencement clause.
It provides that the Act comes into force on the day after the date on which it receives Royal assent.

Clause 3 is the purpose clause.

Clause 4 is the interpretation clause.

Clause 5 establishes the Electronic Data Safety Commission.

87—1 2 Electronic Data Safety Bill Explanatory note Clause 6 specifies the manner of appointment of the Commission, and the requisite qualifications of its members.

Clause 7 sets out the entitlement to remuneration of members of the Commission.
Clause 8 gives the Commission all the powers of a Commission of Inquiry.

Clause 9 sets out the functions of the Commission.

Clause 10 sets out the reporting requirements of the Commission.

Clause 11 requires the Government to respond to the Commission’s recommenda- tions.
Clare Curran Electronic Data Safety Bill Member’s Bill Contents Title Commencement Purpose Interpretation Electronic Data Safety Commission Membership of Commission Remuneration of Commission Powers of Commission Functions of Commission Commission to report Government to respond The Parliament of New Zealand enacts as follows: Page 1 1 1 2 2 2 2 3 3 3 3 1 2 3 Title This Act is the Electronic Data Safety Act 2012.
Commencement This Act comes into force on the day after the date on which it receives the Royal assent.
5 Purpose This Act establishes a Special Commission of Inquiry into— (a) the recent privacy breach that enabled access to the Ministry of Social Development’s computer network through the Work and Income self- service kiosks: 10 87—1 1 cl 4 Electronic Data Safety Bill (b) (c) (d) (e) any other similar, significant, and recent breaches involving unauthor- ised access to the personal information of members of the public held by government agencies: the capacity of government agencies to manage and hold secure personal information, especially in electronic form: 5 how significant breaches involving unauthorised access to the personal information of members of the public held by government agencies may in future be avoided: any other matter that the Commission considers it prudent to inquire into and report on.
10 4 Interpretation In this Act, unless the context otherwise requires,— Commission means the Electronic Data Safety Commission established under this Act Minister means the Prime Minister.

15 5 Electronic Data Safety Commission The Electronic Data Safety Commission is established.

6 (1) Membership of Commission The Commission consists of up to 3 members, to be appointed, no later than 30 days after the coming into force of this Act, by the Governor-General on the nomination of the Minister.
20 (2) One member of the Commission must have held a practising certificate as a barrister or solicitor for at least 7 years prior to appointment, and must be nom- inated and appointed to be the chairperson of the Commission.

(3) In nominating members, the Minister must take into account the need for the Commission to have expertise in— 25 (a) (b) (c) privacy and information management; and IT systems security; and public administration.
(4) Members hold office until the Commission reports to the House of Representa- 30 tives under section 10.

7 Remuneration of Commission Members of the Commission are entitled to remuneration and expenses under the Crown Entities Act 2004 as if they were members of a Crown entity.
2 Electronic Data Safety Bill cl 11 8 Powers of Commission Except as provided by this Act, the Commission has all the powers of a Com- mission of Inquiry established under the Commissions of Inquiry Act 1908, and that Act shall apply, with any necessary modifications, to the proceedings of the Commission.
5 9 Functions of Commission The Commission has the purpose of inquiring into and reporting to the House of Representatives on the following matters: (a) (b) (c) (d) (e) the recent privacy breach that enabled access to the Ministry of Social Development’s computer network through the Work and Income self- service kiosks; and 10 any other similar, significant, and recent breaches involving unauthor- ised access to the personal information of members of the public held by government agencies; and the capacity of government agencies to manage and hold secure personal information, especially in electronic form; and 15 how significant breaches involving unauthorised access to the personal information of members of the public held by government agencies may in future be avoided; and any other matter that the Commission considers it prudent to inquire into and report on.
20 10 Commission to report The Commission must present a report to the House of Representatives con- cerning the matters described in section 9 not more than 12 months after its appointment.

25 11 (1) (2) Government to respond The Minister must, not more than 30 working days after the report of the Com- mission has been presented to the House of Representatives, present a report to the House responding to any recommendations of the Commission.
The Minister’s report must contain clear indications in relation to each recom- mendation of the Commission as to— 30 (a) whether the recommendation is accepted, in whole or in part, and how the Government intends to implement it, and when; or (b) whether the recommendation is rejected, and if so, why.

Wellington, New Zealand: Published under the authority of the House of Representatives—2012 3