Huo RaymondPRIVACY BILLFirst ReadingDebate resumed from 10 April.RAYMOND HUO (Labour): Thank you Madam Deputy Speaker. I start where I finished. We have learnt from the police that cybercrime investigations at the moment may be a specialised area but in the foreseeable future they will become a generalised area because technology is a part of everyday life. Advances in technology such as the social media platform e-commerce digital economy and new ways of collecting saving storing and distributing personal information bring with them a variety of issues and challenges concerning privacy. The proposed changes under this bill act on the recommendations of the Law Commission in 2011. The bill would grant significant powers to the Privacy Commissioner and strengthen the existing privacy regime by repealing and replacing the Privacy Act 1993.The key changes in the Privacy Bill include mandatory reporting of privacy breaches compliance notices—that is the Privacy Commissioner will be able to issue compliance notices that require an agency to do something or stop doing something.What is personal information by the way? Personal information according to the Privacy Commissioner is any information about an individual namely a living natural person as long as that natural person can be identified.Let me step outside this bill for a little while and talk about the issues covered in another bill. Last Tuesday this House unanimously passed the Criminal Records (Expungement of Convictions for Historical Homosexual Offences) Bill. There are two types of criminal records or checks: Case Management System (CMS) and Criminal and Traffic Convictions History records (CaTCH). In the case of CMS it is where all data in relation to offences including convictions that were subsequently quashed will be stored. This is a data centre a unified go-to place for all information in relation to court or criminal cases. For CaTCH anyone who is eligible to have their criminal records expunged and successfully expunged will be able to have their criminal records wiped from the CaTCH system. In terms of both CMS and CaTCH there will need to be a robust check and balance system to ensure that privacy concerning individuals will be protected and we do have such a robust system—for instance regular checks or auditing.The expungement legislation provides statutory requirements for the privacy concerning individuals to be protected. In a similar vein the Privacy Bill creates a new criminal offence. It will be an offence to mislead an agency in a way that affects someone else's information and to knowingly destroy documents containing personal information where a request has been made for it. Other measures under this bill include strengthening cross-border data-flowing protections. New Zealand agencies will be required to take reasonable steps to ensure that personal information disclosed overseas will be subject to acceptable privacy standards.The bill also clarifies the application of New Zealand's law when a New Zealand agency engages an overseas service provider. This is important. New Zealand is an export-orientated country and New Zealand is an active member of the international community in terms of international agreements and contracts. To maintain acceptable privacy standards will be very important—for instance concerning international contracts etc.The Privacy Bill retains the existing Act's 12 information privacy principles or the so-called IPPs. At the core of the Privacy Act are those 12 information privacy principles that set out how agencies may collect store distribute and disclose personal information. Of course many rules have exceptions as we are reminded by the Privacy Commissioner. We will need to read together with those exceptions to see how they relate to any particular circumstances.The Privacy Bill repeals and replaces the Privacy Act 1993 as recommended by the Law Commission in its 2011 review of the primary Act. The Act has been in operation for 25 years. Over that time the rise of the internet digital economy and e-commerce have transformed business and government. New technologies such as the social media platform e-commerce and cloud storage have changed the way personal information may be collected saved stored or distributed. This has created many benefits but together with the benefits has also created new challenges and this bill seeks to address those issues.This bill will better align New Zealand's privacy law with international developments including OECD and European Union guidelines.While we're debating this bill Facebook's CEO has just faced the United States Senate judicial and commerce committees where legislators there are introducing similar changes aiming at protecting people from incidents like the Cambridge Analytica scandal. General consensus is that consumers deserve the opportunity to opt in to services that might mine and sell their data not to find out their personal information has been exploited years later. We're dealing with a reality. It is not only about Facebook. Other social media platforms such as Instagram LinkedIn or Twitter are a part of everyday life.Everyone is dealing with some form of data one way or the other. This is the era of big data. Voluntary standards are not enough. Legislative changes are necessary and this is exactly what this bill seeks to achieve. I look forward to submissions. The already busy Justice Committee is fully gearing up for a new mission and new challenges. Thank you Mr Speaker.