Electronic Identity Verification Bill — In Committee 
Text is incorporated into the Bound Volume 
Electronic Identity Verification Bill — In Committee 
[Sitting date: 13 November 2012. Volume:685;Page:6525. Text is incorporated into the Bound Volume.] 
Electronic Identity Verification Bill 
In Committee 
Part 1 Preliminary provisions 
Hon RUTH DYSON (Labour—Port Hills) 
: 
 We seem to have got to this bill the Electronic Identity Verification Bill with extraordinary speed this afternoon. I was actually thinking that we might not get to this bill until after the dinner break but I am delighted that we have. 
This is a bill that I was very pleased to have at our select committee the Government Administration Committee and one that although it did not provoke a lot of debate and discussion in terms of the number of submissions we had was certainly of great interest. It posed to our committee the tension that people have—perhaps not so much the younger generation; you know people of the age of my colleague Kris Faafoi would not be as concerned as perhaps older people of my generation and even older than me—that is the anxiety that some people feel about the use of their personal identity in an electronic form. That really was at the heart of our discussions. That tension exists because there is that anxiety but at the same time the use of electronic procedures for people to access information—to have data or information shared for people to gain information for themselves which may be dependent on them providing their personal identification—has huge advantages. 
The balancing trick if you like for our committee was to consider that anxiety: that the improper use of people’s identity information—identity fraud as we are very familiar with in this House—that the possible abuse of people’s identification or that by giving their personal information some other individual being able to access information about them or others by using it could be possible. This is quite a big deal. It is an important thing. We know for example that there are a very large number of scams where people’s credit cards are used inappropriately—about 2000 each day—where there is credit card fraud or identify theft or some spam some virus that is given and people have not been asked. 
 Of course we have had very recent examples raised in this House of privacy breaches. We have seen a large number in Government departments and actually I think we should consider ourselves fortunate that the committee considered this bill prior to the most recent major breaches of Work and Income through its kiosks where just a regular person off the street more or less was able to gain access to totally inappropriate information without doing anything illegally. I think that the committee may have had a large number more submissions had it been considering this legislation at the time that the Work and Income kiosk fiasco was being undertaken. 
Dr David Clark 
: 6300 people affected in the IRD breach. 
Hon RUTH DYSON 
: My colleague Dr David Clark from Dunedin North has just told me there were 6300 people identified in an Inland Revenue Department breach. So as I say the fact that our committee considered this bill some time ago and it is now just getting to this Committee stage is hugely advantageous I think because otherwise we may have been considering it in quite a different environment. 
The principles that are outlined in Part 1 of this bill were agreed to. This had cross-party agreement. They were not difficult issues. We wanted to make sure that people were not obliged to give out their personal details in order to access information but we knew that as people became more confident with the system it would certainly evolve. We had also the absolute understanding of what information was able to be shared between different agencies obviously not for a different purpose than a person who gave that authority agreed to. Also there are other matters that people might not have considered such as the principle of people being able to access their own history: what has their own history been used for in terms of this electronic identity credential? 
There was no debate or division at all in the committee about the principles that were set up. What we were primarily concerned about was the issues I referred to earlier—that tension that exists between people electronically giving authority to access information or to share information against the advantages that are clearly of most benefit to the Government departments and agencies in terms of convenience in terms of lower transaction costs but also just in terms of basic efficiency. But actually it is hugely advantageous to the person themselves. We all know that as things like phone banking and internet banking have evolved no matter how much we said we actually really like the face-to-face exchanges it is also—although face-to-face exchanges are really pleasant—very convenient for people to be able to have electronic access to a wide number of services. 
I omitted earlier in this debate to acknowledge the Minister. Minister Chris Tremain is responsible for this legislation and I just want to put on the record a note of acknowledgment to him for guiding it through to this Committee stage. I also want to acknowledge that the bill was introduced by his predecessor the Hon Nathan Guy and during previous discussions on this bill both have been very helpful in terms of listening to members who have spoken. I also want to acknowledge the members of the Government Administration Committee. I think over the coming weeks we will look back on this legislation with a considerable amount of fondness because it received only a couple of submissions. To my recollection there were only 12—was it? I thought it was nine perhaps 12. It was not very many anyway compared with legislation that is before our committee at the moment. The Marriage (Definition of Marriage) Amendment Bill is likely to exceed 12 submitters on that particular legislation I would imagine as we hear that bill. 
I know that we have amendments later on in this debate but I do not think there are any Supplementary Order Papers that cover any of Part 1. I hope that is the case because I am about to conclude my contribution. I might have to take another call if there is an amendment to Part 1. But I will just conclude by saying that Labour is very pleased to support this bill. I note that the way we have dealt with it—and I hope the Minister in the chair the Minister for the Community and Voluntary Sector is able to answer any questions that are posed to her during the Committee stage of the bill—and considered it at the committee and made a large number of amendments that I understand have got the support of the House should give the rest of the House confidence that the bill can progress without further amendments other than that outlined in Supplementary Order Paper 128. Thank you. 
KANWALJIT SINGH BAKSHI (National) 
: 
 First of all I would like to congratulate the House and wish it a happy Diwali. Today is the actual day of Diwali which we also celebrated last week in Parliament. The Sikhs celebrate today’s date as Bandi Chhor Divas so I wish all the Indians all over New Zealand a happy Diwali. 
I would like to acknowledge the chair of the Government Administration Committee the Hon Ruth Dyson and other members of the committee who have worked during the select committee process. The purpose of this bill the Electronic Identity Verification Bill as we have shared in the second reading is to simplify and enhance service to ordinary New Zealanders. The bill will endeavour to do so by simplifying the interaction that an individual has with Government agencies. 
The bill seeks to ensure that participating agencies achieve a higher degree of confidence in the individual’s identity. This confidence is to be achieved by providing New Zealanders with the option of verifying their identity electronically. The bill provides the necessary legislative parameters for the igovt Electronic Identity Verification Service which provides easier and more secure access to online Government services. 
Once fully implemented the service will be able to be used by all New Zealanders for a wide range of online transactions offered by the Government and private sector agencies. Using igovt will allow people to avoid repeatedly having to provide physical documents to multiple agencies in order to use online services. Currently for these kinds of interactions agencies usually require people to provide several documents as evidence of their identity but the bill ensures that the process is much easier while still having appropriate control and a safeguard. The Government is committed to providing people with the facilities for this modern age and I hope this bill will be a step further. Thank you. 
Hon TREVOR MALLARD (Labour—Hutt South) 
: 
 I want to thank members opposite and the members of the Green Party who were involved in the Electronic Identity Verification Bill and to compliment the Hon Ruth Dyson on her chairing of the Government Administration Committee. I think this bill and a measure that will follow are bills where there was a considerable amount of agreement amongst members as to the direction. Where there were changes that we wanted to make to the legislation there was I think good consideration taken of the suggestions and the committee ended up with the sort of unanimity that can be had if people listen to evidence consider submissions make some changes and act in a way that is designed to get sustainable legislation rather than things that are highly politicised and likely to change. 
The igovt identity verification service has been in place for a couple of years now for people wanting to authenticate their identity in their interactions with the Department of Internal Affairs in respect of the Births Deaths and Marriages registry. But it has been something that has been very limited. What this bill does is allow the service to expand in its availability to all members of the public and allow more agencies to use this service to identify the clients. What it does effectively is reduce the hassle of people having to submit documents over and over again. I might say having recently dealt with the Department of Internal Affairs on the question of a passport renewal that the changes that have occurred in recent years around the simplification and not having to provide the same documentation again and again on renewal is something that I think is real progress if it can be continued—and if we go back to what is effectively an old-fashioned notion about the indivisibility of Government. The Crown is not meant to be divisible. You deal with the Crown. I think the way that we have developed over the last 20 30 or 50 years has been that we have been dealing with ministries and departments in their own separate silos and in quite different ways and with different standards rather than dealing with the Crown as a whole. My view is that what this bill does is allow for individuals to deal with the Crown as a whole and I think that is something that is very useful. 
I think it is fair to say that since this bill was introduced there have been some questions around the security of information held by the Crown. I am not absolutely certain that this bill would have had a clean run through the select committee process if it had been introduced 3 months or 6 months later than it was. I think that at that stage there might have been quite a lot more debate around it. But my view is that the principles that are involved in it and the legislation itself are OK. But I think that what has happened since—and I am sure there will be further discussion as we go through the Committee stage—will mean there will be more focus on security and proper arrangements around the legislation and on the examples of the multiple ACC leaks both the ones that hopefully might be viewed as careless out of the ACC and those that appear to have been deliberate which have come from sources yet to be finally established. But I think what we are focusing on at the moment is a Crown with a series of departments and other Crown entities where there are some real questions around the security of personal information. As we head into an electronic identity verification service people will want to know that their information is not going to be accidentally disclosed through this sort of system. 
It is not as if ACC has been the only case and it is not as if Judith Collins has been the only Minister in charge of the sorts of breaches that have occurred. There have been some in the Inland Revenue Department that I regard very seriously. I think the idea that one’s information is held by the Inland Revenue Department and that it is sacrosanct is something that is very important as it is frankly with Work and Income. The fact that there have been through the various portals the availability of and the fact of massive breaches is something that we will have to consider as we work our way through the legislation. Then of course more recently there has been the Novopay breach that became apparent over the last 4 or 5 days—the fact that a lot of personal information of individuals has been made available. I think all of those things slowly reduce people’s trust in the ability of the Crown as a whole to hold information securely. A system like this which is a voluntary system is going to depend on people trusting the Crown to hold the information. 
I think my colleagues know that some of my views on this information are somewhat different and I do not necessarily have strong views as others do in this area in that I think there are a lot of things that would be simpler. I think a small microchip in an earring could be something that would be quite useful for people carrying their information around and sharing it with Government departments. It would mean that you could have a consistent approach and the information could be updated and through that—well Mr Chairperson Tisch I think that as a rural member you would be aware of the advantages of eartagging and the electronic systems that are available. 
I might say that in my electorate the Times-7 group has some very good systems. They are somewhat questionable as to their privacy but they use it for conference systems that show where at a particular conference individuals are. People wear a tag either a badge or something on a lanyard around their neck and as they go through particular doors it shows that they are at this particular seminar or that seminar. I think unfortunately it has shown on a number of—[ 
Interruption 
] No it is not quite the same as the badges that we carry because one does not have to swipe these ones; one just passes through a door and one’s identity is recorded. But unfortunately for some people recently at a real estate conference in Auckland it recorded not only the fact that they went in but the fact that they went out and on occasions people’s long absences were noted and sometimes grouped and that I think led to some questions of privacy and lack thereof. 
I am sure that we are not heading towards that sort of system with this but what I hope and it might take 5 or 10 years and a development of trust in the Government and its ability to hold information securely and to respect people’s privacy—[ 
Interruption 
] Well a change of Government obviously. There has got to be a change of Government before that happens and a building of trust. But I hope that eventually this sort of system becomes more or less universal and that we do have standard systems that people are all prepared to be part of. I hope that in that way we have a simpler system and we do not end up with multiple systems with some people bringing their paper— 
DENIS O’ROURKE (NZ First) 
: 
 I will comment only briefly on Part 1 of the Electronic Identity Verification Bill. I note that it is intended to regulate the operation of the Electronic Identity Verification Service to give individuals using the internet the option of using a secure channel to verify their identities and to access services from approved Government and non-Government agencies. 
I myself like I guess thousands—probably tens of thousands—of New Zealanders use the igovt service. I find that it is a service that is secure very efficient very usable and a good means of doing business on the internet which of course does need to be secure and also needs to protect the privacy of individuals. That is the sort of service that we need in the country to be extended to other agencies and that is in fact what the bill does and intends to do. It is therefore one that New Zealand First enthusiastically supports. It is the way of the world these days and it is what is expected of the Government by the public. 
 The provisions of the bill will expand the service to all members of the public and will allow more agencies to use the service to identify their clients. As I have already indicated I think privacy is an extremely important aspect of this and one that I believe with the safeguards that have been provided in the bill is well catered for in the way that this bill has been put together. The Privacy Commissioner also of course has an appropriate role. 
Later I will have some comments to make on some aspects of that—in particular some comments to make later about penalties but that can wait until I think Part 3 of the bill. For the time being I wish to record New Zealand First’s overall support for the bill—indeed enthusiastic support for the bill—which is one that will be applauded by most members of the public especially those who use the internet a lot. 
CLARE CURRAN (Labour—Dunedin South) 
: 
 I would like to take a call in the Committee stage of this bill the Electronic Identity Verification Bill. Part 1 is talking about the principles that lie behind this bill and it is important to take a minute to think about what they are. They are about security of information they are about privacy of individuals’ information and they are also about having confidence in the system. 
As we have discussed in this House a number of times Labour supports this bill and we support the intent behind it. It is not a majorly controversial bill but what is controversial is the adequacy of information management systems in Government agencies—whether the public thinks that those systems are secure whether individuals’ information is actually kept private and whether there is public confidence in the system. I put to you today in this Committee that I do not think we can have any confidence right now that right across the Government agencies there are adequate systems in place to ensure that those principles are being upheld. 
The bill actually talks about secure channels of information for individuals using the internet it talks about accessing services from approved agencies and it talks about containing minimal personal information. I think in the current context all of those phrases should be ringing warning bells. I think one of my colleagues actually tweeted today in relation to the Government’s management of the economy and jobs and described it as an omnishambles which I thought was a very apt term. But I thought it was just as apt if not more apt in relation to this issue which is essentially about the adequacy and the security of individuals’—of citizens’—private information in Government agencies and how that is being accessed. 
That is what this bill is about so I think in terms of providing a recipe for confidence in the ability of the Government to deliver a secure verification service of any kind that today that is a bit of a joke. I wonder how the Government members can sit across there with straight faces and debate this bill while they have got enormous holes in IT systems—across at least four of their main agencies—that concern the privacy of New Zealanders’ information. I would also say that I think the confidence of the public in these systems has been shaken if not lost. 
In defence of the bill this service has been in place since December 2009—so it is not as if it is a completely new service that is being introduced—so that people can authenticate their identities and their interactions with the Department of Internal Affairs but in a very limited capacity. This bill is going to expand the availability of that service to all members of the public and allow more agencies to use the service to identify their clients and I think that is where the warning bells should currently be ringing until—until—it can be demonstrated that the public of New Zealand can be reassured that this system is going to provide the security that is required. That is why Labour introduced a member’s bill into the ballot last week titled the Electronic Data Safety Bill which goes to the very heart of this issue. 
I know that other colleagues are going to reference some of the other agencies that have been affected but recently as we all know a member of the public was able to download more than 7000 documents from the Ministry of Social Development’s network through the Work and Income self-service kiosks. Those documents included very sensitive information such as medical invoices about children in the care of Child Youth and Family personal information about people receiving benefits the names of people being investigated for benefit fraud the name of a person who had committed suicide and pay rates for individual contractors employed by the Ministry of Social Development. Those things are very serious. Previous breaches have occurred in other agencies. We know they have occurred in the Inland Revenue Department we know they have occurred in ACC and we know they are occurring currently in the Novopay system through the Ministry of Education. Previous breaches in other agencies have highlighted the need for a systematic inquiry into the adequacy of information management systems in all Government agencies which is what this bill seeks to address. 
So by all means let us put this bill through the House but before we do that let us have a bit of a look at the adequacy of information management systems across all Government agencies so that the people of New Zealand can be reassured. Let us put in place and make sure that there is an adequate system for information management across all Government agencies that they have robust protocols that they are resourced adequately with the correct level of skills and that that management system has a governance that transcends the individual agencies and then let us look at bringing this particular bill through the House. 
I would say that the big issue for us to be discussing right now is the culture. This is a culture issue around privacy and security in the Government agencies. It is the responsibility of the Government to ensure that that culture is the right culture to ensure that the privacy and security of information can be assured. That is what needs to be changed within the public sector if we are going to stop these sorts of things happening. 
Just going back to the Ministry of Social Development kiosk debacle the thing is that we know that the report showed that the issue was known about back in 2009 and that people were reminded a number of times about it. The report that was commissioned was good but we need to be assured that the ministry is actually going to take note of all the recommendations that have been made and of all the security-related issues that have been identified. The issues that were identified in 2009 were paid lip-service to essentially. They still pressed ahead with the kiosks. They called the network issues an acceptable risk. But if there was proper IT governance and accountability it just simply would not have happened. That accountability and governance need to happen at the highest possible levels. The project should not have progressed until it had been signed off by somebody senior who was an accountable professional and who could make damn sure there was a proper elevation structure in place that did not proceed with those issues unresolved. That is what the problem is. 
If we are looking at introducing and widening another system which is what we are debating today then where is the accountability on it and where is the accountability on the other side of the House around all of these issues at the highest possible level not just in one agency but across all of those agencies? It has been put to me by the industry that as with every other profession and vocation there is professional accountability. It is imperative that the Government is involved in ensuring that there is a minimum level of experience education and ethics for senior professionals who are in a position to sign off major projects and then holds them professionally accountable for those standards in the same way as in every other field. 
I would like to put it to you today that although this bill is supported by Labour it is raising warning bells again around another system that is being put in place without the appropriate measures behind the system that is being widened. In at least four major agencies across this Government there are serious systemic problems and they need to be addressed. 
CHRIS AUCHINVOLE (National) 
: 
 It is a pleasure and indeed a privilege to stand and speak in favour of this particular bill the Electronic Identity Verification Bill. I too would like to acknowledge the chairmanship of Ruth Dyson and the contribution by actually all members of the Government Administration Committee. It is a neat little select committee the Government Administration Committee. It is small. It allows for a lot of consideration and a lot of good debate. We have an interesting blend of experience. A bill like this one in spite of the last two speakers’ contributions is basically not really a partisan bill. It allows for open consideration. Indeed that was the way it was handled. It was a pleasure to handle. It was particularly good to receive the carefully considered responses of officials to the points we raised and there were a number of issues that were taken into account. So from that point of view as I said it has been a pleasure to be involved with this bill. 
I have been listening carefully to the contributions that have been given so far and I think there were some take-home points brought up by the Hon Trevor Mallard who said that there is anxiety over electronic sharing. That was something that we very carefully considered in considering this bill. Listening to the last speaker Clare Curran she went to some extent to express her concern. Indeed I was put in mind to some extent of H G Wells’  
The First Men in the Moon 
 and the concern about Selenites and central control. I was reminded of  
Nineteen Eighty-Four 
 George Orwell’s novel of the horrors of our future and indeed of Alvin Toffler’s  
Future Shock 
. In the film of it they had Orson Welles smoking and shrieking out: “We live in an age of anxiety. We are the victims of our own technological strengths. We are the victims of future shock.” I can remember when  
Future Shock  
came out. It gave people a little bit of concern. Life did not actually turn out that way though. Life did not turn out that way. 
Although I think the criticism that has been expressed by the previous speakers of things that have gone wrong is fair let us remember that it is always important to view systems with great care and with great recognition of human error technological deficiencies and unforeseen vulnerabilities. This is what happens when you introduce new systems. The development of trust is something that will come only in my view with experience. I do not make light of the seriousness of the technological errors that have occurred and have been referred to today but it does let us remember take an exception to prove the rule. It is not as if the problems that have occurred have been ignored. They have been and are being attended to and were taken very seriously. 
So with this particular bill what does it do? Let us look at Part 1. Basically the bill contributes to the Government’s reforms to achieve better public services—in particular result 10 of the Better Public Services programme which is that “New Zealanders can complete their transactions with the Government easily in a digital environment.” I remember being approached by a constituent in Motueka who said that I could repeat his story. It is the story of his son who is in his 20s. His son has an incurable condition and it requires him to liaise frequently with up to six or eight Government departments. He consistently has to produce fresh identification information in hard copy—original documents and all that sort of thing—on a very frequent basis. It is tedious. It just emphasises to the family again that he has this difficulty in which he is not going to get improvement. One of the consistent questions that he is asked is whether his condition has improved. He has a condition that will not improve. And so I think back to him when I see that invalids who repeatedly need to supply information will be able to do so electronically using this identification system. I think of all the times when as a rural-based JP we had people come fair distances for me to verify copies of identification. All these things will be far better dealt with. The other parts of the debate— 
KRIS FAAFOI (Labour—Mana) 
: 
 It is always a pleasure to follow Mr Auchinvole. As he started with a pop culture and film reference I would like to do the same and remind everyone of that movie in the early 2000s  
Enemy of the State 
. It is a good movie where Will Smith a simple US lawyer had his identity stolen. Although that was a beaten-up Hollywood story there is serious concern— 
Andrew Little 
: I thought it was a documentary! 
KRIS FAAFOI 
: —it was not a documentary it was a Hollywood film—out in the community and tension in the community. As my colleague the Hon Ruth Dyson mentioned now we are living in a much increased digital age people are very concerned about the worry of identity theft. We have all received those emails from the ASB bank or whatever bank you may be a customer of asking for your details. We know to just delete them but unfortunately there are some people out there who do respond to them and find themselves having their bank accounts cleaned out. 
I want to just reiterate also at the beginning a theme that a number of my colleagues have mentioned and that is that the journey of the Electronic Identity Verification Bill would have been much different if it had happened in the context of recent events around the security of information at a number of Government departments. They have been mentioned and I will revisit them later. I would imagine that if this bill had gone through the select committee process in that context there would have been a lot more opposition and scrutiny of the details of this bill— 
Andrew Little 
: A lot more evidence. 
KRIS FAAFOI 
: —a lot more evidence and a lot more submissions than just the 12 that the Government Administration Committee received. Kudos to the select committee. Apparently it worked well to ensure that this legislation was improved and it has arrived as Mr Auchinvole mentioned in a non-partisan fashion before Parliament in a much better state than when it arrived at the first reading. 
Ruth Dyson did say that there was some tension between the digital age and concern around privacy but I think there is also a fair bit of concern in the community around the digital age and frustration amongst the public at having to repeatedly physically offer up documentation around their identity. I know we have all probably had people in our electorate offices who are sick and tired of having to repeatedly supply that whether it be their address their birth certificate or their marriage certificate. As Trevor Mallard mentioned this is something that is being rolled out to make sure that we can improve efficiency relieve some frustration in the community and streamline the process when we are dealing with the likes of Births Deaths and Marriages in the Department of Internal Affairs. 
I want to point to the bill and to Part 1 clause 3(1)—the purpose clause—“The purpose of this Act is to facilitate secure interactions (particularly online interactions) between individuals on the one hand and participating agencies on the other.” I just want to focus in on those two words “secure interactions” and take stock of the recent events that have happened with the Ministry of Social Development and the kiosks that Keith Ng accessed. He managed to download from those kiosks 7000 documents which were publicly available to anyone who walked into a Work and Income office around the country. For this igovt system to work our public need absolute confidence that their basic details are going to be held securely within the departments concerned. Although Mr Auchinvole did have a bit of a gibe I think it is absolutely appropriate for the Opposition to point out that the Government should take stock of what happened in those instances and look very closely as to the security of the information that is concerned here. 
When we have got a large ministry like the Ministry of Social Development having publicly available kiosks where 7000 documents can be accessed by anyone off the street—and we are talking about the names of people who have committed suicide invoices medical records—you have to start questioning the capability of the Government to manage information within our Public Service. That is a fair question to ask—absolutely fair. And you put that in the context of other ministries that have come out and absolutely and utterly—and rightly so—confessed that they have had privacy breaches as well. I understand that the Ministry of Justice came to the fore and said: “Look we’ve had a potential breach as well.” My colleague Dr David Clark has talked about the 6300 individuals affected by a privacy breach in the Inland Revenue Department. 
I think it is absolutely appropriate in the context of this bill which we support and hope that the Government can bring in and get right that we ask the questions as the Opposition to make sure that the security of this information is going to be appropriate. There is as I said massive concern out there in the community about the privacy of personal information and about identity theft. I think that the confidence of the public has been shaken by those misgivings about the Ministry of Social Development and I think they are disappointed that this could happen to such a large extent. The nature of the information that was let out through those kiosks and the sheer number of documents that have been accessed really did shake the confidence of the public in the ability of the Government to protect this basic information. 
This legislation is a sign of the times. We are going to have more and more of this type of information as we are well and truly into the digital age. As our lives change to have more online transactions we are going to have more and more legislation in this House to govern those transactions and how we interact online so we need to get these kinds of things right. That is why we in this Chamber although we are standing in support of this bill need to make sure that we ask the appropriate questions so that the public out there who are going to be interacting with the Department of Internal Affairs and important departments like Births Deaths and Marriages and Passports have absolute confidence that their information is being securely looked after. 
Identity theft is a major worry. We actually had a member of a former Parliament in here who many many years ago committed what I believe was a case of identity theft. Identity theft is not new but I think it is due to the fact that we are living in an age where information can be much more easily accessed online that it is becoming much more pervasive in our community. That is why I think this bill is certainly apt. 
The ability to opt out of the system is important because although I think about 86 percent of New Zealanders are doing something online not everyone is confident that they want to put all their details—whether they be bank account details birth details or anything like that—online. So we need to make sure that there is the option the ability for those who are not confident to transact on the internet to opt out and to be able to do things more traditionally—more old-school as you might say—to ensure that their needs can be looked after in an age when much more is going to be done online. 
We also need to think about those people who because of their financial ability cannot transact online. I know that there are certainly a lot of families in my community in the electorate of Mana who do not have the ability to have internet accessibility who do not have a computer at home. We are hoping that we can make that much more accessible for them but until then they do not have the ability to transact online with the likes of the Department of Internal Affairs so we need to make sure that the ability is still there for them to do what they have traditionally done—some may find that frustrating—and be able to interact offline with the Department of Internal Affairs. 
Also as my colleague Ruth Dyson said as aged-care spokesperson for the Labour Party there are a lot of older people in New Zealand who although they may be proficient online and they may be able to do some simple things online would not be confident to be able to do the likes of the transactions with the Department of Internal Affairs that we are talking about here. So we need to make sure that they have the ability to do that. 
Just to conclude we do support this bill. We are very concerned in the context of recent events around the privacy breaches that have happened under this Government’s watch with Work and Income and with the Accident Compensation Corporation. One that I have not mentioned is the Ministry of Education and Novopay which is obviously a big concern. Those members over there will know that they have got teachers in their electorates who are very upset about privacy breaches and also their inability to get paid. So in that context we hope that the Government does take heed of the warnings that this party has made in terms of making sure they get the security of information right and making sure they do that properly. 
TIM MACINDOE (National—Hamilton West) 
: 
 I move  
That the question be now put 
. 
Motion agreed to. 
Part 1 agreed to. 
Part 2 Electronic identity verification 
The CHAIRPERSON (Lindsay Tisch) 
: We now come to the debate on Part 2 and schedule 1. 
Dr DAVID CLARK (Labour—Dunedin North) 
: 
 Part 2 of the Electronic Identity Verification Bill contains the majority of the actual implementation of this particular measure so I am very pleased to speak to Part 2 of this bill because my concern which I hope the Minister in the chair the Minister of Energy and Resources will be able to address is around the ability of the Government to implement this measure. The Inland Revenue Department computer system is something that has caused great public concern in recent times. There have been 32 reported breaches in the calendar year between September 2011 and September 2012. For over 600 people the breach was considered severe enough for them to be contacted and followed up by the Minister for Social Development. In those breaches 6300 people actually had their private details released and it is not clear yet why the Inland Revenue Department did not think it worth following them up why it should be that people should not be told that their privacy has been breached as a result of ineffective security systems as a result of errors in the department and so on. 
I want to say that Labour will support this bill because we support the principles behind it as were enunciated in Part 1 but in Part 2 the real question is: can this be enacted? Can these measures be enacted? In the Inland Revenue Department’s case we have a 20-year-old system. It is needing according to Mr Key a billion dollars spent on it in order to upgrade it to replace it and to bring it up to scratch. Mr English is on record as saying that $700 million of the asset-sales money will be spent on the system. Mr Dunne is on the record as saying “Don’t ask me any questions. Those decisions are going to be taken as a result of the Budget process.”—effectively saying “Nothing to see here.” I have serious concerns because this is a department under incredible stress and we are seeing bills now coming through the House that take backward steps. The Government says “We are implementing this in principle.” and then later on has to follow up with legislation that says “Actually we’ve realised we can’t implement these changes and we now have to change the goalposts. We have to move the goalposts to a place where we can put the ball through.” That raises a serious question about whether we should be considering this legislation now or whether it is actually premature given that it may not be able to be implemented in the way that is intended. 
I am deeply concerned about the breaches at the Inland Revenue Department and also those at ACC at Work and Income and at Novopay. I have certainly heard whispers around my electorate of other Novopay breaches that have yet to be publicly alerted so it is not over yet. I am sure there will be more breaches coming to light. When I became aware of the Inland Revenue Department breaches I did a quick calculation and realised that if the current rate of breaches continues in a little over a decade it will be one in 20 New Zealanders who have had their privacy breached by the Government—if the current rate of breaches continues. That is outrageous. It is absolutely outrageous if one in 20 New Zealanders has to put up with their private details being breached by Government systems that are inadequate that are not up to the task and that do not take seriously the trust that New Zealand citizens put in them. 
David Bennett 
: Come on David sit down. You know you’re telling rubbish. 
Dr DAVID CLARK 
: Mr Bennett on the other side of the House there is uncomfortable with these facts and figures and is wanting to put that on record. He should come across the floor and join a party where Davids can get ahead. I know his heart is in the right place but these are serious serious issues that we are raising. 
These are serious issues where four out of every thousand Kiwis have had their private details breached in the last 12 months and where one in 20 will have their private details breached if this is not addressed in the next decade and we see a Government that has no plan. In the case of the Inland Revenue Department the Government is yet to outline a plan. John Key said in February this year that it would cost a billion dollars to upgrade the Inland Revenue Department computer system. Now 9 months on we do not have a single plan in place. We do not have a credible timetable outlined. We have no idea how the Government is going to make sure those systems are secure. Now in front of us is a piece of legislation that talks about the electronic identity verification that should be in place. We know that this is a good idea. There is no doubt that having electronic identity verification in place is a good idea but can the Government actually deliver on it? That is the question that I am asking. 
The Inland Revenue Department to cite some further examples failed to return 70000 phone calls in the 2 weeks prior to the last GST filing period. 
Hon Ruth Dyson 
: What? How many? 
Dr DAVID CLARK 
: 70000 phone calls. 
Hon Ruth Dyson 
: A year? 
Dr DAVID CLARK 
: That was in 2 weeks. That was in 2 weeks I say to my colleague prior to last year’s GST return period. 
There are over a million unprocessed returns in that department and we have $7 billion in outstanding debt—$7 billion at the Inland Revenue Department in outstanding debt. It is little wonder that it has had a 33 percent turnover rate in the call centre in Wellington that handles many of these complaints. Those at the coalface are feeling the pinch because we have a Government that has not stepped up to the plate and that is not addressing the concerns raised by a computer system that was put in place in 1992. That is 10 years prior to Facebook that is prior to Google and that is prior to the internet as many of us know it. There are even members of Parliament who were not born then I think—oh no I might be getting a bit premature there. But this system is nearly as old as some members of Parliament. We have had a 4 percent drop in the tax take under the watch of this Government so there are serious serious issues in that department. This bill would say that that department has to put in place a system that implements a system of electronic identification. I am not convinced at all that this department will be able to do it. 
We also know that the Inland Revenue Department does not and cannot currently—and the Minister in the chair can correct me if I am wrong on this—reset passwords. It cannot even reset passwords electronically. If you have got a department that is struggling with issues as simple as that in terms of its computer system—John Key refers to it as a pig of a system a pig of a system. Those words are from the Prime Minister’s own mouth. Nine months on we do not have any idea how the Government is going to address that system. 
We have a bill with more aspiration in it but we see no progress. How can the confidence of the New Zealand taxpayers be restored? It is being shot to pieces—shot to pieces—by the breaches this Government is making: ACC breaches Inland Revenue Department breaches Work and Income breaches and now Novopay breaches. What we are seeing is a pattern. What we are seeing is a clear pattern. We have some talk about how these things are going to be addressed then often we have a retraction but we do not have any credible plan outlined as to how these problems are going to be addressed. New Zealand taxpayers give over their private details in good faith—in good faith—and good on them because people do need to pay their fair share of tax. They do need to sign up for the various Government services that are available. But they are getting nervous because of the inaction of this Government. So although Labour will support this bill because it supports the principles in it we hold very very deep concerns about the Government’s ability to implement these changes. 
JAN LOGIE (Green) 
: 
 I would like to make just a very brief call on behalf of the Green Party to offer our support for this bill the Electronic Identity Verification Bill as well in the Committee stage and actually to raise our voice to share some of the concerns that have been raised by our Labour colleagues. Our reasons for supporting the bill are primarily about easing citizens’ engagement with the State through a variety of different agencies. We know there is a need to ease that engagement. All too often people are being required to bring information again and again and again and are being sent away from appointments which may have taken them some time to get because they do not have the required information. It is our deep hope that this bill will go some way to alleviating this problem. That is the reason for our support. 
We also though do have concerns around privacy issues—clearly. We have heard of a number of Government departments recently—ACC the Inland Revenue Department the Ministry of Justice the Ministry of Education with Novopay and Work and Income—that have all had very significant privacy breaches. We are interested and we expect to hear that possibly other departments have also had privacy breaches. We are seeing at the same time coming through this House a range of bills and amendments to other existing legislation that seek to change basic legislative arrangements for and protections of people’s privacy. It makes sense that we do that as technology develops but it is also incredibly important that we take the duty of care to ensure that it does not undermine people’s confidence and ability to place their trust in the State. We have no choice on many occasions but to engage with the State. It is essential that we can trust that our information is kept secure in that process. Sadly at the moment we cannot necessarily have that trust. That is a very worrying situation. 
We see that there are many reasons for these breaches of privacy that have happened. My colleagues have mentioned the culture within some of the Government departments that does not prioritise privacy. We hope this bill will actually help to put it high up the agenda as we hope the breaches will as well. Another reason that has been mentioned for some of the breaches of privacy is a lack of expertise in terms of information technology within the departments and the fact that a lot of the systems that have been set up in-house were set up in another time. We hope and trust that the Department of Internal Affairs and every other department that does engage in this process will ensure they have the appropriate information and communications technology expertise to ensure that privacy is protected in this process. 
The digital divide is another aspect that I would like to just mention. I hope this bill is also a stimulus for each department to consider how it can provide the same ease of access for people who do not have access to online technology: older people people on low incomes people who have English as another language—all of those groups. If we provide a service only online we will get a lower-quality service from our Government. I do not believe that is good enough and I think that this bill could be a spur to consider what assistance we could put in place to help those people get that information online so that they too can get the benefits of this bill. So I hope to see those policy initiatives come out of this bill. 
On that note again I will mention the Green Party’s support for this bill which is a bill of its time and we are pleased to support it in that context. 
KRIS FAAFOI (Labour—Mana) 
: 
 Mr Chairman I know you had a lot of choices to make. Thank you for giving me the chance to speak on Part 2 of the Electronic Identity Verification Bill. As I said in my contribution on Part 1 the public need absolute confidence in the security of the information for the igovt system to be expanded out beyond what it has operated under since 2009. As a number of speakers have said already in the debate on Part 2 there is a certain amount of unease with the public—and I think that is probably being a bit kind actually—about the ability of a number of Government departments to securely hold private information given the recent events. At the risk of mentioning these ad nauseam we have already spoken about the privacy breach in Work and Income— 
Chris Auchinvole 
: Ad nauseam. 
KRIS FAAFOI 
: —thank you Mr Auchinvole—with the kiosks there. We have talked about the privacy breaches with Bronwyn Pullar with the Accident Compensation Corporation. We have spoken about the thousands of people who were affected by the Inland Revenue Department breaches. We have talked about the Novopay transgressions with some of the personal details of teachers from schools— 
Louise Upston 
: Are you talking about the specific part? Because that would be kind of useful. 
KRIS FAAFOI 
: I will get to it—I will get to it. Just hold on. Taihoa—taihoa. Patience—patience. What I would like to talk about in terms of Part 2 is clauses 20A through to 21B and they are about access—access—and who is allowed to access the information that we are going to be talking about expanding within the realms of the Department of Internal Affairs and the likes of Births Deaths and Marriages and Passports. Clause 20A in relation to access says “Access to core identity information and status information. An individual may access—(a) the core identity information contained in the individual’s electronic identity credential: (b) information about the status of the individual’s electronic identity credential.” That sets out in clause 20A in terms of one aspect access to this information. 
But who is going to monitor that? That is one question I would like to have answered from the Minister in the chair the Minister for the Community and Voluntary Sector. Also who is responsible in the Government about giving assurances given the context of what has happened recently about the security of that information and exactly who can access that information? As I have said before we have had a number of instances and they have really rocked the confidence of the public in the ability of this Government to hold private information. In Part 2 clauses 20A through to 21B do talk about who can access this information. I want to hear from the Minister in the chair about who is going to give the assurances that this is going to be monitored and who is going to give the assurances as to how there will be any punishment if the provisions within clause 20A to clause 21B are not adhered to. 
There is a massive amount of public concern about you know the likes of Work and Income the likes of ACC and the likes of the Ministry of Education around their ability to hold private information. So we think it is only fair that we are asking these questions of the Minister in the chair in respect of access—who can access this information—and about the assurances this Government can give in the context of recent times because there is a serious lack of confidence and that lack of confidence is probably well founded given what has happened in the last 3 or 4 months. 
In terms of Novopay—that is a new one that has come out. There are a number of teachers whose personal information has been sent to an incorrect school and the media reports suggest that that gave administrators at one school the ability to access or to manipulate the finances or the pay of that particular individual. That is quite shocking given that this is a secondary issue with Novopay; it is not the primary issue with Novopay. The primary issue with Novopay as we know was the complete inability for it to meet its purpose of paying teachers on time and correctly. So that latest issue with the Novopay system is just another instance of where a Government department has really not met the mark and you have got to ask the question around governance and whether there is enough monitoring being done. 
I know there has been an inquiry into the leaks of information at Work and Income. We on this side of the Chamber hope that it is actually acted on because it is a very serious case when you have one individual who can access 7000 files of information of the likes of invoices medical records and information about children and where they are staying under protection orders. That kind of information being publicly available to any Joe Bloggs who can walk into the reception of Work and Income would shock most people and has shocked most people. Therefore there is subsequent concern around the ability of the Government to assure New Zealanders that it can be trusted with private information. 
We have had instances of Ministers quite liberally throwing around private information and that is shocking in itself in a political way but when you get instances of the average Kiwi who has done nothing and is in a very—what is the word I am looking for—vulnerable position and they have had their information— 
David Bennett 
: It’s called David Shearer—vulnerable position. 
KRIS FAAFOI 
: Oh I am glad you find it funny Mr Bennett. Kiwis who are in a vulnerable position who have had family members who have committed suicide or are in protection situations—for their information to be freely available on those kiosks is a concern. That is why we are asking some serious questions and I hope that the Minister in the chair does take the opportunity to answer these questions. Who is going to access this information? Who is going to monitor the access to this information? And what is going to be done if this information is either incorrectly accessed or dispersed to people who should not have that information? That is I think given the bipartisan way in which the Government Administration Committee worked on this bill a fair enough question to ask given the times. 
Also I have just one more point on the access. There will also be provisions in clause 20B about access to photos which is in this digital age very important because if you have a legitimate or seemingly legitimate image of someone or something it lends legitimacy to someone on a social media site. So there are very tight restrictions about who can access photos that are held within this realm. Obviously if we are dealing with the likes of Passports you do not want those photos floating around too widely or to be accessed by the incorrect people because then it makes much easier the work of people who target the security of passports and we know that in recent years there have been a number of instances where that has certainly happened. So to have some clarity around that within clause 20B “Access to photograph” in Part 2 is very good and we hope that maybe the Minister in the chair could also clarify for us what the provisions might be in terms of assurances for the security of photos as well— 
Hon Ruth Dyson 
: I think a new provision. 
KRIS FAAFOI 
: It is a new provision? Was it inserted by the select committee? It looks like it and Ruth Dyson the chair of the select committee would know. But maybe just to reiterate the Minister in the chair could assure us around the security of those images because as I say images in this digital era are very very important. They lend legitimacy especially to official transactions and when we are talking as I have mentioned before about the likes of transactions with Passports or with Births Deaths and Marriages—I think it would probably be only in the case of Passports though—the security and the good reputation of the New Zealand passport could be seriously at risk if we do not have tight controls over who can access the images that are held within the system that the Department of Internal Affairs has. 
I want to just reiterate that we are supporting this bill but I have asked a number of questions of the Minister in the chair and I hope that at some stage during the debate on Part 2 of this bill the Minister in the chair will be able to elaborate on some of the questions that I have put to her concerning access to this information under Part 2. 
Part 2 agreed to. 
Sitting suspended from 6 p.m. to 7.30 p.m. 
Part 3 Miscellaneous provisions 
Hon RUTH DYSON (Labour—Port Hills) 
: 
 Thank you very much for giving me the opportunity to speak on Part 3 of the Electronic Identity Verification Bill. This is one of two bills that the Committee will be considering during the course of the evening relating to very similar activities. 
I want to just draw your attention to the fact that over the dinner break—there are always interesting conversations are there not that occur over the dinner break—this evening there were several conversations happening at the table that I was at. My friend and colleague Kris Faafoi was talking about his children and referred to one of them by his nickname Freddie. At the other side of the table Annette King who was listening misunderstood the conversation thinking we were talking about Freddie Mercury and started talking about how fabulous Queen was. Then somebody else at another part of the table thought we were talking about the royal visit. It actually was quite confusing. I can see that the Minister in the chair the Minister for the Environment is very intrigued by it. It brought us to the point of saying how important clarity of identification is which is actually the very point of this legislation—to ensure that— 
Hon Amy Adams 
: It’s a long way round. 
Hon RUTH DYSON 
: Well you know elaboration can sometimes be of assistance. I look forward to my neighbour from Canterbury the Hon Amy Adams taking a call. I am sure she will make a fine contribution in this debate. 
I had the pleasure of chairing the Government Administration Committee. As the Committee will notice in Part 3 “Miscellaneous provisions”—sometimes when you get to miscellaneous provisions you think “Well there’s not a lot left in this bill.”—there are a few quite significant amendments that have been made by the select committee. Perhaps more important and I will speak on this in a later call Supplementary Order Paper 128 which is the only Supplementary Order Paper that I have yet seen tabled in the name of the Minister of Internal Affairs the Hon Chris Tremain who has not yet taken a call—I am sure the Hon Amy Adams who is standing in for him in the meantime will do a fine job—actually amends this part of the bill. 
In clause 54 which is the first clause in this part the select committee removed the entire original drafting and replaced it. It is pretty important to note the specificity of that given that the clause is dealing with the Official Information Act. We obviously had concerns about information obtained under the Official Information Act and we wanted to make sure that the relevant sections that are described in clause 54 are in fact adhered to and to ensure that there is clarity in the relationship between this bill the Electronic Identity Verification Bill and the Official Information Act. The select committee clarified in paragraph (a) that “sections 20A to 21A are given precedence by section 52(3)(a) and (b)” of the Official Information Act. Paragraph (b) of the new clause 54 states that “section 39(3)(b)(i) incorporates by reference provisions” of the Official Information Act. Paragraph (c) of the new clause 54 says that “section 48(2) extends the application” of the Official Information Act. That was quite a significant change. As I said often when you get to miscellaneous provisions in a bill you think they are not going to arouse much of a debate but we did have a lot of discussion about this clause at the select committee and as I say the Minister’s only Supplementary Order Paper is referenced through this part. 
Likewise with regard to the next clause clause 55 we replaced subclauses (1) and (2) to ensure that the relationship was really clear between this current bill—soon to be an Act I hope—and the privacy legislation. Of course we had a lot of discussion about the privacy legislation. It was discussed much more than the Official Information Act. There have been a lot of concerns expressed in the House about use and abuse or potential abuse of the privacy legislation. I remember that the Minister for Social Development some time ago was attacked—well her policy was attacked—in the paper by two women who were on the domestic purposes benefit who had been in receipt of the training incentive allowance and were undertaking university qualifications. That is a jolly fine thing for anyone to aspire to but particularly women who are trying to raise a child on their own. For them to be able to take that additional leap is a big thing and we as a Parliament and as a society should support it. They dared to criticise the Minister’s policy to reduce the application of the training incentive allowance so that it did not cover the very qualifications that they were going for. 
At that time Paula Bennett released their private details. It was not a leak. She was very open about the fact that she had released their private details. But what was of concern to me and I know many others was whether it was actually a breach of the particular women’s privacy when those details were released—whether it had application under the Privacy Act. So a proceeding was taken under the human rights legislation. Paula Bennett wrote to that office about this issue and said “I acknowledge that you consider that I was wrong to do so and that this resulted in a breach of Ms Fuller’s privacy. As you also know I don’t accept that view.” So you can see in that example of actions in relation to one’s individual privacy that people have very different views about what is acceptable and what is not. 
In a previous contribution prior to the dinner adjournment I heard my colleague Dr David Clark from Dunedin North talk about breaches of privacy through mistakes made by staff often because of electronic transfer of information. With the Inland Revenue Department mistakes thousands and thousands of New Zealanders have had their personal information transferred electronically to the wrong person by the Inland Revenue Department. In the last year the Inland Revenue Department has sent the personal information of 6300 people to the wrong people. That is a huge number of people. When we are talking about people under this legislation giving authority for their information to be accessed by that department or by other departments to perhaps be shared these are the sorts of concerns that we have to be really aware of. We as a Parliament have to be very rigorous to ensure that the concerns that have been expressed in relation to Work and Income breaches—not only when the Minister so boldly defied the Office of Human Rights Proceedings deliberation but also of course more recently with the Work and Income kiosk shambles where despite repeated warnings Work and Income continued to leave vulnerable people at risk of having their personal information accessed—are addressed. The incidents I have just referred to in terms of the Inland Revenue Department and its releasing personal information are the issues that have to be paramount in our consideration as we work through Part 3 of this legislation. 
The final point I want to make is in relation to offences and penalties. It is really clear that our select committee from its consideration considered that there should be no tolerance of breaches of the provisions here. Of course if people are a little anxious about an electronic transfer system but see a conviction made under it and some appropriate penalties dealt out then their confidence in the system will increase. I would prefer that there were no breaches of access to identification at all but if there are whether they are by accident or done willingly then we must certainly have appropriate provisions. Clauses 56 through to 61 cover those offences and there were very few alterations that the select committee made to them. 
The next section of Part 3 deals with liability and once again you will see that the select committee made some significant changes. They were more technical than policy-driven in that area. Subclause (1) under clause 61 “Protection from liability” has been replaced but that was not a significant policy area at all. The remaining clauses of Part 3 deal with regulations. 
I look forward as I said to the Minister in the chair making a contribution to this debate. There has been a bit of work that the select committee undertook. First of all we were a bit puzzled about why we had two bills with such similar names that appeared on the face of it to do quite— 
DENIS O’ROURKE (NZ First) 
: 
 As I have already said New Zealand First supports the Electronic Identity Verification Bill overall. There are some aspects in Part 3 however that I do wish to comment upon. First of all relating to unauthorised hacking deleting and altering of information in respect of clause 56(3) New Zealand First does approve of the penalty increases there for individuals being up to $250000 or 10 years’ imprisonment and for organisations being up to $1 million. The point here is that these are significant penalties and they need to be significant because we need a very strong deterrent for these sorts of activities these days. One could list many and various instances when very severe cases of hacking and altering of information has occurred in many areas both in the public and private sectors. The point however is that significant penalties are very important so that is supported. 
However when I look at clause 58(1)(a) relating to unauthorised access I said in an earlier speech that I thought it would be wise to add an offence of attempting to access after the place where the word “access” is used in the clause and also to expand it to define what would constitute an attempt. I find it a little bit difficult to know whether access needs to be a successful access or a complete accessing of information or whether some sort of an attempt to do so would itself be a sufficient offence for the purposes of the bill. I would have liked to see some amendment of that particular clause to cover that kind of issue. Of course it is not too late to do that. Perhaps the Government could have a look at it. Similarly the same thing arises in clause 58(3) where again the words “attempts to use” are specified. Again we could add something about “attempts” in that section too. I think it is very important indeed that the bill should specifically cover attempts so that we know what is meant by access and we know what is meant by an attempted access. 
Moving on when I look at penalties I think the Government should also reconsider clause 58(4) concerning accessing of information and using information because I think that we need higher penalties than are specified there. I think they should go up in respect of an individual from 2 years’ imprisonment or a $50000 maximum fine to up to 5 years’ imprisonment or a $200000 fine. For corporations I think it would be appropriate for the penalty to be raised from $200000 which for many corporations is not a huge sum of money to at least $500000 for the illegal accessing and using of information. I think that we need to understand that the possibility of commercial gain from some of these illegal activities is quite large especially for corporations. We need strong penalties to deter that sort of behaviour. Organisations that hack information would be doing so for commercial gain and they cannot be imprisoned so we need to have very high financial penalties. That is what we in New Zealand First would like to see. There might also be other possible penalties such as deregistering a company but at the very least much higher financial penalties are warranted. 
In respect of the regulating powers New Zealand First agrees with new clause 65A concerning regulations to prescribe the length of time that electronic identity credentials photographs records of usage history status information and technical codes are retained after their cancellation revocation or expiry. We also approve in particular of the requirement for the regulations for these purposes to be subject first to consultation with the Privacy Commissioner. I think that is very appropriate indeed. New Zealand First also approves of allowing a different duration to be set in regulations for electronic identity credentials issued to children under 14 years of age because of course children’s appearances change dramatically as they age and generally they hold fewer identity documents which can limit the effectiveness of biometric checks on them. With those reservations and some of those suggestions which we think would improve the bill New Zealand First would be very happy to support all parts of it. 
Hon AMY ADAMS (Minister for the Environment) 
: 
 I am going to take just a brief call on Part 3 of the Electronic Identify Verification Bill to address the points raised by the New Zealand First member Denis O’Rourke in his last contribution. Mr O’Rourke expressed some concern that there was no provision making it an offence to attempt to carry out those particular actions listed in clauses 56 58 and others. I just wanted to reassure the member that the reason there is not a specific provision making it an offence to attempt those actions is that it is an offence under section 72(1) of the Crimes Act and the way legislation is drafted is that we have it in the Crimes Act rather than repeating it in every piece of legislation. That is a fairly standard approach to drafting. The point was considered and I can assure him that it is in fact an offence to attempt to carry out any of those activities that he talked about. 
The other point that I thought I would just briefly address is his concern around increasing the penalties and just assure him that the reason the penalties sit where they are is to ensure that they are at an appropriate alignment with similar offences in other legislation. As he will understand that is a core part of good drafting. In this case they have been lined up with a number of similar offences such as for example the use of electoral information for a commercial purpose under the Electoral Act. In order to maintain proportionality with similar related offences they have been set at that level. I hope that clears that up for the member. 
KRIS FAAFOI (Labour—Mana) 
: 
 Thank you very much Mr Chair for offering me the chance to speak to Part 3 of the Electronic Identity Verification Bill. As I said in my contributions in Part 1 and Part 2 it is absolutely fundamental that if we are going to roll out this Igovt system and expand it out through what is already existing the public need to have 100 percent confidence in the security and the monitoring and also the consequences if the laws—as they stand or as they are proposed—are transgressed. There are grounds for serious concern within the public because of the number of recent glitches in the security of private information that we have seen in a number of Government departments. Of course there has been most recently Novopay where the private details—[ 
Interruption 
] Yes “No pay” I should say. There have been instances when the private details of teachers have been forwarded on to schools where they do not work. There was a case with ACC where the details of over 6000 individuals were sent to one individual. There has been the case of the Inland Revenue Department and 7000 individuals affected there and then of course we had the Ministry of Social Development and the cases of the kiosks where one individual was able to access quite a lot of sensitive information. I do want to talk about that in respect of Part 1 and Part 2 and especially around access and then the provisions in clauses 56 to 60 I believe which cover the penalties if someone is found to improperly access information that is held within this realm. 
During Part 2 I did ask the Minister in the chair for some assurances given the concerns that would be out there in the public at the moment around security about whether or not the Government departments involved in this legislation have done enough to assure the New Zealand public and the Minister that the information involved is safe. I also asked the Minister in the chair what level of monitoring is going to be carried out given the fact that I believe in the case of the Ministry of Social Development there were some flags raised about 6 months—or a year I think it may have been—before the issue was highlighted in the media. Nothing was done publicly at least from the time that that was raised privately until the issue was raised by citizen journalist Keith Ng. I think if it is still possible to get a reply from the Minister in the chair the Minister for the Environment about the level of monitoring that would be good. 
I mentioned Keith Ng and I also want to ask the Minister in the chair whether there was any talk or any possibility—because Part 3 sets out the offences of accessing the information and the penalties—that in the case of Keith Ng there might be some kind of protection for people who like a blogger or a citizen journalist are accessing this information because they believe there is a potential gap in security. They might believe that the only way for them to find out whether or not there is a gap in security is to do what Keith Ng did which was to go into that Work and Income office and access the information to see whether he could access it. But from my reading of the bill as it stands there does not seem to be any protection for anyone who with good intentions and no malice goes in to access this kind of information. 
That is just something I want to throw out there because given the nature of the area we are talking about—and we are talking about digital storage—the expertise for these kinds of things as we have seen in the last couple of months to try to test it or hack the information does not necessarily rest within the Government departments. They could not find the security gaps or the security lapses that had existed for some time. It took someone external to test the system to see whether there were some gaps. So we have got a case where there may be a third party who comes in who may have a little bit of knowledge about a potential threat to the security of the system and who does what Keith Ng has done which was to go in access that information and with no malice actually go to the authorities and to the media about a potential security lapse. I am just wondering whether the Minister in the chair could elaborate as to whether because of the nature of this—and I am no technology guru—the expertise in this area might not lie within the Government departments. It might lie with those who are more technically advanced than those within the department. If they do test it and find a lapse in security I ask whether or not there will be some protection within the law as it stands now to protect that person because they have actually done the public a good service by highlighting the issue of a security lapse. Hopefully as the Minister in the chair has taken one call to answer a question from Denis O’Rourke it would be good if I could potentially get a reply to that question. 
There are some penalties both monetary and also in terms of imprisonment that are contained within clauses 56 to 60. If someone commits an offence that is set out in clause 56 they are liable for a term of imprisonment not exceeding 10 years a fine not exceeding $250000 or if it is an organisation a fine not exceeding $1 million. I think Denis O’Rourke talked about the level of penalties within clause 58(4) and he was answered by the Minister but I have since that time had a chat to my colleague the chair of the Government Administration Committee Ruth Dyson. She said that during the select committee process which was some time ago I understand the level of punishment and the penalties that are contained within the bill were debated and the members of the select committee thought that it was appropriate to have the level of punishment as it is set in the bill as it stands. Also clause 58 looks at an issue that I highlighted in the debate on Part 2 which was around access. It relates to offences relating to improper access to the information that is held on the service database. That also carries penalties of imprisonment for an individual of a term not exceeding 2 years a fine not exceeding $50000 or for an organisation a fine not exceeding $200000. So I guess that does answer some of the questions that I posed in the debate on Part 2 around the monitoring and what kinds of penalties would be carried out if someone was found to be improperly accessing the database. 
In terms of improper access there is serious concern. Again I just want to highlight the concerns that there will be out in the community about the level of security around private information. It is a serious concern. It is a real concern. As many people have pointed out the journey of this bill might have been slightly different if it had happened in the context of recent events. I think there would have been much more scrutiny around the protections that the Department of Internal Affairs and other agencies could offer around the security of information given we have had a series of serious blunders I guess you could call them around the security of private information from the Government in the last year or two. So I just want to reiterate that public confidence is absolutely essential to making sure that the Igovt roll-out and expansion beyond what is already in place is a success. There is concern amongst the community because of the glitches at Work and Income ACC the Inland Revenue Department and the Ministry of Education with security of private information recently. 
I would like the Minister in the chair to potentially answer some of the questions that have been posed. I just remind the Minister in the chair about maybe that one issue of the likes of citizen journalists or bloggers who may expose glitches in this system having some protection from prosecution—[ 
Interruption 
] Yes whistleblowers. If they do highlight glitches in the current system I ask whether or not they potentially have any protection—if they with no malice do highlight some shortcomings of the current system. 
CHRIS AUCHINVOLE (National) 
: 
 It is as always a pleasure to debate these matters with Kris Faafoi whom we have just heard from. I am not sure what he had for dinner but I really feel he is arguing against himself and I think there are serious consequences to what is being suggested. On the one hand he is castigating the Government for having identified problems with some of the computer systems and saying that it is unforgivable it should never have happened there was insufficient testing and it must never be allowed to happen again but on the other hand he is suggesting seriously—because he is a serious person—that if a hacker goes in as long as they can say “Oh no it was for non-malicious reasons.” they should be forgiven and not prosecuted. I cannot follow the logic. If people breach security they breach security and for someone in this Committee to stand up and say that that is fine leaves me somewhat amazed. I am sure on reflection he would not expect the Minister to say: “Yes on the one hand it was dreadful that we had those security breaches but no as long as they can say it was without malice and it was just to highlight a problem that’s OK.” 
I had the experience of losing my company identification to a well-established company that handled information bank details and everything else. It sold its files. It sold its files to American interests and American interests then had the liberty to phone you up and ask you about your business. They already knew all about it. They had everything there. “We’ve got your file right on our desk. We feel that you should buy these shares.” and so on and so forth. There was no protection against that company doing that. There was no protection. 
I would like to reassure the Committee in the light of Kris Faafoi’s statements that the Government Administration Committee certainly considered this bill the Electronic Identity Verification Bill very very seriously. Indeed the officials went away and did remedial work—extra work extra research. I think they worked extremely diligently and I do not doubt that the chair of the committee who is sitting beside Kris Faafoi will bear that out. They worked very very hard and we took this very seriously. I would hate for anyone to think that this committee was slipshod in its processes because we were not. 
Let us have a look. We talked about the level of fines. Let us just see what they are what we have lifted them to. It was previously imprisonment for a term not exceeding 10 years or a fine not exceeding $250000. The prison term continues not to exceed 10 years and the fine continues not to exceed $250000—or both—but if an organisation gets involved then it is a fine not exceeding a million smackers. That starts to erode the profits they might receive from selling information that they could gain. So it becomes quite a risky operation. But I would not be at all surprised because this is valuable information if an organisation a shonky one was prepared to give it a go—have a go—and see whether it works. If it does fine. Pocket the profits. If it does not they may say that they were doing it for non-malicious purposes to show there was a breach in the system. Under Kris Faafoi they are forgiven because they have shown the Government there was an error. Sorry it does not wash. I feel that we should distance ourselves from that sort of peculiar slipshod logic. 
Hon RUTH DYSON (Labour—Port Hills) 
: 
 I did not realise that the member who has just resumed his seat Chris Auchinvole was going to do so so rapidly. I want to begin by just endorsing his comments. I did refer earlier to the Minister of Internal Affairs and the members of the Government Administration Committee and the officials and I want to just reinforce that point. Some people would look at this bill the Electronic Identity Verification Bill and say: “Well hmm?”. Perhaps they would not get very excited about it. I suppose it is not a bill that you would get really excited about but that does not mean it is not important and it certainly does not mean that you should not apply a lot of rigour to it and ensure that the anxiety that we referred to earlier is considered seriously and dealt with even if we do not think it is entirely appropriate to do legislative amendments or frame legislation on terms of unwarranted anxiety. But we want a system where people’s confidence will grow. We want the benefits of electronic identification to be given to Government departments agencies and individuals but we also want people who are using the system to have their confidence grow because of the rigidity of the system the rigour of the system so that we are not likely to get the sorts of breaches that we have been talking about earlier in the debate. Also if there is some breach appropriate penalties should be dished out to those who breach it. 
I want to refer now to clause 61 which is the only clause in the bill that has an amendment from the Hon Chris Tremain. It really draws further on the comments that my colleague Kris Faafoi was making in relation to Keith Ng who is the—what was the term he used? 
Kris Faafoi 
: “Citizen journalist”. 
Hon RUTH DYSON 
: Citizen journalist. There you are; that is an interesting term. He is a blogger. He is a person who has strongly and competently held views and expresses them through social media and other outlets. I want to correct the deputy chair of the Government Administration Committee. The kiosk system was not hacked. There was no hacking involved. It did not involve anything that bordered on anything illegal. The system was used in the manner it was intended to be used but it delivered a whole lot of information that should not have been delivered to the people who were accessing it. So they did not hack into the system; they just accessed it and kept putting in the details that they were asked to put in and they suddenly got a whole lot of information that breached other people’s privacy. 
The point that Kris Faafoi was making is that if you read clause 61—it is talking about protection from liability—subclause (1) says: “Subsections (1A) and (1B) apply to an act done or omitted—(a) by the chief executive or an employee or agent of the department; and (b) in the course of—(i) performing functions or duties or exercising powers under this Act; or (ii) purporting to perform functions or duties or exercise powers under this Act.” and subclause (1A) says: “Neither the chief executive nor the employee or agent is under any criminal liability for the act.” The point that Kris Faafoi was making was to ask whether this has any bearing on the example that he used where Keith Ng went into a legitimate public space of Work and Income and without any hacking or otherwise unauthorised or illegal actions or engagement with the Work and Income computer system was able to access a whole lot of information that was personal and private to other people and should not have been shared. But he was not accessing it illegally; he was just following due process as I understand it. There does not seem to be anything in this clause at all to respond to that situation. 
I think the question that Kris Faafoi raised with the Minister in the chair the Hon Amy Adams is worthy of some consideration. The select committee did not consider it and that was for a very simple reason: that incident had not occurred it had not happened and it was not in the public domain. We did not know about it until after the select committee had deliberated on it. As Chris Auchinvole alluded to given the serious attention that we gave to what appears to be quite an innocent and small bill I know that our select committee would have given it further consideration in terms of the protection from liability that should be accorded to Mr Ng. 
KANWALJIT SINGH BAKSHI (National) 
: 
 Thank you Mr Chair for allowing me to participate in this debate on Part 3 of the Electronic Identity Verification Bill. This part deals with very important issues where we have defined what sort of penalties are in place if somebody plays with the information held within the system. We just heard from my good friend Chris Auchinvole about his personal experience of how his information was sold to an overseas company. This part defines that if an individual or a corporate sells or plays with the information that is being held they will get severe penalties. As multiple Government agencies exchange information it is critical to ensure that the fundamentals of this proposal are absolutely right. 
My colleagues and I in the Government Administration Committee have considered the bill and have suggested amendments to the bill that we believe will enhance the legislation. Members of the committee have recommended the application of higher penalties to organisations. The present version of the bill has suggested penalties for individuals and organisations that misuse the services. However the committee considered that the penalties currently being applied to the individuals as well as to organisations are unlikely to restrict organisations from misusing the services. So for instance if an organisation hacks into the service database the maximum penalty is a fine. The view of the committee is that it is unlikely to stop organisations with malicious intentions. 
The Government Administration Committee has recommended the imposition of fines that are likely to have severe financial repercussions on those organisations and that could deter them from misuse and says that these should be applied. The committee also recommended that a specific time period be inserted into the legislation that prescribes the length of time electronic identity credentials photographs records of usage history status information and technical codes are retained after their cancellation revocation or expiry of data. 
Before I conclude I would like to thank the officials for their help during the select committee process. I hope this will be a bill that will help to safeguard the database we have in electronic form. 
Dr MEGAN WOODS (Labour—Wigram) 
: 
 It is my pleasure to take a call on the Electronic Identity Verification Bill which is a very timely piece of legislation for many reasons. Members have gone over the current events that make this a piece of legislation that we need to think about very carefully. 
One of the things that struck me as I have sat here listening to the speeches in the Chamber tonight is that a number of members of this House went to a cross-party forum this evening. This was for a number of our small and medium sized enterprises and high-tech companies and people were talking about working with the Government and how it is that they could add to the weightless economy. It dawned on me that there is no more weighty responsibility for the Government than when it is dealing with people’s private information. This is really what this bill gets to the heart of. I think that Part 3 of this bill has some incredibly important points to make in terms of how it is that this piece of legislation interacts with the very legislation that protects our rights in this country. Specifically I am referring to the Official Information Act and the Privacy Act. 
Some very interesting points have been drawn out as we have gone through this debate tonight and I would like to address a couple of those as we go through the bill. This is important as a number of my colleagues have noted in this debate. Kris Faafoi who is getting quoted a lot in this debate tonight finished his speech— 
Hon Annette King 
: Name-dropper. 
Dr MEGAN WOODS 
: I am being a name-dropper. Kris Faafoi finished his speech by saying that it is absolutely imperative that individuals have confidence when the Government is dealing with private information. I think many of us have instances of constituents in increasing numbers coming to visit us and sharing their anxiety at the personal information that the Government has stored about them and what might come about because of that. 
But Labour is supporting this bill and as I said I want to address some of the points in the debate. I specifically want to pick up on what Ruth Dyson talked about in terms of clause 61 of this bill and the point that was brought up in Chris Auchinvole’s speech in response to Kris Faafoi. [ 
Interruption 
] There is another name—Annette King! 
In terms of Government responsibility and the allegation that when someone is just carrying out their normal duties and there is no malice involved and they come across information we need to recognise it for what it is—this bill in clause 61 does. The example of Keith Ng has been used and it is a good one because putting a USB stick into a computer is not hacking. Keith Ng was merely using the portal in the way it was designed and clause 61 does cover this. 
This brings to mind some other breaches that we have had in terms of people’s personal information. If you receive by email from a Government department the details of a whole lot of people’s personal information as happened in the case of ACC is the person receiving that email going to be liable? Well no—clause 61 actually covers that off because there is no malice intended. 
But what if you are a teacher or you are a principal or you are an administrator at a school and you receive from the Ministry of Education because of the breakdown of the Novopay system personal information and bank account details of teachers from another school? That has been happening with the Novopay system so is it something people could be liable for? That is why clause 61 of this bill is incredibly important—it does cover that off. It does cover off this protection from liability. 
I think these are things that we have to be very mindful of because we are dealing with a technology and we are in an era when technology is being employed to move around massive amounts of data. So we do need to empower chief executives to protect people from liability when things go wrong through no fault of their own and when it is someone else’s problem. 
But when we look at some other provisions of this bill—and there are some incredibly important ones under this part—and we look at the relationship with the Official Information Act we see some really important interfaces here between these two pieces of legislation. What we see is that we have the Government having the responsibility to deal with it. We see reporting to the Privacy Commissioner being an incredibly important protection that people will be given under this legislation. So this is a bill that Labour is happy to support. 
The question was put that the amendments set out on Supplementary Order Paper 128 in the name of the Hon Chris Tremain to clause 61 be agreed to. 
Amendments agreed to. 
Part 3 as amended agreed to. 
Schedule 1 agreed to.  
Schedule 2 agreed to.  
Clauses 1 and 2 
Clause 1 agreed to. 
Clause 2 agreed to. 
Bill to be reported with amendment presently.