Dalziel Lianne: Debate on Crown Entities Public Organisations and State Enterprises — In CommitteeText is incorporated into the Bound VolumeDalziel Lianne: Debate on Crown Entities Public Organisations and State Enterprises — In Committee[Sitting date: 14 May 2013. Volume:690;Page:9891. Text is incorporated into the Bound Volume.]Hon LIANNE DALZIEL (Labour—Christchurch East):The Privacy Commissioner is one of the Crown entities that is finding itself under increasing pressure as we have heard from my colleague Andrew Little. I think my comments are going to follow on quite neatly from what he had to say. It will not be surprising for the Chamber to know that after the Privacy Commissioner’s reference to the “blind bantam hen” which I think has been appropriately identified by my colleague she went on to talk about the fact that she anticipated that we would be interested in asking her questions about data breaches. She said: “I have to say to the committee that unfortunately the sorts of data breaches that we’ve seen in recent months are actually nothing new. We have data breaches being reported to us all the time right across the public and private sectors. The intense media and public interest is however relatively new.” I think that is because of the scale of the breaches. We heard Andrew Little talk about—what was it? There were 6000 included in the ACC breach. There were 98000 claims affecting 83000 claimants. That was the extent of the breach for which we did not get a snap debate in Parliament. I find that absolutely extraordinary.But anyway the Privacy Commissioner said: “I’ve noted that in terms of Government responses to these breaches there’s an element of resignation perhaps an impression that human error is to blame”—and yes we heard that from both the Prime Minister and the Minister for Canterbury Earthquake Recovery—“and that nothing can be done about that. Of course we cannot eradicate human error.” says the Privacy Commissioner. “That will always be a feature of every incident that involves human beings or human systems. No system can be error-proof and it would be unreasonable for me or the public to expect such a standard from the Government or from business all the time. However I think the answer is bigger than that. It’s not a simple answer. These recent events have formed a cluster. OK some of it arises from intense public and media interest but they definitely form a cluster that we should pay attention to. And I believe it’s inappropriate to blame the staff at the front line in every case.”I just want to comment on that because that is what we got from the Prime Minister and that is what we got from the Minister for Canterbury Earthquake Recovery. They put up the straw man and then they knock it down. Not once ever did the Opposition call for anyone’s resignation from the front line on the breaches of privacy in the Earthquake Commission in ACC or in Work and Income—any of those. We expect Ministers to be accountable for their departments and they are the only ones for whom that call would be made. I just want to make that crystal clear. It is inappropriate to blame front-line staff. Human error always occurs. You cannot have a systems breakdown in the IT sector without human error. The trouble is that human error occurs when you are dealing with computers because computers actually do not do anything that they are not required to do by somebody who is feeding it. It will always be a programmer an analyst a user or any combination of the above that will mean that there will be a breakdown in the systemic operation of the system.The problem is that the spin doctors want to take it away from the reality and that is that there has been inappropriate and inadequate attention paid to the culture of privacy. That is what the Privacy Commissioner went on to say: “What’s become clear following the ACC inquiry which was a very useful case to look at is that human error is more likely to occur in an environment where privacy is not given the weight or attention that it deserves. There needs to be a culture of privacy through every organisation. Staff need the tools the systems the support required to protect them and the personal information they work with every day. We need leadership we need good management we need good technology and good systems at every level to protect citizens’ data and the customers’ data in the private sector.”And I believe that that statement from the Privacy Commissioner is what is unprecedented about our consideration of this matter. It is a criticism of the Government because that Government is responsible for ensuring that there has been no leadership that there has been poor management and that there has been hopeless technology and systems which the Privacy Commissioner has to address.