Little Andrew: Privacy Amendment Bill Tax Administration Amendment Bill Births Deaths Marriages and Relationships Registration Amendment Bill — Third Readings 
Text is incorporated into the Bound Volume 
Little Andrew: Privacy Amendment Bill Tax Administration Amendment Bill Births Deaths Marriages and Relationships Registration Amendment Bill — Third Readings 
[Sitting date: 21 February 2013. Volume:687;Page:8112. Text is incorporated into the Bound Volume.] 
ANDREW LITTLE (Labour) 
: 
 It is a pleasure to take another call on the bills that come from the Privacy (Information Sharing) Bill now several pieces of legislation. One might say that in the absence of comprehensive adoption of the Law Commission’s report on privacy and proposed privacy changes what we have before us now in this third reading debate is a gallimaufry of legislation dealing with the issue. 
This legislation does three things of considerable importance. One change is to relax the protections in the existing Privacy Act in relation to privacy principles 10 and 11. Mr Macindoe the last speaker alluded to the fact that what was a protection for agencies to release information in the event that there was a “serious and imminent threat to public health or safety” has been watered down to just a “serious threat to public health or safety”. I will come back to the significance of that. Although Labour is supporting this legislation nevertheless the record should show that there remain some concerns. In the event that a future Privacy Commissioner or a court should come to consider these words then let the record show that this House has expressed some concerns about the legislation even as it stands. 
The second change is to create and allow for privacy sharing agreements between agencies and not just public agencies but private ones as well—private agencies that are dealing with public work if you like and operating in the public arena. The third significant change that I want to draw the House’s attention to that relates to privacy sharing agreements is that although the privacy sharing agreements are done by Order in Council and therefore there is a record of them and it is possible to get access to them they can be amended without referral back to any of the parties and without going through a public process simply by Order in Council. That is another point to draw attention to as something that we need to be alert to because it carries the potential for abuse or for further erosion of the rights to privacy that we have all come to expect under the Privacy Act. 
In relation to privacy sharing agreements the point is—it has been made before and I will make it again—that in this day and age in the modern State citizens operating in the modern State must surrender an enormous amount of personal information to the State. We accept that in order to get the benefits of the State whether through protection whether through entitlements and benefits or for whatever reason. But we do release an enormous amount of information to the State. If there is one thing that people want to have control over and want to make sure is secure and is protected it is information about themselves. It goes to their identity; it is about who they are. They want to know to whom it has gone and for what reason. They want to be assured that it is going to be used for the right reasons. They want to have some control over it. 
The Privacy Act was a very good way of putting a stake in the ground because we never had a developed common law of privacy. Even in other legal jurisdictions more mature than ours their common law privacy rights were developed in fits and starts and lurches rather than in one coherent stream. We enacted the Privacy Act which set a stake in the ground. That was very good. It was very important that people could understand that they could exercise control over the information that they surrendered to public and private organisations. 
Now we are doing something else. We are in effect relaxing those protections. So naturally every citizen wishes to proceed cautiously and carefully as indeed I think the House has done by and large with this legislation. But when it comes to information sharing between agencies particularly State agencies then we want to be clear that there are good safeguards around that. Those safeguards include that there is to be a deliberative process that the agreement is obviously to be kept in writing—recorded and kept by whichever lead agency is in control—and that people can have access to it. But it still raises the risk that people might give up information about themselves to an agency in order to get access to its support or services or some sort of entitlement and that information could find its way wrongly disclosed to another agency. Or it might be that a zealous official misinterprets the extent of a privacy sharing agreement and releases information in the mistaken belief that it is covered by the privacy sharing agreement. That means that the oversight of these sorts of processes needs to be very thorough. 
If there is one thing that we have learnt in the last year—in 2012 the year of the privacy breach in the New Zealand bureaucracy—it is that our oversight and enforcement need to be up to scratch and up to the mark. I am not 100 percent confident that they are. We can do better. If you have a look at the breaches I think that most of the breaches of privacy that we saw in 2012 were accidental. They were from public servants who were harried overworked stressed for whatever reason and not exercising due care and diligence and they allowed information to be wrongly disclosed. In some cases they were risks of breach of privacy that were known in advance but no action was taken. That particularly applies in the case of Work and Income. But it highlights the anxiety and the reason why people have anxiety about the information they give to the Government and therefore why the processes we have for dealing with information managing personal information and now disclosing information between agencies in a more streamlined way need to be very clear. The processes around those things—those mechanisms—need to be well understood clear and followed absolutely to the letter of the law and there needs to be good oversight and control of them. 
So the Office of the Privacy Commissioner becomes even more important. If there is one thing that we now should rightfully expect to see it is a beefing up of the Office of the Privacy Commissioner because my observation is that in response to the privacy breaches that we saw last year that office struggled to deal with the complaints and to come to grips in some cases with the magnitude of the complaints and the seriousness of them. A lot of people were left with a very sour taste in their mouths about the way their privacy complaints had been handled by that office. I do not blame that office—it is in a difficult position—but it needs some assistance and support if it is to come to grips now with overseeing what could be very extensive very comprehensive and very important agreements between public agencies. People are entitled to that assurance. They are entitled to know that in this new age in this electronic age where information can be disclosed very easily and very quickly there are proper safeguards around that information and that they have a place to go that they know will be responsive to their concerns and if they have complaints can respond effectively and with alacrity to their complaints and their issues. 
So although Labour supports this legislation and we will be voting for it let us not avoid the reality that there are ongoing concerns and anxieties about the way personal information is managed by the public sector in its engagement with the private sector and that this legislation although it has the potential to do many good things and be very helpful and allow streamlining of processes between Government departments also has the power to magnify and exacerbate the risk of breaches of information. So the safeguards must be absolutely second to none and the oversight by the Office of the Privacy Commissioner must be the best that it possibly can be.