O'Rourke Denis: Privacy (Information Sharing) Bill — First Reading 
Text is incorporated into the Bound Volume 
O'Rourke Denis: Privacy (Information Sharing) Bill — First Reading 
[Sitting date: 08 February 2012. Volume:677;Page:238. Text is incorporated into the Bound Volume.] 
DENIS O’ROURKE (NZ First) 
: 
 It is a pleasure to take this call on behalf of New Zealand First. New Zealand First members support the intent and substance of the Privacy (Information Sharing) Bill. There has long been a need to make certain whether when and how agencies can share information about an individual. In fact it is common sense that this should be possible provided of course that there are adequate controls in favour of personal privacy. Those are the provisions that New Zealand First will wish to ensure are robust and that is something that we will be looking at closely in the Committee stage.  
The benefits of information sharing are significant and there are a couple of good examples of this given in the regulatory impact statement. They include these two: that the ability of agencies to take a coordinated approach to support individuals and families with complex needs is not as effective as it could be if information were shared more easily; and that the violent abuse of a young child is sometimes blamed on inadequate coordination which draws attention to a lack of information sharing.  
So we should not always see that there is some dark purpose behind this. There do need to be controls of course but let us look at the positives that can come out of information sharing. After all if one agency of Government has got information for valid purposes then it is perfectly normal for another arm of Government to require and make good use of that information as well. The detailed provisions of the bill do create the certainty required for agencies to lawfully share information and also protect the rights of individuals concerned. They also empower the Privacy Commissioner appropriately in his or her role to oversee the operation of these new provisions.  
The concept of the bill we think is good. First it allows sharing as appropriate and necessary for the efficient operation of the Public Service. An agency that holds personal information may use the information for another purpose or disclose it to another person if the agency believes on reasonable grounds that the use or disclosure is necessary to prevent or lessen a serious threat to public health or public safety or the life or health of the individual concerned or of another individual. So the purposes are perfectly proper and provide a significant benefit to the community as a whole provided again that there are adequate provisions in favour of personal privacy. We think that the removal of the word “imminent” is also sensible and necessary. It is easy to see the problems that the word “imminent” would impose. The word is unnecessary and it is unduly limiting.  
The second thing that the bill does is to provide for a new mechanism using a procedure culminating in an Order in Council to improve information-sharing agreements and it is the best of the two options that were available. In particular it sets out the functions of the Privacy Commissioner by adding further provisions to section 13 including: the making of submissions on an information-sharing agreement in new subsection (1AA)(a); in new subsection (1AA)(b) reporting to a relevant Minister on any matter relating to privacy that arises; in new subsection (1AA)(d) receiving and investigating complaints about alleged interference with privacy; in new subsection (1AA)(f) conducting a review on the operation of an approved information-sharing agreement; in new subsection (1AA)(g) reporting to a relevant Minister on the findings of a review conducted; and in new subsection (1AA)(h) requiring a public sector agency to report on the operation of each approved information-sharing agreement.  
These provisions will give confidence that the rights of the individual will be protected appropriately that privacy principles and codes of conduct will be preserved and that there will be transparency and reporting requirements in respect of the operation of agreements.  
The requirements for the Order in Council in the new section 96H are also comprehensive. I note than in proposed new section 96H(e) an Order in Council must “for every party to the agreement—(i) describe the personal information or type of personal information that the party may share with each of the other parties; and (ii) state how the party may use the personal information; and (iii) state the adverse actions that the party can reasonably be expected to take as a result of sharing personal information under the agreement; and (iv) specify the procedure that the party must follow before taking adverse action against an individual as a result of sharing personal information under the agreement”. In proposed new section 96K(2)(a) the Minister must be satisfied that the “agreement will facilitate the provision of any public service or public services:” in section 96K(2)(b) the Minister must be satisfied “that the type and quantity of personal information to be shared under the agreement are no more than is necessary to facilitate the provision of that public service” in section 96K(2)(c) the Minister must be satisfied “that the agreement does not unreasonably impinge on the privacy of individuals and contains adequate safeguards to protect their privacy:” in section 96K(2)(d) the Minister must be satisfied “that the benefits of sharing personal information under the agreement are likely to outweigh the costs of sharing it:” and lastly in section 96K(2)(e) the Minister must be satisfied “that any potential conflicts or inconsistencies … under the agreement and any other enactment or rule of law have been identified and appropriately addressed.”  
These requirements are also comprehensive and we think adequately balance the needs of departments and agencies against the rights of individuals for personal privacy. After all it is for the benefit of the community as a whole that such information should be available provided that the necessary protections are in place. Otherwise the provisions relating to giving notice of adverse action review and amendments of agreements and reporting requirements are all satisfactory.  
There is however one matter of apparent misdrafting that I would like to raise with the committee with a suggestion for rectification. It is a relatively minor matter. It relates to the amendment to section 2(1) and concerns the definition of “serious threat” which refers to an agency in assessing whether a threat is serious to have regard to “ ‘(a) the likelihood that the threat will occur: ‘(b) the severity of the consequences if the threat occurs: ‘(c) the time at which the threat may occur’.” I believe that these subsections should instead of referring to the threat itself refer to the events or conduct threatened as follows for example: (a) the likelihood that the event or conduct threatened will occur (b) the severity of the consequences if the event or conduct threatened occur and (c) the time at which the event or conduct threatened may occur.  
Finally it is obvious that the bill if enacted will place much more pressure on the Office of the Privacy Commissioner. I trust that despite current budgetary constraints the necessary additional resources will be made available so that the commissioner can carry out the important role defined in the bill. Subject to these comments and for the reasons mentioned New Zealand First members support the bill going to the select committee.