Logie JanJAN LOGIE (Green): I have got to say that I read this report which I think can be fairly characterised as a damning report with a lot of discomfort and it raised many questions for me. Some of the questions are about how we got to the point we are at at the moment and other questions are about where we go next. So I just want to address some of the questions that were raised for me by the report about how we got to this point.What this shows us is that in the words of the Privacy Commissioner a system was put in place prematurely without adequate consideration of privacy risks or mitigation of those risks. And it is not as if the Opposition and the community organisations that were being told they had to do this had not raised concerns about these issues. We have been since at least October last year and we have had in response from the Minister for Social Development constant assurances that there is nothing to see here that Opposition members and community organisations and the public could have absolute confidence in the roll-out of this individual client data information-sharing that we should just trust in the process and that the Ministry of Social Development (MSD) was on to it.Well this report tells us that actually we are validated in our concerns—that already there has been a privacy breach and that the basics of oversight were not done. The Privacy Commissioner said that he would have expected a privacy impact assessment to happen before this process was initiated in order to consider what the privacy risks might be and how they could be mitigated. But that work is still not completed. This is something that was started in March last year and we have had assurances that this Government is all over it and that it is holding privacy concerns and keeping strong oversight of that.Yet the absolute first step was never done and has still not been done. The Privacy Commissioner was briefed on the intention for this programme in June last year and the Privacy Commissioner was told at that time that there was going to be an ability for sensitive services to opt out of sharing this individual client data and that it was going to be aggregated data for research purposes. Then somehow between June and December the actual plan changed significantly to the point that in December it became clear that the policy intent was then for individual client data to be able to be used for sharing and matching with other agencies. And this is quoting from the Privacy Commissioner's report—this is not me being mischievous; this is not a misrepresentation of what the policy is. And we—I will speak for myself—have never insinuated that that may have been matching or sharing with Work and Income. It was with anyone because the initial intent was that it would be anonymised data for research purposes and that changed. It does not seem as if the Privacy Commissioner who we have been told has been kept in the loop along the way on this was told of that change which is a fundamental one. It is a completely different policy with significantly more privacy risks. It does not sound as if he was told and if he was—well we can gather from the Minister's answers this afternoon that the Minister never checked to see whether the Privacy Commissioner was told or what his response to those changes might have been.So we have a very significant issue and I would say it is one of competence for a Minister. We have a Minister who has come to this House repeatedly giving us assurances that the privacy of individuals would be protected and yet she did not ensure that a privacy impact assessment was done and she did not check to see whether the Privacy Commissioner had been informed or what his response was to a massive significant change in the policy. She cannot even have found out the method for collecting the information in that first stage because surely—surely—the fact that MSD was collecting information through a spreadsheet would have raised alarm. Then I would have thought it would raise alarm to hear that MSD was planning on collecting individual data information via spreadsheet. And then if we will just give her the benefit of the doubt for not having asked that question—which again is a competence issue but just say we let that go—she got this report or surely would have asked around some detail of that data collection in that initial stage from her briefing or expected that from officials and found out that the Privacy Commissioner said that this is not secure and identified significant risk yet she waited until there was a breach before she stopped collecting that information. This was despite significant clear direct warning that the method that was being used was not secure and not safe. That is a massive confidence issue and I think it should be worrying everyone in this House as well as the public because if we are to have faith in the process going forward if we are to have faith in the protection and the well-being of New Zealanders then we need to know that the Minister who has oversight of such significant reform knows what questions to be asking and will be making sure that she is getting the right answers. If she does not know what questions to ask if she is not actually making the effort to ask those questions then how can we be sure that there is going to be safe implementation of such a radical policy? We cannot be sure.And that brings up some of the other issues that we are seeing and the inconsistencies I heard from the Minister earlier where she was saying that yes they need to collect the individual data because without it they cannot be sure that people are getting the right services. She quoted examples of the children's teams and Whānau Ora as if those systems do not have information-sharing capability at the moment—they do. There is no actual translation of how that could translate to knowing whether an individual is getting the right service if that information is going to some data analyst sitting in an office in Wellington and they still have not given agencies an assurance that there will be no adverse consequences for people from that information being shared.It has identified that there will be the ability for MSD to share that information with the Ministry of Health the Ministry of Justice and the Ministry of Education. Within MSD the Minister also mentioned Oranga Tamariki. We know at the moment that people are not accessing healthcare—I have been told of several examples of victims of domestic violence not accessing healthcare services because they are scared of reports going to Child Youth and Family and losing their kids.So here we have a very valid concern that people will potentially not access services if information is being shared in that way. Yet the Minister has given us no assurance that that will not happen. It has not been said. We are hearing that it is about making sure that services are not being duplicated or that people are getting the right service. That gives an indication that actually if that is to be relevant or meaningful they would actually intervene if they found an individual was not accessing a service and go to them and tell them We think you should be accessing a service." or if someone is accessing many services they are going to go in and try to reduce the number of services they are accessing. If people have chosen to access those services then that is an adverse outcome I would suggest. The Minister is saying that it needs it for the information to be meaningful but now it is going to bring in some exemptions—but if it is not complete information then again how is it meaningful? If it is saying that it is not going to collect it all but it needs to know whether everyone is accessing it and whether the services are going in the places they need to but it is only partial information then again how is it meaningful? How will it achieve the goals that the Minister is saying it will? Again it raises significant issues of competence and we have no ability to be secure that people will have their rights protected."