5. Social Development Ministry—Security of Client DataJAN LOGIE (Green) to the Minister for Social DevelopmentSocial Development Ministry—Security of Client Data5. JAN LOGIE (Green) to the Minister for Social Development: Does she believe she delivered on her statement that robust procedures would gather and protect the information" when referring to her ministry's Individual Client Level Data Collection policy?Hon ANNE TOLLEY (Minister for Social Development): Yes. As I said yesterday it is absolutely vital that clients and providers have confidence that their information is being protected which is why yesterday after I was made aware of a technical issue with the portal system I directed that a new IT solution be developed for the collection of that individual client - level data. As I said in the House yesterday I have also directed that this new system be independently assessed and I would welcome the Privacy Commissioner's input as well. I have also asked that the Government Chief Information Officer be involved in this.Jan Logie: When the Minister told this House "Of course we are working closely with the Privacy Commissioner to ensure that clients' privacy rights are protected." can she tell this House whether he was briefed on significant changes to the policy after first being consulted in June?Hon ANNE TOLLEY: I do not have that information. What I have assured the House on on a number of occasions is that I understood that the Ministry of Social Development (MSD) was working closely with the Office of the Privacy Commissioner. The details of that I leave to the MSD people to work through themselves but in my conversations with the Privacy Commissioner we have traversed all the areas that he covered in his report. Three of the four recommendations I agree with and I have put things into action to implement his recommendations.Jan Logie: Did the Minister check the Privacy Commissioner's view on such changes as collecting identifiable data for sharing and matching with other agencies instead of the initial proposal to use anonymised data for research purposes?Hon ANNE TOLLEY: I cannot answer that question as to whether MSD was talking to the Privacy Commissioner about that particular issue. I know that I have been talking to providers about that change in processes for almost 2 years.Jan Logie: I raise a point of order Mr Speaker. If you had listened to my question you would have heard that I asked whether the Minister had checked and her answer was that she cannot say whether the ministry spoke with the Privacy Commissioner.Mr SPEAKER: No no the question was addressed. The Minister was saying effectively that she did not speak and that she is not sure whether the ministry had. That has addressed the question.Jan Logie: Does she think it is acceptable to have gone ahead with this policy without having completed a privacy impact assessment when the Privacy Commissioner has said he expected it to have happened before they went ahead?Hon ANNE TOLLEY: I agree with the Privacy Commissioner.Jan Logie: On what date did the Minister see the first draft from the Privacy Commissioner which her ministry received on 9 March?Hon ANNE TOLLEY: Oh I am sorry; I do not have in front of me—it is in the Hansard from yesterday—when I received a letter from the Privacy Commissioner I think it was 10 March with his initial findings. I then met with him several days later to talk through those findings. As I say of his four recommendations I do not agree with his first recommendation about using Statistics New Zealand and anonymised data because whilst that might give us the progress that is being made by NGOs it does not give us the coverage so we do not know that everyone who needs the services are actually getting that service. But certainly for his other recommendations following that meeting I did discuss with MSD working up an exemptions regime as he has recommended in recommendation No. 2. I think for recommendation No. 3 I have made sure that MSD has been very clear what the data is needed for and that it will not be used in order to be matched with any other Work and Income - type information. And recommendation No. 4 I absolutely agree with which is why I shut the portal down yesterday.Jan Logie: If the Minister read in the draft report or knew that MSD was collecting individual client data via spreadsheets which the Privacy Commissioner says "lack inbuilt security protection and have been associated with significant data breaches" why did she not put a stop to the collection of data rather than waiting for this week's breach to happen?Hon ANNE TOLLEY: Well the member is assuming that I was aware of that level of detail. I have asked the chief executive of MSD to provide me with a detailed report of what happened and how this process was developed because I did not as a Minister have operational oversight of it. But I agree with the Privacy Commissioner that that is not the correct way to develop a system like this and as I have just said to the media I am furious and disappointed that the agency seems to have taken shortcuts.Jan Logie: How can the public trust the Minister to protect their privacy when she has been completely missing in action on core protections of privacy in terms of ensuring that the database system was able to protect their privacy ensuring that assessment was done in the first place and even finding out whether the Privacy Commissioner had been consulted on massive changes?Hon ANNE TOLLEY: The public can have confidence because I shut the portal down immediately I became aware that it was not secure and I have said that we will not upload any data until not only I but the Privacy Commissioner and the Government Chief Information Officer are content that it is a secure system. It is absolutely critical that it is secure and that people's privacy is respected."