Reti ShaneDr SHANE RETI (National—Whangarei): Thank you Madam Assistant Speaker. It's a pleasure to speak to this bill. I have a particular interest in data and cyber security and I certainly will be supporting this bill. I would like to start by noting first of all a few key moments and a few key people in the life of privacy legislation in New Zealand.I want to start with the late Sir Bruce Slane—a man I called a friend and the first Privacy Commissioner. In the third and final reading of the Privacy Act 1993 on 5 May Minister of Justice Doug Graham said this about Sir Bruce: I also [want] to thank and to place on record the appreciation of the Privacy Commissioner Bruce Slane—not only for myself but also I am sure on behalf of the members of the select committee. He was given the task of suddenly becoming an expert on privacy law and of going around the business community to settle down any problems … he did that with consummate skill. He reported to the select committee as I asked him to do. His advice was sound it was reasonable and it was carefully planned and that reflects great credit on him." I also want to acknowledge the late Elisabeth Harding—a lady I called a friend and legal counsel to Sir Bruce when the Privacy Act was enacted. I say to both of them—now they are both deceased—haere ki te kāinga tūturu o tō tātou Matua i te Rangi. Moe mai moe mai moe mai.[Farewell to the home of our Heavenly Father. Rest in peace rest in peace rest in peace.]Privacy issues started taking shape in the late 1960s and 1970s as large computer databases started to be formed. This culminated in the 1976 Wanganui Computer Centre Act. Now the Wanganui computer is detailed as "New Zealand's first centralised electronic database … It was also the first time a New Zealand computer had its own Act of Parliament. It was set up by the State Services Commission and the information it amassed was initially available to and shared by the police … Land Transport … and the Department of Justice. The mighty Sperry mainframe needed its own multi-storey building to accommodate it." It goes on: "The computer was [actually] little more than a glorified mail handler steaming open virtual envelopes in order to peruse their contents. Police and others wanting to access others on the database had to do so through terminals located in their stations and offices." That was the 1960s and 1970s.In the 1980s it was the OECD. Their privacy legislation was the most applicable to us. We can read here from a presentation made to Australia from the New Zealand Privacy Commissioner at the time: "At the time that we enacted our Privacy Act the OECD guidelines were the only applicable international instrument for New Zealand. Unlike the majority of OECD members the European instruments just didn't apply. Only much later did APEC develop its privacy framework."In the 1990s further regulatory reforms and globalisation led to some of the early legislation. The 1991 information legislation was introduced by a National Government and two years later it became the 1993 Privacy Act. Why did it take so long? We can see here if we read through some of the notes: "On 5 August 1991 the National Government introduced the Privacy of Information Bill as a consequence of its first budget. There was resistance to applying the proposed [legislation] to the private sector"—we heard this; this was one of the struggles for Sir Bruce to get the Privacy Act through—"and the Select Committee to which the bill as amended was referred did not report the Bill back until [two years later]."Clearly 25 years later which brings us to today the Act is needing reform. I acknowledge the body of work that the Law Commission did over 2010 and 2013—I think it's actually three large volumes as I recall looking at it a very detailed work on reviewing the Privacy Act from the Law Commission. Why then does the Act need modernisation? Well the advent of social media social services and the reach of international jurisdictions into the lives of New Zealanders. In my view it's very important that the privacy laws in this area be strengthened as this bill will do. The international data community while touting the principles of sovereignty conveniently cower behind their own jurisdictions when it suits particularly as it applies to New Zealand data. We've already heard mentioned Uber New Zealand data breaches Facebook—and ticketing site Viagogo hiding behind their Switzerland presence and others. I think it's also important to reflect on trade. If we believe that here in New Zealand we are good stewards of overseas data we expect others to do the same with our data. To that end New Zealand is required to be certified as good data stewards by many of our large trading partners before we can do business with them. We expect exactly the same care and respect. The EU is a good example. We export $8.2 billion to the EU each year. For many services New Zealand needs to be certified by the EU as having adequate data protection mechanisms and in fact in December 2012 New Zealand received data protection certification with the EU.I think at another point in time I want to talk about data breaches because there is a lot of stuff happening particularly in the EU and Britain and Australia particularly in 2018. But I think at this point I will leave what I have to say until another time. I commend this bill to select committee."