Curran Clare: Electronic Identity Verification Bill Identity Information Confirmation Bill — Third Readings 
Text is incorporated into the Bound Volume 
Curran Clare: Electronic Identity Verification Bill Identity Information Confirmation Bill — Third Readings 
[Sitting date: 11 December 2012. Volume:686;Page:7397. Text is incorporated into the Bound Volume.] 
CLARE CURRAN (Labour—Dunedin South) 
: 
 I would like to say that both the Electronic Identity Verification Bill and the Identity Information Confirmation Bill are actually very important bills because they go right to the heart of the relationship between citizens and the State which is essentially about the trust that is held between the information that citizens provide to the State and how that information is used and exercised. That is why Labour is supporting both of these bills. They are both important bills. I would like to commend the work that has been done on the bills in the Government Administration Committee and the effort that has gone into these bills from members all around the House. 
I would also like to make mention of what was just said by the previous member Jami-Lee Ross around supposed antics with reference to the ghost of David Garrett. This is actually one of the reasons why these bills are so important. These bills are so important in terms of ensuring that there are provisions in place for the security of information and how information is used. I would like to read to you some words said around 10 days ago by our Privacy Commissioner Marie Shroff in terms of her annual report about the importance of privacy and the importance of people’s information. She said that the public is increasingly suspicious of handing over personal information as complaints reach a record high in our country. She said that in the year to 30 June her office had received 1142 complaints which topped a steady rise in the last 5 years. What those figures represent is that there is increasing concern amongst the public about how personal information is being used and that the link between public trust and responsible stewardship has not been made in the minds of some people. She said that in 2012 the most complained about organisations were all Government agencies with ACC taking the top spot with 173 complaints. 
I did want to run through just a few of these because they are important. As I said they do go to the very heart of that important relationship of trust and how the Government chooses to deal with it on a systemic basis right across the Government—not just at an individual agency departmental or ministerial level. 
 Marie Shroff in her annual report said that that data breach in March from ACC was a watershed moment for the public sector that exposed weaknesses at a systemic and governance level and highlighted the integral nature of data management in the public sector and at all levels of the organisation. She said that the lack of commercial drivers meant that public trust must be clearly demonstrated as necessary to effective government. I think that is very important because when we are looking at these bills and what they do—and they do go some way to addressing some of these issues but not nearly far enough—there is and needs to be recognition from right around the House of the importance of these issues and how they are dealt with. There needs to be—and it would be very good to see—clear support from across the House for law changes that require notification of affected individuals. I also would like to note that when the Privacy Commissioner released her annual report the Government was yet to respond to most recommendations of the commissioner’s August 2011 review of privacy report. 
I would like to make mention of the top complaints that were received because I think the most important point that was being made here was that the privacy breaches that were appearing were all coming from Government agencies including ACC as we know and the New Zealand Police department the Department of Corrections the Ministry of Social Development the Department of Labour Immigration New Zealand the Inland Revenue Department the Housing New Zealand Corporation and the Civil Aviation Authority. They were the top agencies that were reporting breaches. The fact that those breaches were being reported is a good thing and it is a healthy thing but the remedy—how they are to be dealt with—is the next important issue. 
I would like to I guess make mention of—I think a number of my colleagues across the House have made mention of—the systemic issues that have occurred particularly in the last year. We have had reports just in recent months about these and we are up to I think between 30000 and 40000 individuals whose breaches of privacy have been notified as a result of some of these issues that have come to light. They have come to light not unfortunately because of self-notification; they have come to light because they have been exposed. The Inland Revenue Department had 32 breaches which represented 6379 individuals. ACC as we know is a well-known case where 6000 individuals’ data has been made available to the public. In the case of the Ministry of Social Development 7300 files were made available. I do not know what the latest count is—maybe one of my colleagues can help me here—with the Novopay breaches and the information that has been provided but the last count sometime in November was 8000 individuals affected. That is more than 30000 if you do a count-up around that. 
I also want to make mention of—[ 
Interruption 
] Well it is the tip of the iceberg. It does equal a small town but it is the tip of the iceberg. I also want to make mention of the really good work that has been done by my colleague Darien Fenton in the immigration area around the breaches—and I am sure she will talk about them herself—that have occurred and the effect they are having on those individuals and what that actually means. 
I think the major point to be made here is that when you do have—as I think is agreed around the House—issues of privacy breaches of breaches of information and the impact on individuals you have to deal with it at a governance level. That is extremely important. That is why there is a bill which has been pulled from the ballot called the Electronic Data Safety Bill which actually follows on from what is being discussed here tonight—and there is reasonable support around the House for both these bills. It is about how to deal with these issues by essentially establishing a commission of inquiry into the privacy breaches that have occurred in the last few years and as I have just outlined the effect of them here in the last 12 months and across all of those Government agencies. The bill looks at what the capacity across the Government is to respond to those breaches it tries to look into how they have occurred and then most important it looks at some remedies for dealing with them so that they do not happen again in the future. 
There is no doubt that all of these breaches have been acknowledged but unfortunately there has been a tendency which we have heard tonight from the Government side to try to say that things occasionally go wrong that there is no big deal here and that it is human error. Well I think these issues are a bit more than just human error on an individual agency basis. There are systemic issues here. This is the digital environment. We do have to address these issues on a systemic level across the Government and I do hope that when that bill comes up for debate there is serious discussion around it and there is support across the House.