Curran Clare: Identity Information Confirmation Bill — In Committee 
Text is incorporated into the Bound Volume 
Curran Clare: Identity Information Confirmation Bill — In Committee 
[Sitting date: 13 November 2012. Volume:685;Page:6551. Text is incorporated into the Bound Volume.] 
CLARE CURRAN (Labour—Dunedin South) 
: 
 I would like to say in the Committee stage on this bill the Identity Information Confirmation Bill that the first thing to do is to agree with the member opposite me about identity fraud and how important it is that we address that issue particularly in the digital environment. It is a growing issue. It will continue to be an issue and we have to have measures in place to deal with it. That is why having not sat on the Government Administration Committee and listened to all the submissions but having read some of them and having thought about the issue I certainly acknowledge the importance of it and the fact that we have to keep abreast of fraud in whichever manifestation it appears. We have heard that the Privacy Commissioner was satisfied with the legal safeguards and the controls in this bill. 
We know that it is a serious and growing problem and I am sure a number of speakers have said how many millions of dollars it costs the country as every year about 2000 New Zealanders are affected by online scams. No doubt if I asked people to put up their hands and say whether they had been scammed or they knew somebody who had been probably most people would in one way or another even if it is by having your Twitter account hacked by clicking on one of those connections that takes you to a rather unsightly you know unseemly image. That then means that all of your followers—[ 
Interruption 
] 
Hon Trevor Mallard 
: Some of them are sightly but unseemly. 
CLARE CURRAN 
: I guess it depends on which perspective you come from. All of your followers then get a message from you saying that they are being hacked and people are looking at or saying terrible things about them online etc. Although there is a growing awareness amongst the population about these scams including the scams that come from people purporting to be banks etc. and people are becoming more careful I think about what they do click on online there is still always going to be a percentage of people who are terribly affected by these sorts of practices. So I think it is really important that we acknowledge the importance of the issue. 
When I spoke about this bill in its second reading I said there were two things that we needed to take into account. One is the prevention as I have just said of identity fraud. The other is balanced with the ability of people to go about their business without feeling under surveillance which I know is one of the issues raised by the Greens as being an important thing and that is something we need to take into account as well. Also we have to be mindful as I said in my speech on the previous bill of the systems management that is occurring around the Government agencies’ use of information and communications technology and the security of that. I suppose that is what I want to go to here. I think it is absolutely critical that there is a robustness across Government systems and I am pleased to see that the Minister for Communications and Information Technology is in the chair because there is no doubt that security of information the privacy of individuals’ information and confidence in the system used to manage those systems is absolutely paramount. 
 I made the comment in the debate on the previous piece of legislation that went through this Committee the Electronic Identity Verification Bill that in order for us to be confident about that we have to know that we can trust the agencies that are interacting with citizens out there. I think actually that that has been compromised in recent weeks. I think that there are four major agencies in our Government that have been compromised. We have heard the issues around that. In order to address that I actually introduced a member’s bill last week called the Electronic Data Safety Bill which is around ensuring that there is a systematic inquiry into breaches in agencies around privacy so that the adequacy of information management can be trusted. This is what it comes down to: can the citizens of New Zealand trust the systems that are in place that are managing information including their private information and that can make that information public to people that it should not be made public to? 
What I am saying is that before we pass pieces of legislation like this that are worthy and important because identity fraud is important we should actually have a good look at the adequacy of those information systems that we do that through an inquiry and we then ensure that we put in place systematic information management across Government which includes a governance system that is not just agency based so that that management system transcends the individual agencies and then we look at these pieces of legislation that are coming before the House. 
I have sought industry views around this which is why I am pleased to see the Minister in the chair. I am being told that what we need is something more than what we have got. This is ultimately about public confidence. It is about confidence in the security of the information and the security of the systems that we have got which will be restored only when the public can see that the ministries and the departments are working together and bending over backwards to ensure that that data is secure. Mistakes happen. There is no doubt that mistakes happen. In any development of any new system etc. of course there are going to be mistakes. But on the kind of scale that we have seen—in the last few weeks particularly—it is just not on. The mistakes are systemic and they are not just in one ministry or one department; they are across a number of agencies. 
I am being told that we know that this is an issue that this does need to be addressed at a different level. That might involve setting up a new part within for instance the Department of Internal Affairs with—and I think it is important to say this—some sort of dotted line to the Privacy Commissioner. This is about privacy and people feeling that their information is secure. This new part would look after the rule-setting for Government agencies and public information have the power to advise and require certain things before any system is launched and investigate and test post any launch. I think it is important to note that the private sector has quite a lot of experience in these things. I think that the Government and the agencies affected should be looking outwards right now as to what experience they can draw on to bring in that experience and see what can be done about this issue before we put these pieces of legislation to the House. Ultimately they are about providing new systems or extending systems that are small and making them bigger. It is about the privacy of New Zealand citizens’ information. That information and the trust that that information is not going to be abused and misused is really important. I would hope that the Committee recognises that. 
I would like to see that future developments around how these sorts of developments are rolled out do ensure that there are provisions around security of personal data and that they are put to the top—put to the top. They are not at the bottom and they are not in the middle; they are at the top of the requirements list. There should be penalties around them not being carried out. I am not talking necessarily about penalties to individual companies. I am talking about accountability at the highest level—about the governance level which is at the political level as well. That is where it should reside and that is what we should be talking about today in the Committee rather than about introducing yet another piece of legislation that is piecemeal and that is not part of a wider plan around the security of our information.