Chauvel Charles: Privacy (Information Sharing) Bill — First Reading 
Text is incorporated into the Bound Volume 
Chauvel Charles: Privacy (Information Sharing) Bill — First Reading 
[Sitting date: 08 February 2012. Volume:677;Page:229. Text is incorporated into the Bound Volume.] 
CHARLES CHAUVEL (Labour) 
:  
We have heard from the Minister of Justice that the Privacy (Information Sharing) Bill arises from an exercise that was begun by the Law Commission I think in October 2006 and completed only in August last year. So it is something that took over 5 years and was required to be done in four different stages because of the scale of the work. I read the report again today. It contains some sweeping recommendations for reform and this is no less than we should expect. After all the original Act dates from 1993 long before social media were in vogue before smartphones and even before the widespread use of the internet and email. So reform is overdue. The way in which we deal with information in our society today is vastly different from the way it was in 1993.  
The Law Commission recognises this in its full report. One of its recommendations is that the Privacy Commissioner’s powers should be significantly augmented by a new power to issue a compliance notice where there is a clear breach of privacy principles and where there is good reason for it to require an audit of an agency’s information-handling procedures. All we need to do in this House is think about some of the recent controversies around organisations like Google to think about what an important addition to the Privacy Commissioner’s armoury that would be and what a useful one that would be from a consumer protection point of view.  
The commission also recommends that the complaints process under the Act should be streamlined in a number of respects including giving the Privacy Commissioner a binding power of decision on complaints about people’s rights to access to their own information. Anyone who has been involved in supporting a complainant to the Privacy Commissioner knows that the current procedures are cumbersome. They take a long time and in the end the commissioner herself does not have a power of decision. All she can do in the event of failing to get the parties to a complaint to agree an outcome is to refer the matter on to the Director of Human Rights Proceedings who can then decide whether or not to take a case to the Human Rights Review Tribunal—and he may not in which case the only recourse to the complainant is to fund one himself or herself. So that really is something that needs reform.  
There are another three significant recommendations that I want to mention tonight. Agencies should be required to notify people when personal information held by the agency is lost or otherwise compromised—for example through computer hacking—if the breach is sufficiently serious. There is just nothing in the Act or the privacy principles at the moment to equate with that sort of requirement and it is obvious why: 1993 largely pre-dated hacking. There should be—this is another recommendation—a new framework in the Act to allow the sharing of personal information between Government agencies where it is in the public interest to do so but with appropriate safeguards. Finally some exceptions to the privacy principles should be modified—for example to clarify that people can pass on information to an appropriate person where someone’s health is seriously at risk or can report suspected offending to the police.  
It will be apparent from the Minister’s speech and from a reading of the bill that it is just those last two recommendations that are being picked up and dealt with in this legislation. Last year the Government identified information sharing in particular as a matter of urgency. The Minister mentioned in her speech first that she thought there were difficulties around information sharing in the Government sector although she did not specify what those difficulties were and she mentioned the problem of child abuse. But again I am not sure with respect to her that she made a link between that undoubtedly very troublesome phenomenon and the amendments that are proposed in the legislation that we are looking at tonight. None the less it is clear that the bill is being brought forward to progress those last two recommendations of the commission that I mentioned. We have heard from the Minister that that is the rationale for it so that is the basis on which we need to evaluate this legislation.  
On this side of the House our usual practice is to support the referral of legislation to a select committee unless the proposals that are contained in it are repugnant or just fatally flawed in some way. As I have said these are proposals that flow out of a carefully considered Law Commission report. There are significant safeguards contained in the information-sharing powers. So it seems to us that because the work flows out of recommendations of the Law Commission we should not at this stage fail to give it our support to go to the Justice and Electoral Committee to be properly considered. The information-sharing regime that the Government will be subject to under the bill clearly is intended to improve clarity to ensure that information can be shared with more certainty and to make it easier for that sharing to be carried out as I said earlier with appropriate protections.  
Obviously any increase in Government control over New Zealanders’ personal information needs to be carefully considered and balanced with strong safeguards but it is apparent that the bill consistent with the Law Commission’s recommendations does contain those safeguards. It provides for transparency accountability and robust decision-making in the sharing of information by setting out the considerations that must be taken into account before information is shared including the privacy risks. It requires transparency around this decision making by giving the Privacy Commissioner the right to publish her advice to Ministers and I hope that it becomes a regular practice and that such advice will be tabled in public as a matter of course. There are requirements on departments to report on their activities and information-sharing agreements that are reached are always subject to review by the Office of the Privacy Commissioner. Obviously there is also the fact that any resulting agreements will be treated as delegated legislation and will be subject to the scrutiny of this House via the Regulations Review Committee and I can assure the House as chair of that committee that we will take a robust approach to scrutiny in respect of these agreements.  
It is also important I think that the Law Commission has recommended—and the bill has carried this through into the first draft—a strong role for the Privacy Commissioner including providing flexibility for her to vary requirements for example on reporting in accordance with perceived privacy risk. As she is the expert on privacy risk it is appropriate that she should make that assessment.  
Having said all that I am not left without concerns about this legislation. As I said earlier I feel there has been an inadequate explanation from the Minister for severing these two recommendations of the Law Commission from the bulk of the rest of its work and we are going to have to have a better explanation frankly at the select committee if support is to continue to be forthcoming. We are going to have to see the evidence for the link between the problems identified and the solutions proposed such that they are sufficiently urgent to be brought forward in this way.  
There is the obvious danger that the rest of the Law Commission’s work will just languish given that this Government does tend in the area of justice and law and order to accord priority politically rather than according to evidential need. This would be a tragedy from a consumer protection point of view because of the enormously complex environment caused by the new technologies that I referred to earlier. We especially need those enhanced powers on the part of the Privacy Commissioner. If the Government’s agenda is simply to advance these two recommendations and to leave all the others languishing on the Order Paper or not even to legislate for them then an absolute disservice will be done to every consumer in this country by the Minister.  
I am also concerned that the robust controls and safeguards in the bill as it stands might be weakened as we go through the process and we will be absolutely vigilant at the select committee to ensure that that does not occur. There are also some concerns in the regulatory impact statement that cannot be ignored. It is noted that there are no resources provided for the commissioner or for agencies to accommodate the requirements on them in the new legislation. So we will be supporting the referral of the legislation to the select committee. I wish the new chair of that committee well in that work.