Locke Keith: Privacy (Cross-border Information) Amendment Bill — First Reading 
Locke Keith: Privacy (Cross-border Information) Amendment Bill — First Reading 
[Volume:653;Page:2343] 
KEITH LOCKE (Green) 
: 
 The Green Party is supporting the Privacy (Cross-border Information) Amendment Bill. We are very keen on protecting people’s privacy and this bill goes some way towards achieving that. It is driven mainly by the requirements of the European Union countries which are at the forefront of the world in protecting databases and privacy. In order for those countries to exchange data they make it a condition for the countries they exchange it with to be up to the required standard. We have some country-to-country arrangements with European nations’ Governments such as the Netherlands. 
As the previous speaker Claire Curran indicated in her description of what the Law Commission is up to on the privacy issue and also the Privacy Commissioner herself when one reads her stuff this bill is touching only the edges of the problem. The issue goes much deeper than what is in this bill. But it is good that we are updating our law to fit in with the European Union requirements and be on what was called earlier its “white list”. 
One of the problems is that so much information is international these days that it is very hard for any one national jurisdiction to really get a handle on the problem and to protect the privacy of databases. If one listens to people like Marie Shroff the Privacy Commissioner one hears them talk now about what I believe is called cloud computing whereby people are not storing information so much on their own computers and hardware but on the Internet. That does not mean it is in the middle of space; it is on a server somewhere. But sometimes one cannot work out which country the server is in and in that respect it is very hard to protect the privacy of databases. 
We also know and it is happening in New Zealand that call centres are going to overseas locations. In New Zealand call centres are now basing themselves in countries like India or the Philippines in particular. Although the countries might have data protection—they are supposed to have passwords and the like to get into the system as well as firewalls; you name it—if one deals with countries like the Philippines the governance is not particularly strong and the workers are not unionised. One cannot necessarily guarantee the privacy of the New Zealand data when there are call centres or data being processed in the Philippines using cheap non-unionised labour in many cases. There is a big problem there. 
Lianne Dalziel talked about the advanced passenger processing system and the protection of data within that system. Airlines have to keep the data secret so that people do not know where travellers are going except that under some of the laws brought in over the last couple of years the airlines have to hand out the data. They have to hand it out not only to New Zealand agencies but to overseas agencies with which New Zealand has an advanced passenger processing agreement. Information such as the details of a passenger’s 28 days of travel or projected travel on either side of the date of departure goes all around the world. 
The European Union which as I said is at the forefront of a lot of this privacy stuff had a big fight with the United States over the passenger processing system. One of the problems was that the American law enforcement agencies said they were after terrorists around the world and therefore wanted information on passengers coming from Europe to America. The European population got a bit upset. So the European Parliament passed motions about for example situations when Europeans—and it would be the same with New Zealanders—paid for an airline ticket with their credit card. The American law enforcement agencies said they wanted as part of their advanced passenger processing terrorist-checking system the credit card numbers on their database for people who paid with their credit card when they booked flights in London or Brussels. The Europeans said that that was all very well except that the Americans did not have any serious data protection systems. They do not—that is one of America’s big weaknesses. New Zealand has an advanced passenger processing exchange with America but we do not really know where the data we are exchanging ends up. 
When we were discussing legislation in Parliament 3 or 4 years ago to guide the advanced passenger processing system we added a provision to tighten it up. The provision said that if information were given to say the US customs or immigration departments the departments could not pass on that information—there was a whole pile of about 20 bits of data on each individual including nationality; you name it—to some other agency unless it was for a continuation of the original purpose. In reality how could that ever be worked out? Since that time the US has set up the Department of Homeland Security which incorporates all the different agencies. The last I heard it had on its database the names of about 70000 people whom it considered a security risk. So there is a lot of room for error discrimination and leakage of data in that whole US system. 
There are cases when people think they are transferring personal information just from one country to another but really it goes around a big circuit of other countries. There was the case about 5 years ago of a man in Auckland called Mohammad Abbas who had a sick relative in India. He wanted to send the relative some money for help in getting hospital treatment. He went into Western Union—an American company—in Auckland to transfer the money. But it did not get to the other end which caused big distress to his family in India. Then it was discovered that Western Union had put the information through to an American Government database and that Mohammad Abbas’ name had come up as having terrorist links so the money never got through. In fact it was just a confusion of names. Mohammad is a very common name and Abbas is a very common name. There will be a whole lot of common names in any database of doubtful people. Abbas had a hell of a problem. There was no guarantee that Mohammad Abbas’ information would not circulate in directions he was unaware of when he first went into Western Union in Auckland. 
There is also the problem of financial data relating to individuals and companies. It is very important private data. It is circulated and exchanged through banks around the world through a computer system called SWIFT. Although it is operated out of Brussels it is American-owned with a mirror of the data running in America as well so that the American agencies can get hold of the information if they want to use it to track down terrorists. Sure we want to track down money transfers between terrorists but in the process currently used to do so the whole privacy system tends to break down. The Europeans have been a bit upset about the SWIFT system and some of its problems. 
There is another problem with the internationalisation of data through law enforcement agencies and even with what information comes up in newspapers. Poor old Ahmed Zaoui had this problem in a different way when he arrived here several years back. The Refugee Status Board did the first processing of his refugee status application and it was much criticised by the Refugee Status Appeals Authority afterwards. An officer at the Refugee Status Board did a Google search and came up with a whole lot of newspaper clippings about Ahmed Zaoui in Belgium and France. The officer thought that Ahmed Zaoui must have some links with terrorism and denied his refugee status application on the basis of media information from abroad that was untested. 
I have been involved as an advocate in other immigration cases. Police files have emails and stuff from agencies overseas that have come through. Supposedly the information is about things like people’s job background but none of it is tested or verified. People have been discriminated against because of that information. There is a free exchange of very personal information between in particular Government databases and going beyond that private databases as well. Sometimes people can get a raw deal because of that. It is good that the European Union is trying to set the pace in terms of protecting privacy. The Green Party supports this bill and wishes the Law Commission and the Privacy Commissioner well in trying to deal with these very difficult and complex issues of protecting people’s privacy.