Curran ClareINTELLIGENCE AND SECURITY BILLIn CommitteeDebate resumed from 15 March.Part 5 Accessing information held by other agenciesCLARE CURRAN (Labour—Dunedin South): My comments are related to privacy and to the importance of privacy measures in the legislation. I think I started my comments last night by acknowledging the engagement of the Minister in the chair Christopher Finlayson. I also want to acknowledge that there are more protections for privacy in this bill as amended by the Foreign Affairs Defence and Trade Committee in particular the removal of clause 109.However I do want to make some comments about the importance of the privacy provisions. I think it was my colleague Grant Robertson who last night used the phrase uncomfortable concerns". Well I have some uncomfortable concerns about the state of our privacy legislation—our privacy provisions generally—in New Zealand. Although this bill seems to go quite a long way to ensure that privacy is taken into account it still leaves a lot of questions about the overall privacy framework and I am wondering whether the Minister in the chair might want to comment on that in particular.Today I am actually tabling an amendment to clause 101A which inserts after clause 101A(3)(b) a new paragraph: "(c) the Privacy Commissioner." Clause 101A relates to the register of section 101 certificates where "(1) The Director-General of an intelligence and security agency must keep a register of all certificates issued …" and where "(3) The register may be accessed at any time by—(a) the Minister responsible for the intelligence and security agency: (b) the Inspector-General." and if my amendment is accepted then also by the Privacy Commissioner. The reason for that is that it is I suppose an extra check and balance. It is an extra set of eyes. It is an extra sense that there is more transparency and independence around the issuing of certificates and keeping the system honest.I note that the Privacy Commissioner has to be consulted with in regard to the direct access agreements. This is in clause 105 "Consultation with Privacy Commissioner before entering into direct access agreements": "must consult with and invite comment from the Privacy Commissioner on the proposed agreement." That goes to really the intent of Part 5 which is around how information is accessed by other agencies. I note that that is actually quite a step forward and I think it provides some significant comfort around how that information from public sector agencies will actually be shared—if the Privacy Commissioner is able to have some input and particularly to be consulted before it happens. That is why I have suggested in my amendment to clause 101A that the Privacy Commissioner also be given a role in relation to being able to view the certificates that are issued—essentially the warrants that are issued. It would be good if the Privacy Commissioner could then do some reporting on the numerical number or whatever so that there is more transparency in the system.This goes to essentially—and this is one of my questions to the Minister—around how this piece of legislation fits with the existing Privacy Act. That Act underwent quite a considerable review—well a fundamental review—by the Law Commission in 2011. It is now 2017 and there has not been any acting by this Government on the strong recommendations of the Law Commission to reform the Privacy Act. Here we have a sort of upping of the Privacy Commissioner's role in this piece of legislation but the foundation legislation for privacy in New Zealand is way out of date.I note the comments that were made by the outgoing Privacy Commissioner Marie Shroff a couple of years ago. She described privacy and security—in other words our intelligence framework—as being like twin pillars and said that really a true functioning democracy operates most effectively when those pillars are truly twinned when they are equal. Well in recent years what we have seen is our intelligence framework—our legislative framework around intelligence the gathering of information the restrictions on telecommunications companies and the role of the intelligence agencies—we have seen several pieces of legislation we have seen significant reforms in those areas but we have never seen any reform yet in the privacy legislation. I wonder whether the Minister has considered the impact of this whether or not the provisions in this legislation that are giving the Privacy Commissioner more powers actually do somehow undermine the Act or conflict with the Privacy Act itself and whether he could answer those questions.The other point I wanted to make is the disconnect between this legislation and its information in terms of say clause 105 "Consultation with the Privacy Commissioner before entering into direct access agreement". When it is anything to do with the direct access agreements with public sector agencies and the lack of attention paid to the private sector that disconnect seems to be there.I note that in clause 118—of course I did not sit on the committee so I was not party to the discussions—there are provisions made around telecommunications companies. It seems as if the work has been done on that and that there is nothing hugely controversial in the legislation. But where are the mechanisms for the information for the comparable relationships with the private sector and what role does the Privacy Commissioner have there? Because people do not operate in just the public sector.These are quite important and quite fundamental questions—the role that privacy plays in our country. Our provisions and protections around privacy are out of kilter with our intelligence framework I think and these are matters that I hope the Minister will address."