Cunliffe David: Electronic Data Safety Bill — First ReadingText is incorporated into the Bound VolumeCunliffe David: Electronic Data Safety Bill — First Reading[Sitting date: 18 March 2015. Volume:704;Page:2389. Text is incorporated into the Bound Volume.]Hon DAVID CUNLIFFE (Labour—New Lynn): There is an old joke doing the rounds in the Pacific that at least now New Zealand is listening to them because the Government Communications Security Bureau (GCSB) is wholesale harvesting their data. The same joke has been going around in New Zealand that the first time the National Government has listened to New Zealanders is when it got the GCSB to do it. That is of course an extreme example of what we are talking about here: the necessary privacy that must be attached to citizens’ information be that at the routine level of avoiding breaches and stuff-ups the systemic level of developing systems that are resilient and robust to those accidents and even more important the systemic level of avoiding the deliberate attempts by third parties to access the private information of New Zealanders.Before I go into those three layers for which this special commission of inquiry is essential let me just quickly note the fallacy in the previous speaker’s contribution. Her line of argument was that because one of the examples quoted by my colleague Clare Curran dated from 2012 the bill was no longer needed because everything had all been fixed. Well my colleague has done a data pull on stories of Government privacy breaches since January 2015 and there are plenty of them. There is a Northland Regional Council breach. There is an abortion data-leak error from Lakes District Health Board to Fairfax Media. There is the Broadcasting Standards Authority claim around the Valley Animal Research Centre. There is a Plunket privacy breach in Taranaki—that is an NGO sector rather than the Government sector. There is the Southern District Health Board and so on and so forth. So there are plenty of examples.If you want the statistics the Privacy Commissioner has helpfully compiled them. They tell us several interesting things. Since 2012 when the member’s quoted example was concluded the number of Government privacy breaches has actually gone up. In the last year Labour was in office it was 13. In the most recent year under investigation which is 2014 there were 86. It has gone up from 13 to 86. What is worse is that the private sector equivalent—the whole private sector which is two-thirds of the economy—had only 27. So the one-third of the economy that is the Government run by the National Party had 86 major privacy breaches and there were only 27 in the rest of the economy.What kinds of causes were there according to the Privacy Commissioner? There was unsafe website design loss or theft of physical data files loss or theft of portable storage devices improper employee browsing that was not prevented electronic information sent to the wrong recipient or physical information sent to the wrong recipient. These are all causes.Let us come back to that staircase of issues. At the bottom level is an individual agency that has a stuff-up whether it is a computer design error or whether it is an employee error and they can be extremely serious. The member opposite quoted some cases where third-party consultants had been called in to investigate them. It is good in so far as it goes if the report is thorough and if the agency acts on the recommendations—we all know they usually gather dust on the doorstep—and they are implemented. But what an individual report cannot do is it cannot look at the system and it cannot look at the links between different agencies and the protocols that run and necessarily should run across the whole of Government.That is when we get into the second tier—that is systemic data security design. Not long ago the Government did a project on authenticating individuals. The Government wants to take individual transactions with Government online up from 46 percent to 70 percent. We live in the age of big data. These privacy issues are going to become more and more and more important.And then we get to the third tier which is deliberate use of private data. That happens every day admittedly. Internet service providers website hosting companies and everybody else seem to have systems where they harvest data about their users and then onsell it to third parties or use it to target their own activities. We need to make sure that the Government’s protocols around all three layers are tight. That is why we need this commission of inquiry. That is why we need this bill.