Dalziel Lianne: General Debate 
Text is incorporated into the Bound Volume 
Dalziel Lianne: General Debate 
[Sitting date: 27 March 2013. Volume:688;Page:8998. Text is incorporated into the Bound Volume.] 
Hon LIANNE DALZIEL (Labour—Christchurch East) 
: 
 We should have had a snap debate yesterday as a result of the privacy breach by the Earthquake Commission. It met every test. However what was relied on was the Privacy Commissioner noting that the Earthquake Commission had taken an honest and open approach to the breach. I agree with that. If that was all that had happened—what happened on Friday—I would not have called for a snap debate. Then it was also said that the commissioner would be following up to make sure that similar breaches cannot occur in the future. I want to tell the House what else the Privacy Commissioner said in her release: “The Privacy Commissioner Marie Shroff said today”—and this was on Friday—“that public sector agencies needed to have stronger controls in place when handling spread sheets of personal information. ‘The EQC breach is yet another incident involving inadvertent disclosure of large amounts of personal information on a spread sheet. We hope that agencies are starting to realise that they should have stronger controls in place to help to prevent these types of mistakes. But they clearly have a way to go yet. I think it has reached the stage where the public need some further reassurance’ Marie Shroff said. ‘So I am considering writing to the State Services Commissioner and all public sector chief executives asking them to tell me what precautions they have put or are putting in place to help prevent inadvertent emailing of client information on spread sheets.’” 
Then she said the bit that was relied on yesterday and then she said this: “There are real people behind the information that government holds and we all have the right to expect that our information will be strongly protected.” That is the issue. The Government can take the Crosby/Textor classic approach of attacking the messenger to divert attention from the real problem but this will not go away. The role of the parliamentary Opposition is to hold the Government to account but when we are denied access to the tools our Standing Orders provide for that purpose for unknown reasons the Government is let off the hook unreasonably so. The Prime Minister should have been standing in the House yesterday admitting that the Government had failed to give the people of New Zealand confidence that it can be entrusted with people’s personal information and that is what this is all about. 
Yes there is a Christchurch issue and now we know that the Earthquake Commission could easily give people a quick snapshot of where they are up to in the system whether there are any hold-ups with their claim what they are and what time frame is anticipated for their resolution. Not one aspect of the confidential commercially sensitive information needs to be released but of course that is the one—the Crosby/Textor approach—that the Minister for Canterbury Earthquake Recovery focuses on to avoid fronting the real question which is why people do not know what is holding them up and why the Earthquake Commission will not give them that information. We now know that it has precisely that information. 
But the bigger-picture issue is that this Government is not meeting its obligations to provide data protection even though it is legally and morally obliged to do so. Under John Key’s watch there have been serious breaches of New Zealanders’ private information at the Ministry of Social Development ACC the Inland Revenue Department Work and Income Novopay the Department of Corrections and now the Earthquake Commission. This is not just a simple case of human error. Of course there was human error but it is not good enough to say that we have all sent an email or a text message by mistake at some point. We are not all responsible for massive amounts of personal data. It is not good enough to say that it was one file sent to one person. It contained over 80000 separate entries covering 98000 claims. It is not good enough to say that this is like putting the wrong address on an envelope. It is not. The Government is responsible for receiving and handling massive amounts of personal information which can be transmitted in a nanosecond. That is why we have data-protection laws. You could not stuff 80000 pieces of information into an envelope to wrongly address. That is the point of data protection. 
The latest breach shows that there is clear evidence of a serious and widespread problem with the security of our Government information systems. That is why the Prime Minister of New Zealand must take responsibility.