Curran Clare: Electronic Data Safety Bill — First ReadingText is incorporated into the Bound VolumeCurran Clare: Electronic Data Safety Bill — First Reading[Sitting date: 18 March 2015. Volume:704;Page:2385. Text is incorporated into the Bound Volume.]CLARE CURRAN (Labour—Dunedin South): I move That the Electronic Data Safety Bill be now read a first time. I nominate the Commerce Committee to consider the bill. New Zealanders need to have the utmost confidence that their personal information held by the Government is secure and private. There have been numerous and very high-profile incidents in recent years that have shaken that confidence. The establishment of an Electronic Data Safety Commission which is what this bill does will help restore confidence.This should not be a partisan issue. Every member of this House understands the need for privacy and security of information in conducting their role as an MP. We must ensure that the information the State holds regarding members of the public is treated with the same care and respect we expect the information we deal with as MPs to be treated. We must ensure that the electronic systems used are robust resourced modern and regularly audited. But there is a growing body of evidence that this is not the case. If the Government’s intention today is to vote against this bill because it claims that the numerous issues with data security over recent years are minor isolated incidents and that they have been addressed by a few internal appointments then I ask that the Government put that claim to the test by establishing the Electronic Data Safety Commission to reassure the public.There is a widespread perception that personal data is not safe with the Government. If that perception is misplaced then this commission will show that. The Privacy Commissioner’s 2014 annual survey of the public showed that 63 percent of them rate their level of concern about the privacy of their information as high and that this number has remained very high over recent years. The Privacy Commissioner’s office gets notified of an increasing number of data breaches every year the vast majority in the public sector. In the 2013-14 year the total figure was 113 up from 16 in 2008-09. Of those 86 were in the public sector—across the Government and in the hospitals and other health agencies. These are important breaches and they are significant.Almost a year ago the previous Minister of Justice Judith Collins announced significant changes to the Privacy Act that would give the Privacy Commissioner more powers to compel public and private sector organisations to report privacy breaches. In May 2014 Judith Collins said it was vital that New Zealanders have confidence in our privacy laws and that people know that their information is in safe hands. She said she was going to introduce legislation for the mandatory reporting of data breaches with new offences increased fines enhanced powers for the Privacy Commissioner and various other things. That was nearly a year ago and that legislation is not even on the Order Paper. Where is it? Well a little birdie tells me that it might have got lost. That is a significant worry and I ask the current Minister of Justice where that legislation is.There are fundamental concerns—fundamental concerns—about IT governance and accountability as well as the wider Government attitude to privacy that have got to be addressed. The National Government must answer for a long line of recent privacy breaches that include breaches at ACC the Ministry of Social Development the Earthquake Commission Housing New Zealand the Medical Council of New Zealand Immigration New Zealand and most recently the Ministry of Justice. Two other very recent privacy breaches include the Southern District Health Board labelled incompetent after accidentally sending the private health details of 60 patients to a member of the public. In January this year a privacy breach blunder resulted in the personal details of more than 600 females some as young as 13 who had had abortions in the central North Island being given to Fairfax Media. These are recent occurrences. These have not been dealt with.This is systemic. Today I revealed in question time that there are deeply concerning high-level risks identified within the Department of Internal Affairs which Peter Dunne is the Minister of that are leaving Government networks vulnerable to attack including security controls that are not functioning a lack of ability to investigate malicious activity and insecure information being transmitted over the Department of Internal Affairs’ cloud provider networks and other cloud provider networks. But the Minister has denied that under his watch any Government system has gone live without accreditation from the New Zealand Institute of Safety Management and sign-off from the Chief Executive of the Department of Internal Affairs.Well you would think the Government would have learnt from Novopay. You would think it would have learnt from the bungles. It is my understanding that there have been IT systems going live without accreditation and without sign-off. They include the “Desktop as a Service” cloud-provider networks. Many vendor systems are either insecure accessed by foreign nationals locally accessed by contractual agreements with third parties overseas often with poor sanitation of data or all three of those together. These are extremely important significant issues happening right now in one of our most important Government agencies. John Key has been consistently blasé in the face of recurring privacy breaches. There is a distinction between one-off mistakes and a systemic widespread privacy problem that is not being resolved.The commission of inquiry in my bill is needed because more and more personal information is being collected electronically by the Government and we need to ensure that guidance and proper rules are set in place to protect the privacy of New Zealanders in an increasingly sophisticated environment. I know that many members on the Government side claim to take data security and the privacy of the public very seriously. Well now we get to see whether they live up to their rhetoric by supporting this bill.National should vote for this bill because this bill will assist the Government in achieving one of its Better Public Services targets. Target 10 is that “An average of 70 per cent of New Zealanders’ most common transactions with government will be completed in a digital environment by 2017.” The number is currently at 46 percent. To lift this to 70 percent by 2017 New Zealanders will need to have greater confidence in the security of their transactions. A commission that assesses the problems with data security and recommends solutions can only help the current Government in achieving this target. It would be somewhat perverse for the Government to vote against this bill for purely partisan reasons when it actually helps it achieve one of its stated election promises.Peter Dunne should support this bill. The Minister of Internal Affairs claimed today in question time that he believes that New Zealanders’ personal information is being managed securely in his department. Well he needs to vote for the bill to prove that this is the case. He originally pledged to support this bill as you heard in question time but that was before he got caught out leaking confidential documents to the media and then attempted to mislead the public about that. After he was stood down as the revenue Minister a few months later he was—without any hint of irony—appointed as Minister of Internal Affairs responsible for data security. Well if Mr Dunne wants to have any credibility he should be up here today voting for this bill to show that there is probity and that there are proper processes happening within his own ministry.David Seymour the ACT member for Epsom in his maiden speech spoke of liberty and of improving public policy so that “free individuals may flourish”. Well surely if Mr Seymour is going to be true to his libertarian beliefs he must vote for this bill to ensure that the State is handling the information of private individuals which is the private property of those individuals in the most appropriate and careful manner. Voting this bill through to select committee is the first step so that we can receive public submissions on the security of data and discuss how the effectiveness of the commission could be improved. We owe it to the public to ensure that their personal information is treated with the respect it deserves.