Privacy And Personal Information Protection Amendment (Notification Of Serious Violations Of Privacy By Public Sector Agencies) Bill 2017

Photo of computer screen
12 April 2018

Mr ALISTER HENSKENS ( Ku-ring-gai ) ( 11:52 :35 ): It is always a pleasure to see the old jury advocate, in the member for Heffron, fire up in this place and to try to make something seem to be a massive Coalition conspiracy, because that is the way that members of the Labor Party like to play: They like to play the man, rather than the ball. Let us reflect for a moment on the operating environment in which this private member's bill has been brought before the House. I note that the member for Heffron was a distinguished member of the bar before he came into this place, which those in the public gallery probably would not know. He knows as well as I do that in 1990 the High Court decided, in New South Wales v Commonwealth, reported at 169 CLR page 482, that incorporaton of corporations is a matter for the Commonwealth Parliament.

Mr Ron Hoenig: That is why the bill does not refer to corporations.

Mr ALISTER HENSKENS: Exactly, and that is my point. This bill is dealing with a pinprick in the area of privacy: an issue that must be dealt with by governments in Australia. We saw on last night's news and read in this morning's papers that Mark Zuckerberg was grilled by the United States Senate because of privacy breaches committed by Facebook, a private corporation. Because it is a private corporation, it is a body that is entirely outside of the power of any legislation of this Parliament. It is important that people's privacy and private information be protected, but it is equally important that it not be done piecemeal by the shadow Attorney General, who, with all due respect, is hardly at the cutting-edge of digital technology. We see the shadow Attorney General sitting on the bench, and we know that he has spent many years in this Parliament. Probably like me, he did not first touch a computer until he was well into his twenties—I suspect he may even have been in his thirties.

Technology in this area is complex, and tackling issues of privacy relating to technology should not be done in a piecemeal fashion, and without proper consideration and consultation. At the end of the day, all we are talking about with regard to the constitutional competency of this Parliament is the protection of private information held by New South Wales government agencies. That is the entirety of the constitutional remit of this Parliament, so when we consider the pinprick of private information that is within the legislative competency of this Parliament, the somewhat boisterous, blown-up balloon of a speech by the member for Heffron quickly loses its air because it is shown to be the puff of hot air that it really is.

It is not as if this Government has done nothing to protect the privacy of residents of New South Wales in so far as their private information is held by public authorities. The Government has established an independent statutory authority called the Information and Privacy Commission, which administers New South Wales legislation dealing with privacy and access to government information. The Information and Privacy Commission was established to support the Information Commissioner and the Privacy Commissioner in fulfilling their legislative responsibilities and functions and to ensure that individuals and agencies can access consistent information, guidance and coordinated training about information access and privacy of information concerning government instrumentalities in New South Wales.

The Information Commissioner is the head of the commission and is responsible for the strategic direction and management of the staff of the commission. The integration of information access and privacy is aimed at achieving meaningful outcomes by successfully balancing the two functions within a mature operational model. The new Privacy Commissioner was appointed in the middle of June 2007, Samantha Gavel. She has a distinguished background that well equips her to contribute to this area of regulation. She was the National Health Practitioner Ombudsman and Privacy Commissioner, and previously held the role of Private Health Insurance Ombudsman for six years. She has also held various other positions that qualify her to perform her role.

We should take this opportunity to commend the Information and Privacy Commission [IPC] on the hard work it is doing. Since its establishment, it has strengthened its operational effectiveness in case management based on an internally robust foundation of sound procedures, systems, governance, prioritisation and investment in capability. Its approach has enabled it to project its work externally and adopt a strategically regulatory approach. It is guided by a risk‑based and intelligence‑informed approach to regulation. Risk-based regulation and using intelligence to inform its regulatory activities enables the commission to prioritise and target resources to those areas that pose high risks to the achievement of its regulatory objectives.

The commission's service standards require 80 per cent of complaints and reviews to be finalised within 90 days of lodgement—which is a fairly impressive record. Since July 2016, the commission has finalised 93 per cent of information access reviews within service target time frames, which is a substantial improvement on the previous year's result of 43 per cent. The outcome reflects the improvements in timeliness and case management processes in an environment in which there is no longer a case backlog. This regulator is dealing with complaints in an incredibly efficient fashion. Notwithstanding a 5 per cent increase in the number of complaints, the commission has been able to maintain its case efficiency with regard to people's concerns about privacy breaches. This is a complex area with existing protections and we do not want ad hoc developments. This is an area where the Federal legislation, which governs probably 99 per cent of privacy issues in our community, is in harmony with the New South Wales legislation.

I note that the Attorney General informed the House that complete consultation with regard to this private member's bill was not undertaken and that he is conducting investigations into how current New South Wales legislation can be improved. On that basis, in the interests of consistency, harmonisation and thoroughness, it is important that the Government proceed with this matter in a more comprehensive and consultative fashion than has occurred in preparing this private member's bill.