New Zealand Intelligence and Security Bill

2.1. Are there any publicly available inquiry, review or evaluation reports that have informed, or are relevant to, the policy to be given effect by this Bill?

YES

The title is ‘Intelligence and Security in a Free Society:  Report of the First independent review of Intelligence and Security in New Zealand’. Authored by Hon Sir Michael Cullen, and Dame Patsy Reddy, and dated: 29 February 2016.

Available at :

https://www.parliament.nz/en/pb/papers-presented/current-papers/document/51DBHOH_PAP68536_1/report-of-the-first-independent-review-of-intelligence

2.2. Does this Bill seek to give effect to New Zealand action in relation to an international treaty?

NO

2.3. Were any regulatory impact statements provided to inform the policy decisions that led to this Bill?

YES

Regulatory Impact Statement: Intelligence Services and Oversight Bill, the Department of the Prime Minister and Cabinet, 5 April 2016.

Addendum to Regulatory Impact Statement: Intelligence and Security Legislation, the Department of the Prime Minister and Cabinet,  11 August 2016.

The regulatory impact statement can be found and downloaded at

http://www.treasury.govt.nz/publications/informationreleases/ris.

2.3.1. If so, did the RIA Team in the Treasury provide an independent opinion on the quality of any of these regulatory impact statements?

NO

The RIS identified above did not meet the threshold for receiving an independent opinion on the quality of the RIS from the RIA Team based in the Treasury.

2.3.2. Are there aspects of the policy to be given effect by this Bill that were not addressed by, or that now vary materially from, the policy options analysed in these regulatory impact statements?

NO

The features of the RIS identified above correspond to the key policy features of this Bill with the exception of the definition of ‘national security’. The definition in the Bill reflects the recommendation of the independent reviewers, while the proposed definition in the RIS is an alternative formulation proposed by officials and not agreed to.

2.4. Has further impact analysis become available for any aspects of the policy to be given effect by this Bill?

NO

A number of the problems faced by the intelligence and security agencies (as well as the issues that these give rise to) are difficult to discuss publicly or to quantify, because of the need to keep operational matters confidential. For this reason it has not been possible to provide significant analysis of the impacts (including of the costs and benefits) of the proposed changes.  Instead, officials considered matters such as transparency and building public trust and confidence in the intelligence and security agencies, as keystone objectives in lieu of a fully developed cost/benefit analysis. 

2.5. For the policy to be given effect by this Bill, is there analysis available on:

(a)   the size of the potential costs and benefits?

NO

(b)   the potential for any group of persons to suffer a substantial unavoidable loss of income or wealth?

NO

The policy which this Bill gives effect to is not expected to cause any group of persons to suffer a loss of income or wealth.

2.6. For the policy to be given effect by this Bill, are the potential costs or benefits likely to be impacted by:

(a)   the level of effective compliance or non-compliance with applicable obligations or standards?

YES

(b)   the nature and level of regulator effort put into encouraging or securing compliance?

YES

The exercise of the intrusive powers will inevitably impact on individual privacy.  Compliance with the Bill’s provisions is necessary to ensure any individual privacy impacts are mitigated. Effective compliance is supported by increased oversight, accountability and transparency around the use of powers. This is particularly relevant for the structure of the authorisation of intelligence warrants (Part 4 of the Bill) and the involvement of both the Attorney-General and a retired High Court Judge when a New Zealander is targeted.

The Bill sets out the responsibilities and powers of oversight bodies. The roles of the Inspector-General of Intelligence and Security and the Intelligence and Security Committee are strengthened by the Bill. Under clause 92 a panel of judicial commissioners will be set up to increase capability to manage the work load (RIS paragraphs 133 – 167). 

The addendum to the RIS covers the implications of changes to the Privacy Act 1993 by the Bill. Individuals may complain to the Privacy Commissioner if they consider that the intelligence and security agencies (the GCSB or the NZSIS) have interfered with their privacy – noting that this right only applies to actions that engage information privacy principles that apply to the GCSB and the NZSIS. Increased application of the principles gives individuals an avenue of complaint in respect of certain actions taken by the NZSIS and GCSB where none has existed previously.

On the changes to the Immigration Act 2009, an infringement and offence regime already operates effectively for carriers providing Advance Passenger Processing information and Passenger Name Records information on passengers planning to arrive in New Zealand.  Ministry of Business, Innovation and Employment officials have not identified any reason why it would not operate as effectively when extended to passengers leaving New Zealand.

3.1. What steps have been taken to determine whether the policy to be given effect by this Bill is consistent with New Zealand’s international obligations?

The Ministry of Foreign Affairs and Trade and Crown Law were consulted on the development of the policy proposals in order to determine compliance with relevant international obligations.

3.2. What steps have been taken to determine whether the policy to be given effect by this Bill is consistent with the principles of the Treaty of Waitangi?

No specific steps were taken as it was considered that the provisions do not affect the general principle that New Zealand legislation is to be interpreted consistently with the principles of the Treaty of Waitangi.

3.3. Has advice been provided to the Attorney-General on whether any provisions of this Bill appear to limit any of the rights and freedoms affirmed in the New Zealand Bill of Rights Act 1990?

YES

Advice provided to the Attorney-General by the Ministry of Justice, or a section 7 report of the Attorney-General, is generally expected to be available on the Ministry of Justice's website upon introduction of a Bill. Such advice, or reports, will be accessible on the Ministry's website at http://www.justice.govt.nz/policy/constitutional-law-and-human-rights/human-rights/bill-of-rights/

3.4. Does this Bill create, amend, or remove:

(a)   offences or penalties (including infringement offences or penalties and civil pecuniary penalty regimes)?

YES

(b)   the jurisdiction of a court or tribunal (including rights to judicial review or rights of appeal)?

YES

(a)The Bill creates a number of offences and penalties. Some are carried over from existing legislation covering the intelligence and security agencies, while others are new.  See Appendix one for details of the offences and related penalties.

(b)Clause 9(3) makes the NZSIS a public service department and as a result the Employment Relations Act 2000 will apply to its employees for the first time, bringing NZSIS within the jurisdiction of the Employment Relations Authority and the Employment Court.

Clause 227 amends section 349 of the Immigration Act 2009 to extend an infringement and offences regime (currently covering Advance Passenger Processing information and Passenger Name Record information for travellers to New Zealand) to also cover the new clauses inserted by the Bill and passengers leaving New Zealand. Carriers who fail to comply with their obligations to collect Advance Passenger Processing information and Passenger Name Record information and to send that information to the Chief Executive of the Ministry of Business Innovation and Employment may be the subject of criminal charges or infringement fees.  Carriers who allow a person to board a craft contrary to a directive or who allow a person to board a craft before the Chief Executive has made a decision will also be subject to criminal charges or infringement fees.

3.4.1. Was the Ministry of Justice consulted about these provisions?

YES

The Ministry of Justice was consulted on the development of Bill, which included commenting on versions of the Bill and discussion with Ministry of Justice officials.

3.5. Does this Bill create, amend or remove any provisions relating to the collection, storage, access to, correction of, use or disclosure of personal information?

YES

The Bill sets up a warranting regime in Part 4 that authorises activity that would otherwise be unlawful—for example, conducting surveillance and intercepting private communications (clause 64). Provisions include tests for ensuring an intelligence warrant is necessary, and an authorisation regime that will impose restrictions on both intelligence and security agencies when they propose exercise of their powers in respect of a New Zealander. The agencies will only be able to take actions for the purpose of collecting intelligence about a New Zealander if they obtain the approval of both the Attorney-General and a Commissioner of Intelligence Warrants (a judicial commissioner).

Part 5 of the Bill provides for the intelligence and security agencies to access information held by other agencies. Schedule 2 includes a list of data bases which the agencies are potentially able to access directly, following consultation and agreement between Ministers. For ad hoc information requests clause 101(3) clarifies that restrictions to disclosure from other Acts still apply (e.g. application of the Privacy Act 1993). Clause 112 provides the intelligence and security agencies with access to restricted personal information. But, the access is conditional on permission being granted by the Attorney-General and (if a New Zealander is involved) a Commissioner of Intelligence Warrants.

Under clauses 263 and 264 of the Bill further Privacy Act 1993 information privacy principles are applied to the GCSB and NZSIS.  It is possible to apply a broader range of principles to the agencies without undermining their ability to protect New Zealand and its interests through inclusion of bespoke exemptions to certain principles to enable performance of their statutory functions. The ‘information sharing arrangements’ section of the addendum of the RIS covers proposed changes to the Privacy Act.

Clause 220 amends the Immigration Act 2009 to require carriers and persons in charge of commercial craft to collect personal information about travellers leaving New Zealand and supply that information to the Chief Executive of the Ministry of Business Innovation and Employment. The information (passport information collected through Advance Passenger Processing and details, such as when and where the travel was booked and how paid for, collected as part of Passenger Name Records) is already collected on people intending to travel to New Zealand. The provisions allow the Chief Executive to share outbound Advance Passenger Processing information (including by way of direct access) with specified agencies for the purposes of law enforcement, counter-terrorism and security (clause 226).There must be an agreement with the specified agency concerned, after consultation with the Privacy Commissioner, before information is shared. Agreements must detail limitations on disclosure of information by the specified agency and the Privacy Commissioner can require reviews and reports. New section 303B specifies the safeguards that must be covered by an agreement which allows direct access (for example, the position of the person in the specified agency who may access the database and data storage and disposal requirements). 

3.5.1. Was the Privacy Commissioner consulted about these provisions?

YES

The Privacy Commissioner, John Edwards, met with the authors of the independent review. Also, as part of seeking Cabinet policy decisions, the Commissioner was consulted by Department of the Prime Minister and Cabinet officials on the relevant policy matters, particularly information sharing proposals (Part 5 of the Bill) and the application of the information privacy principles (Clauses 263 and 264).

Staff of the Office of the Privacy Commissioner were consulted on the broad policy underlining the Immigration Act 2009 amendments relating to information on travellers leaving New Zealand (Advance Passenger Processing information and Passenger Name Record information) and provided with a general outline of the approach likely to be adopted for the sharing of outbound Advance Passenger Processing information with specified agencies.

3.6. Has there been any external consultation on the policy to be given effect by this Bill, or on a draft of this Bill?

YES

Consultation on the Government’s policy only occurred within Government. However, the independent review referenced above called for, and considered, public submissions.

3.7. Have the policy details to be given effect by this Bill been otherwise tested or assessed in any way to ensure the Bill’s provisions are workable and complete? 

YES

The operational agencies were consulted during the development of the policy and the legislation to ensure that the changes can be successfully operationalised.

4.1. Does this Bill contain any provisions that could result in the compulsory acquisition of private property?

NO

The provisions in the Bill that provide for seizure of private property under an intelligence warrant (for example, an activity under clause 63(d)) does not change or transfer the owner’s rights over that property.  

4.2. Does this Bill create or amend a power to impose a fee, levy or charge in the nature of a tax?

NO

4.3. Does this Bill affect rights, freedoms, or impose obligations, retrospectively?

NO

4.4. Does this Bill:

(a)   create or amend a strict or absolute liability offence?

YES

(b)   reverse or modify the usual burden of proof for an offence or a civil pecuniary penalty proceeding?

NO

Clause 227 amends section 349(1)(b) of the Immigration Act 2009 which currently provides for a strict liability offence for circumstances where the carrier has allowed a person to board a craft for the purpose of travelling to New Zealand without receiving a decision from the Chief Executive as to whether or not that person is allowed to board the craft. The amendment will extend this provision to cover situations where the carrier has allowed a person to board a craft for the purpose of travelling from New Zealand before the Chief Executive has made a decision under new section 97A(1).

The amendment of this offence extends its application, and is limited to situations where the person to whom the directive relates is attempting to travel on a passport or certificate of identity that is lost, stolen, invalid, forged, false, fraudulently obtained, or improperly altered, or the passport does not relate to the person who is attempting to travel on it. The offence contributes to the important goal of reducing the use of false travel documents for travel by making sure that a carrier does not allow a person to board a craft before the Chief Executive has confirmed that person may board a craft.

The offence is committed by the carrier or person in charge of a commercial craft in a commercial or regulatory environment which involves a high number of individual transactions. Further, it  is only committed if the Chief Executive has previously notified the carrier that they must obtain Advance Passenger Processing information from a traveller and provide it to the Chief Executive before the craft departs. Persons involved in the airline industry are already familiar with such obligations and the consequences of non-compliance in respect of inbound travellers. They can, therefore, be expected to have in place suitable procedures and safeguards to ensure compliance. The penalties have not been increased from the current level and contraventions of the new obligation will be punishable by an infringement penalty of $1000 for an owner, charterer or agent, or $500 for a person in charge of the craft. In serious cases of non-compliance a carrier may be prosecuted and face a maximum penalty of 3 months imprisonment or a fine of $50,000 (3 months imprisonment and $25,000 for a person in charge of a craft).

4.5. Does this Bill create or amend a civil or criminal immunity for any person?

YES

The Bill creates a number of immunities and/or exceptions. Some are carried over from existing legislation covering the intelligence and security agencies, while others are new.  See Appendix two for details of the immunities, exceptions and the limitations.

4.6. Does this Bill create or amend a decision-making power to make a determination about a person’s rights, obligations, or interests protected or recognised by law, and that could have a significant impact on those rights, obligations, or interests?

YES

The Bill creates or amends a number of decision-making powers including, amongst other matters, the authorisation of intelligence warrants.  See Appendix two for details.

4.7. Does this Bill create or amend a power to make delegated legislation that could amend an Act, define the meaning of a term in an Act, or grant an exemption from an Act or delegated legislation?

YES

Under clause 109 the Governor-General may by Order in Council, and on the recommendation of the relevant Minister, amend Schedule 2 which lists databases to which direct access by the intelligence and security agencies may be provided. This allows for such matters as databases being reconfigured or the holder agency changing.

The listing of the database in Schedule 2 does not, in itself, provide for direct access. The Order in Council process only changes the list of databases for which direct access may be available.

Prior to any direct database access under the Bill (Part 5 subpart 2) there must also be an agreement between the relevant Ministers, as described above in question 4.6 (Appendix two). Before recommending an amendment to Schedule 2, the Minister must consult the Intelligence and Security Committee.

Clause 229 amends section 402(a) of the Immigration Act 2009 to extend the scope of the regulations that prescribe the information to be obtained on travellers leaving New Zealand. This is a consequential change of including new sections in the Immigration Act.  The current regulations are the Immigration (Carriers’ Information Obligations) Regulations 2010.

4.8. Does this Bill create or amend any other powers to make delegated legislation?

NO

The Bill creates ministerial policy statements but they are not legislative or disallowable instruments for the purposes of the Legislation Act 2012. As paragraphs 116 - 118 of the RIS explain they are a mechanism to enable the responsible Minister to direct the appropriate conduct of the lawful activities of the intelligence and security agencies.

4.9. Does this Bill contain any provisions (other than those noted above) that are unusual or call for special comment?

YES

Clause 17 gives the intelligence and security agencies the additional function of providing assistance to another entity. The agencies require a specific legislative provision if they are to use their knowledge and capabilities to help organisations such as Maritime New Zealand or the Royal New Zealand Coastguard and assist with search and rescue operations. The assumption is that the searchers would benefit from information obtained from intercepting communications. The function may only be performed where there is an imminent threat to a person’s life and safety and the agency could not obtain a warrant for the action in question.  

Clause 26 provides for the Director-General of an intelligence and security agency to authorise the acquiring, use and maintenance of an assumed identity. Safeguards include the requirement for a ministerial policy statement or statements to be issued addressing such matters as the circumstances in which such authorisations are appropriate. Limitations on the immunities associated with use of an assumed identity are covered in response to question 4.5 (see Appendix two). 

Clause 63(1)(g) explicitly identifies the use of human intelligence as an activity that may be authorised by an intelligence warrant for the first time in legislation. It is appropriate to transparently identify the use of employees or human sources as a means to collect intelligence. The usual safeguards inherent in the intelligence warranting process will apply.