Privacy, IT, and Waikato

Waikato District Health Board's computers have been down for over a week due to a cyberattack that also seems to have led to private patient and/or staff details being taken from the system by the attackers.

Radio New Zealand reported yesterday on a Health IT Stocktake warning of significant IT risks last year.

The Privacy Act's new provisions allowing the Privacy Commissioner to issue Compliance Orders came into effect 1 December last year. Rule 5 of the Health Information Privacy Code 2020 also requires that private health information be held securely.

So I was curious whether the Privacy Commissioner had had any chats with the Ministry, DHBs, and Minister about these compliance issues last year, and whether any Compliance Orders had been contemplated before the hackers took down the Waikato hospital system's general ability to function. 

On a quick look online, I could find a morning interview with the Privacy Commissioner about the hack, but I could see nothing about it on the Privacy Commission's website, on its official Twitter feed, or on the Commissioner's Twitter feed.

So I sent through the following OIA request at 1pm.

I am curious what measures, if any, the Privacy Commissioner has taken to ensure the security of individuals’ health data held by the public health system.

Last year’s IT Stocktake for the Ministry of Health, as reported by Radio New Zealand, demonstrated substantial risks. Failure to address those risks plausibly led to this month’s substantial data breach at Waikato DHB. 

Radio New Zealand’s report on the stocktake is here. 

The updated Act provides opportunity for the Privacy Commissioner to issue Compliance Orders in cases where substantial privacy risks warrant it. The Stocktake report predated the ability to issue Compliance Orders, but orders presumably could have been issued on the Act’s coming into force if they were warranted, if the Ministry and DHBs had not been demonstrably moving to solve the identified problems.

In terms of the Official Information Act, I would like to know whether the Privacy Commissioner had been aware of last year’s IT Stocktake at the Ministry of Health demonstrating substantial risks. 

Please also provide:

1. Any internal correspondence, briefing notes, minutes of meetings, or recollections of relevant officials about the results of the Ministry of Health’s IT Stocktake and what action, if any, the Privacy Commissioner should take. I am particularly interested in knowing why a compliance order was not issued, if no compliance order was issued.
2. Any correspondence from the Privacy Commissioner to the Ministry of Health, and any correspondence from the Privacy Commissioner to the District Health Boards, about their obligations under the Privacy Act, their obligations under Rule 5 of the Health Information Privacy Code, and about the IT Stocktake;
3. Any correspondence from the Privacy Commissioner to the Minister of Health about the Ministry of Health and DHB’s obligations under the Privacy Act, and about the IT Stocktake;
4. Any correspondence with the Minister of Health about IT security in general, and about the Waikato DHB breach in particular. Please include all memos, briefing notes, aide memoires, and summaries of any meetings;
5. A listing of any measures taken by the Privacy Commissioner to ensure DHB and MoH compliance with Rule 5 of the Health Information Privacy Code 2020, along with any evidence held by the Privacy Commissioner establishing DHB and MoH compliance with Rule 5 of the Health Information Privacy Code
6. A listing of Compliance Orders issued thus far, along with any details on the recipient of each Order and what the Commissioner has Ordered. If identifying details of the recipients need to be suppressed, please provide detail on the sector and industry of the recipient of the Order, and whether the recipient is private or public sector.

I hadn't seen anything about the Waikato leak on the Privacy Commissioner's website when I'd sent in the request.  

At 4.25 pm the Privacy Commissioner tweeted a link to a press release dated 9am, noting that the Commissioner could yet issue Compliance Orders. 

I hadn't seen it on the Commissioner's website at 1pm; I must have missed it, or perhaps their CMS takes a while to refresh. 

Will post what information I receive. 

Keeping the lights on

The Gas Industry Company is looking into gas supply. 

BusinessDesk reports risk:

In the worst-case scenario, New Zealand will not have gas available to ensure electricity security of supply by 2026, the sector regulator has warned.

The Gas Industry Company said if there was more investment in existing fields to eke out reserves, then the system should be able to get through to 2035.

...The paper did not refer to the government’s decision to ban new gas and oil exploration permits but said regulatory uncertainty was a key hindrance to the investment needed to get more gas out of the current fields.

“There was universal acknowledgement that the current supply situation meant that some users did not have sufficient certainty about gas supply for their operations, and that tight market situations may well occur into the future given the transition,” GIC said.

The consultation document notes problems around regime uncertainty. 

The problem isn't net zero by 2050, the problem rather is that the government isn't relying on the ETS. Investors can plan on the ETS. They can see the path of allowed emissions (gas is in the covered sector), make some punts about prices, hedge if they want, and make decisions. 

But when random draw BS like bans on new gas connections get touted by the Climate Commission and gawd only knows what foolishness Rod Carr will suggest next time, investment gets riskier. 

And especially where the government already banned new exploration. 

The consultation document puts it a bit more politely, in its suggestions from stakeholders for feedback:

• enabling and encouraging wider use of the Emissions Trading Scheme (ETS) tools, including the use of the ETS as the main mechanism to encourage increasingly lower emissions activities. This would provide clarity about how abatement of emissions will be treated (e.g. if CO2 is used, or captured and stored), provide economic predictability to investment decision makers, and credits would incentivise gas users to transition away from the lowest value use of carbon first
• providing clarity about the boundaries of the ETS to enable industry decision makers to better assess the viability of existing assets or proposed investments. This could include clarifying where policy outcomes are not expected to be achieved by the ETS and how alternative policy will be assessed

Hypothecation and the carbon dividend

This week's Newsroom column, now ungated, goes through the happy surprise in last week's budget: ETS revenues will be hypothecated. Well, it could be a happy surprise. It could all yet turn to custard. 

Treasury hates hypothecation: the ring-fencing of particular tax revenues to particular purposes. And they are almost always entirely correct in that. In New Zealand, petrol excise is hypothecated to the Land Transport Fund as an ersatz road user charge; now that technology has progressed, petrol excise should be abolished and petrol (and electric) vehicles flipped to the road user charging system that's been in place for diesels. 

That's a reasonable use of hypothecation: when it's the only feasible way of getting something like a user charge.

Otherwise, we descend into tin-pot accounting systems that make a mess of everything. 

They make a mess of the allocation of public funds, because at least in principle you'd want that the marginal value of a dollar spent by government goes wherever it can do the most good, regardless of where it came from. 

They also make a mess of politics. A tax on hipster's beard oil, all on its own, just sounds stupid. A government programme to help save the endangered saddleback might or might not make sense - who knows whether there are other conservation programmes that make more sense, or whether conservation programmes are the next best use of government funding in the first place. But if you tie a targeted tax on hipster's beard oil to a programme helping cute birds, well, that leads us to dangerous kinds of things that show up on US referendum initiatives. You look like a jerk for opposing them, even if they're really stupid. Like - a tax on ice cream to help orphans with cancer. Who could oppose that? They're orphans. With cancer. But it absolutely ruins the tax system. If you want to give money to orphans with cancer, do it out of general tax revenues and at least try to minimise the deadweight costs of generating whatever amount of funds the government wants to take from people. 

So it absolutely makes sense that Treasury hates hypothecation.

But it's a problem in this case.

The ETS faces a political problem, not an economic one. 

In a first best, we wouldn't be having this discussion at all. ETS revenues have a negative burden. It's a tax that abolishes a distortion rather than creating one. We like taxes like that. They're good. So in a first best the government would take ETS money, cut other taxes by a little bit (reflecting that we don't need the revenues from a more distortionary source quite as much), and increase other spending by a little bit (reflecting that the optimal provision of government services goes up by a bit when the marginal cost of funding goes down by a bit. So government would have a small bit more money, and would just put it to its next best use.

But we're not in that first best. We have a political problem. The government is behaving in ways consistent with a terror of ETS prices rising. It's resorting to all kinds of just absolutely crazy, costly, and ineffective measures to reduce gross carbon output. None of it makes any darned sense, because of how it interacts with the ETS. If you subsidize early EV uptake, you just free up credits for someone else to use. And same with banning oil and gas exploration, or banning coal-fired process heat, or anything else affecting the covered sector.

You then have a few options. 

Maybe Ministry for the Environment officials are very very thick in matters core to their core area of responsibility. Just simply grossly incompetent. 

Maybe MfE officials don't care about truth and just want to parrot what sounds nice to thick people in Cabinet. 

Maybe neither MfE nor Cabinet are thick, but voters don't get the ETS and don't trust it because they don't understand emergent outcomes and prices. 

Or, maybe, despite what seems like very strong voter support for Net Zero, voters would actually flip their lids if ETS prices went from $38ish to $75ish and blow up the system - and high ETS prices make it harder to figure out how to get agriculture into the system. And officials figure no Minister could stand the pressure of a few news specials showing poorer households having and even harder time paying for stuff. 

The real problem can't just be either of the first two. Those on their own can't do it. If it were just thick officials, Cabinet would have incentive to lean on them to get it right. And if voters understood it, they wouldn't be supporting these kinds of costly and ineffective policy measures. Ultimately voters are the constraint - and I expect it's a mix on fundamentally not appreciating how prices work through the ETS, the effects of the binding cap, and an unwillingness to actually bear higher daily real costs rather than symbolic stuff and the occasional visibly costly hair shirt demonstrating commitment. 

But if that's the real problem, then all the other problems can be floating around in there too because nothing fixes it. 

All of that makes for a political problem in maintaining the ETS as carbon prices rise. Eventually, somebody wins election by breaking the thing and reducing carbon prices. That builds fragility. And risk of it distorts investment decisions - if you think that the ETS buckles before prices hit $60, you don't make investments that only pay off it ETS prices get north of $60 and stay there. 

And that takes us out of the first best. We need the ETS so that we're hitting the net zero targets in ways that don't cost hundreds or thousands of dollars per tonne abated when there are still options on the table costing only $40 per tonne. Orders of magnitude differences in abatement costs make for first-order problems to solve. 

So what to do? Hypothecate the revenues, create a carbon dividend. Start of the year, forecast the government's ETS revenues. Send every household in the country a cheque for their share. Give the first adult in a household a 100% share, the second adult a slightly smaller share, and a slightly smaller share again for each kid. Carbon costs rise in household size but at a decreasing rate. Heating a house for two people doesn't cost twice as much as heating it for one people. If the government expects excess dividends from the power generators because Huntley's burning expensive coal and that's the marginal unit driving prices, throw the government's 51% share of those excess dividends into the pool. 

The transfer would be progressive; richer people spend more money on everything, and carbon is in everything. But if it still isn't progressive enough to make the ETS stick, boost the dividend payments for households with Community Services Cards. You can make the thing as progressive as you want that way, but there could be risk that payments to middle-income households start looking thin relative to what they're paying in carbon charges if you do too much of that. 

Run the carbon dividend correctly and even if voters don't understand anything about how the ETS works, or how prices work, they will understand getting a big cheque at the start of the year, and that the cheque is bigger when ETS prices are higher. 

"Here's your carbon dividend. Use it to start reducing your carbon footprint. The less you emit, the less you'll have to pay into the ETS. But you'll still get your dividend from those who don't reduce their footprint. Put it towards a heat pump. Save it for a deposit on an EV. Put in some insulation. Whatever makes most sense for you and your household. We, as government, simply can't know your circumstances. You do. We're paying you in advance because we know the costs you'll be facing are going up. Petrol prices could go up. Power prices too. Take the money, use it wisely. We trust you."

Being able to say that at the start of the year, and being able to point to it whenever some reporter gives the lazy "Oh, Minister, what do you have to say to poorer households facing rising power prices?" question, gets rid of political fragility in the system. 

Anyway. Carbon dividends make sense. And the sticking point had been Treasury just being stubborn about hypothecation. But the Budget hypothecated the revenues without saying what'll be done with them. I hope it's a carbon dividend. 

But Treasury could yet wind up being right - there's risk that the Minister will want those revenues as a "at his discretion" slush fund for piles of dumb stuff. It's easy to imagine the government preferring to use the money to fund Joe's heat pump, or Jane's home insulation, with application processes ensuring the recipients are worthy and ensuring that they credit the government for having given them a heat pump rather than crediting the ETS for it. None of it would reduce emissions, and none of it would work better in addressing equity and political economy concerns than running the carbon dividend, but I can see how it could be politically tempting. 

If the government is serious about getting to net zero, it needs a way of entrenching support for the ETS. Watch what they do with the ETS revenues. It will tell you whether they're serious about it. 

Congestion charging and getting Wellington moving

Parliament is considering submissions on allowing congestion charging in Auckland. I think it's a great idea. And it could help more broadly. 

Our submission is here. We suggest that the government should just go ahead with the system recommended in the Report on it, but that we have a few potential improvements for the longer term.

First up, the only purpose of congestion charges should be alleviating congestion. Set the charges to maximise traffic throughput and nothing else. But if the money winds up in the transport budget or elsewhere, there will always be temptation to mess around with the charges to achieve other ends. 

At the same time, the system as proposed has discounts for low-income drivers on Community Services Cards. Equity issues are real but you don't muck around with prices to solve an ability-to-pay money. Instead, you should just give people money. 

Put the two together and you can solve both problems at once. Take the money collected under a congestion charge and rebate it back to drivers in a way that's invariant to whether they're driving on- or off-peak. Lots of ways of doing it. The only critical feature is that the transfers are lump-sum with respect to on-peak driving. It's likely to wind up being a progressive transfer but if doesn't wind up being progressive, provide higher payments to users who have Community Services Cards. Simple. You've solved the equity issue by giving lower-income people money while not messing up incentives provided by congestion charging. 

As tech progresses and the costs of electronic road user charging systems come down, things start getting more interesting for the longer term. First, recall that diesel vehicles don't pay excise into the Land Transport Fund - they pay road user charges based on mileage. Flip petrol vehicles onto that system too, abolishing petrol excise (which would also solve the problem of that lots of non-road petrol uses get taxed for road use - marine fuel in particular). Get everyone onto the kinds of electronic RUC systems that the trucking companies use. The better ones are GPS enabled. The costs of those will keep coming down.

Once you have that, you can start varying road user charges across different roads if some roads are more expensive to maintain - or if the charges are part of a road tolling system for roads financed that way. 

A better future system could then:

• Use congestion charging to maximise throughput on existing roads, rebating charges back to road users through the same accounts they use to pay their congestion charges anyway;
• Use the information provided by congestion charges to inform whether new transport investments make sense. If it takes a $20 charge to clear congestion on the Auckland Harbour Bridge or the Mt Vic Tunnel, that's a pretty good case for building more capacity. If it only takes a $0.20 charge, it would be stupid to build a new tunnel or a second harbour crossing.
• The data from the congestion charge combined with GPS-enabled RUC systems would then allow for simple tolling of new roads. So if road users have demonstrated a willingness to pay $20/pop to get across the bridge at peak times (say), someone putting in a new crossing could bank on there being real willingness to pay. They could then put up a bond backed by the revenues generated by crossing. Which is how the Harbour Bridge got financed in the first place - a bond paid off by tolls. I'm not proposing anything new here or anything new to NZ. It's a big part of NZ's abandoned history of How To Get Things Built. The data from congestion charging would help in demonstrating whether the investment would be worthwhile, and the electronic charging system would make it easier to collect the tolls. That's it. But it's an important 'it'. Right now, it's neverending fights between the "let's put roads everywhere" people and the "oh roads are stupid never build them it'll just cause more induced demand and their cost-benefit cases never stack up" people. Congestion charging would help demonstrate whether new investments are worthwhile, and shoot down ones that aren't. 

There are obvious implications for Let's Get Wellington Moving - which Treasury listed as a risk in the last budget. Congestion charging would ease demand back, fixing a lot of the problem. And it would provide the information necessary for better decisions about things like second Mt Vic tunnels.

Clarke's law, migration edition

One play on Clarke's third law holds that any sufficiently advanced incompetence is indistinguishable from malice. 

I don't know whether it's malice toward migrants driving things in the current government, or a sufficiently advanced incompetence, or a combination of the two. It's overdetermined. 

But it's pretty bad. 

Anuja Nadkarni reports that Immigration NZ is sitting on $5m in fees it's collected from potential skilled migrants, with zero intention of processing anything. 

The expression of interest processing pool has been put on hold because of Covid and the freeze was extended for another six months in October last year.

Before Covid, expressions would be processed every two weeks and could be in the pool for a maximum of six months.

Immigration NZ's border and visa operations general manager Nicola Hogg said that although the suspension was currently being reviewed, there was no timeframe for a decision.

...

To be successful in their expression under the skilled migrant category, migrants must have a job that qualify for at least 160 points under the immigration's system (determined by an immigration advisor). The expression of interest fee is $530.

If successful, migrants can apply for permanent residency after completing medical checks.

Currently there are about 13,000 people waiting in queue for their residency applications to be processed by Immigration NZ.

Immigration Minister Kris Faafoi said this was because of increased demand, but the government department said it was waiting for guidance from the minister to make a decision on a new approval quota.

A company behaving similarly would likely be up on fraud charges. But it's MBIE that runs consumer protection, and MBIE that runs Immigration, and even if it were unlikely for MBIE to prosecute MBIE anyway, there's likely a statutory exemption somewhere protecting government agencies from being hit. 

The go-slow at Immigration also winds up hitting the kids of skilled migrants who wind up in a special hell-limbo, where remaining dependent on their parents maintains some hope of getting a visa, but also means they can't really study because internationals student fees are rather high. 

Under immigration rules, applicants younger than 24 years who are single, don’t have any children of their own and rely on an adult for financial support can be considered “dependent children”.

The rules also don't permit Kayleigh and Chevaunne to work in New Zealand or study without paying international fees. Advice received from immigration advisors, and immigration call centres is to not volunteer or intern either. 

“I can’t apply for residency as an individual because I don’t have any work experience or money,” Kayleigh Roffe says. "My application wouldn’t be successful even if I tried."

The family's spent at least $34,000 on their residency applications.

A positive residence decision would mean the kids could at least study. But Immigration New Zealand isn't processing applications. They're just taking fees. Like run-of-the-mill scam artists. And an 18 year old who's here with their skilled-migrant parent isn't likely to be able to get a work visa on their own. 

At the same time, the border has separated a lot of families. If the border closed after a skilled migrant got here, but before the migrant's spouse and children could get here too, there seems no hope unless the migrant earns a fair bit. There's room in the MIQ system. But you need a special visa to be allowed a slot in MIQ, and they aren't being granted for the families of skilled migrants who are already in New Zealand. There was room for nutritionists for the America's Cup challenger teams, but no room for the spouse and kids of a math teacher. 

The Spinoff notes some of the consequences.

Johan Steyn’s story is by now a familiar one. Having just barely squeaked through the closing doors of the border, he went straight into lockdown with no income for more than a month. After initially being given what he calls “false hope” from Immigration New Zealand (INZ) they’d let families through case by case, he says, what followed was a year of stonewalling.

He and Sumari spent untold hours on hold with immigration, only sometimes getting through. By November, they’d sold all their South African assets, including their home and two businesses. Through racked with anxiety over his family’s safety — besides a rampaging virus, he says, they had to stay in a bed and breakfast near a dangerous area — they were repeatedly rejected for border exemption, told that “humanitarian grounds” meant only matters of life and death.

By the end of 2020, after running two households on a single income for months, they were feeling the financial sting. In New Zealand, Johan was refused a credit card because he was only a visa holder. In South Africa, with no more assets to her name, Sumari couldn’t take out a loan.

He says they’ve spent the majority of their life savings now. And his daughters are struggling. His eldest has seen her grades suffer, while his youngest was told by her classmates her dad would find another wife while he was gone. All the while, hopes raised by the government’s serial assurances that things would happen soon have been repeatedly dashed.

“If you want to torture somebody for a year and a half, you do to them what they did to us,” Johan says.

I'd hit on some of this in last week's Dom Post column:

Potential skilled migrants deserve a few warnings about what they are getting into in moving to New Zealand – the kinds of disclosures that are often mandatory in the private sector to ensure consumers can make informed decisions

The Fair Trading Act’s provisions against deceptive and misleading conduct do not seem to apply to Immigration New Zealand. Caveat emptor.

It isn’t just immigration of course. One of government’s best tricks is exempting itself from the regulatory regimes it applies to the private sector.

But if a private firm with a government-enforced monopoly invited potential clients to submit applications, with hefty application fees, with little intention of ever processing those applications in any timely fashion, there would be consequences.

Engaging in deceptive or misleading conduct, and making false representations, is forbidden by the Fair Trading Act.

But Immigration New Zealand can take skilled migrants’ application fees with little intention of processing visa applications, and the consumer protection side of MBIE never seems to notice.

The world is a big place providing a lot of options for skilled migrants. And a lot of countries seek to attract skilled migrants.

Where New Zealand bans new migrants from purchasing a home until they have achieved residence, Portugal grants residence visas to new migrants who purchase a home in Portugal.

In 2020, Italy enacted a special tax regime for inbound workers. New migrants benefit from generous tax exemptions: up to 90 per cent of migrants’ income is exempt from taxation for up to ten years.

These kinds of tax exemptions are a terrible idea. They make a mess of the tax system and badly distort labour markets.

But they reflect a fundamentally different attitude towards migrants than that evidenced more recently in New Zealand.

... If you come here, you should expect there to really be no way to leave and return, or for family to visit you, for perhaps another year.

Even for people who are vaccinated, and even if they are from places from the UK where high vaccination rates have suppressed the virus.

Hopefully, Minister Faafoi’s announcement will signal a substantial change in attitude and in policy.

But caveat emptor applies. Migrant beware.

Minister Faafoi did not show up for the very heavily publicised immigration speech. His Deputy, Stuart Nash, announced nothing; he just summarised current government policy. Why piles of execs were invited down from Auckland for what was advertised as being a big announcement is anybody's guess. There was no announcement, nor even a hint of one. The Minister's being ill would have been a fine pretext for postponing if they'd found some hole in whatever policy was supposed to have been announced. 

Sufficiently advanced incompetence? Malice? Both? 

Whatever the reason, whatever the government winds up announcing around skilled migration, caveat-the-hell-emptor. 

I have been the biggest advocate that all of my friends should move to New Zealand. I spent the last year wishing that more of them had listened to me. 

I could not recommend that anyone I like or care about do that now. Dealing with Immigration New Zealand under the current government will not be worth it. It'll take something pretty big to fix things. 

Do less, well.

Budget day's today; I'll be in the lock-up after 10. 

The best pre-budget take I've seen thus far is from Harman at Politik, or at least I hope he's right.

The Government has run out of bureaucratic capacity to undertake any more substantial reforms. 

Finance Minister Grant Robertson conceded this yesterday and suggested it would influence the Budget on Thursday. 

In other words, the Budget is unlikely to contain any new broad initiatives.

The public sector has had a lot of crazy stuff thrown at it over the past few years, and not just because of Covid. Things like massive tax shifts on investment properties that weren't well-canvassed with the bureaus before being launched. A complete restructuring of the health system in the middle of a pandemic. An immigration system that's falling apart. Series of absolutely absurd spending initiatives in minor climate change things that will do not a lick of good because they're covered by the ETS's binding cap, but will require bureaucratic time and effort to sort out. 

And more:

But what is likely to be missing on Thursday will be a big new initiative in any policy area. 

And that is because the “big” departments are already flat out on a number of major reforms — the Resource Management Act replacements; the Freshwater reforms; the response to the Climate Change  Commission; the Health reforms; the Immigration review; three waters reforms; the local government review and the future of work as well as big changes in education.  

“Along with the focus on our three core areas of housing affordability, climate change and child wellbeing, we have a complete overhaul of the health system, a complete overhaul of our planning laws and a complete overhaul of the way we manage water,” said Robertson.

The government is not only doing too much, it is doing too much of that too much too badly. 

Old Laws

Tyrone Barugh is having a bit of fun with an old regulation still on Wellington Council's books. A century ago, Wellington required that suppliers of milk have a council licence. The Wellington Milk Supply Act was never repealed. 

And Barugh wants to be the only permitted supplier, though he's a lawyer and presumably doesn't have any cows.

Now Barugh is taking his case before the High Court.

The act was a forerunner to more modern health and safety legislation brought in to control the conditions where milk was supplied to the public.

Later the milk supply moved from small local suppliers to big dairy companies.

Barugh said the council initially said the law was deprecated – a fancy legal term for the law no longer being valid.

However, Barugh said he did not think it could be and asked the council to consider his application in good faith, but it was declined.

So Barugh is taking the case further. .

“I can see why some people may consider this capricious, but it's a reminder that we have laws on the books that are not fit for purpose.”

Good fun, and making a point. A lot of rules ought to come with sunset clauses, so if Council or Parliament don't bother re-upping them, they could just go away.