When National passed the Key-Kitteridge spy bill back in 2013, they promised safeguards. One in particular was that the GCSB would be statutorily obligated to formulate a privacy policy, against which its activities could then be audited. The law required them to do this "as soon as is reasonably practicable".
That requirement has been law been law for nearly three years. And yet today the GCSb has revealed (in a response to a request made through FYI, the public OIA request site) that
Unfortunately, due to other priorities, the policy has not been finalised and is still being drafted.
"Other priorities". That's right - the GCSB has "other priorities" than obeying the law.
This simply isn't good enough. The 2013 GCSB bill was predicated on a broad bargain with the New Zealand public: greater powers in exchange for increased oversight. But it seems that GCSB is reneging on their end of that bargain (and explicitly violating the law to do it). While there's obvious wiggle room, I don't think any reasonable person would consider thirty months to be "as soon as is reasonably practicable".
As for what we can do about it, we can't complain to the Inspector-General or the Privacy Commissioner, because they're both part of this policy formulation process and thus not neutral arbitrators. And Parliament's Intelligence and Security Committee is worse than useless, as it meets in secret and is institutionalised against exercising proper oversight. There seems to be no institutional mechanism to actually enforce this provision at all. Which means any solution has to be political: if GCSB won't act within the limits we set for it, then we must insist that it be disbanded.
