Privacy Bill

Thank you, Madam Deputy Speaker. I start where I finished. We have learnt from the police that cybercrime investigations at the moment may be a specialised area but in the foreseeable future they will become a generalised area, because technology is a part of everyday life. Advances in technology, such as the social media platform, e-commerce, digital economy, and new ways of collecting, saving, storing, and distributing personal information bring with them a variety of issues and challenges concerning privacy. The proposed changes under this bill act on the recommendations of the Law Commission in 2011. The bill would grant significant powers to the Privacy Commissioner and strengthen the existing privacy regime by repealing and replacing the Privacy Act 1993.

The key changes in the Privacy Bill include mandatory reporting of privacy breaches, compliance notices—that is, the Privacy Commissioner will be able to issue compliance notices that require an agency to do something or stop doing something.

What is personal information, by the way? Personal information, according to the Privacy Commissioner, is any information about an individual, namely a living natural person, as long as that natural person can be identified.

Let me step outside this bill for a little while and talk about the issues covered in another bill. Last Tuesday, this House unanimously passed the Criminal Records (Expungement of Convictions for Historical Homosexual Offences) Bill. There are two types of criminal records or checks: Case Management System (CMS) and Criminal and Traffic Convictions History records (CaTCH). In the case of CMS, it is where all data in relation to offences, including convictions that were subsequently quashed, will be stored. This is a data centre, a unified go-to place for all information in relation to court or criminal cases. For CaTCH, anyone who is eligible to have their criminal records expunged and successfully expunged will be able to have their criminal records wiped from the CaTCH system. In terms of both CMS and CaTCH, there will need to be a robust check and balance system to ensure that privacy concerning individuals will be protected and we do have such a robust system—for instance, regular checks or auditing.

The expungement legislation provides statutory requirements for the privacy concerning individuals to be protected. In a similar vein, the Privacy Bill creates a new criminal offence. It will be an offence to mislead an agency in a way that affects someone else’s information and to knowingly destroy documents containing personal information where a request has been made for it. Other measures under this bill include strengthening cross-border data-flowing protections. New Zealand agencies will be required to take reasonable steps to ensure that personal information disclosed overseas will be subject to acceptable privacy standards.

The bill also clarifies the application of New Zealand’s law when a New Zealand agency engages an overseas service provider. This is important. New Zealand is an export-orientated country and New Zealand is an active member of the international community in terms of international agreements and contracts. To maintain acceptable privacy standards will be very important—for instance, concerning international contracts, etc.

The Privacy Bill retains the existing Act’s 12 information privacy principles, or the so-called IPPs. At the core of the Privacy Act are those 12 information privacy principles that set out how agencies may collect, store, distribute, and disclose personal information. Of course, many rules have exceptions, as we are reminded by the Privacy Commissioner. We will need to read together with those exceptions to see how they relate to any particular circumstances.

The Privacy Bill repeals and replaces the Privacy Act 1993, as recommended by the Law Commission in its 2011 review of the primary Act. The Act has been in operation for 25 years. Over that time, the rise of the internet, digital economy, and e-commerce have transformed business and government. New technologies, such as the social media platform, e-commerce, and cloud storage have changed the way personal information may be collected, saved, stored, or distributed. This has created many benefits but together with the benefits has also created new challenges, and this bill seeks to address those issues.

This bill will better align New Zealand’s privacy law with international developments, including OECD and European Union guidelines.

While we’re debating this bill, Facebook’s CEO has just faced the United States Senate judicial and commerce committees, where legislators there are introducing similar changes aiming at protecting people from incidents like the Cambridge Analytica scandal. General consensus is that consumers deserve the opportunity to opt in to services that might mine and sell their data, not to find out their personal information has been exploited years later. We’re dealing with a reality. It is not only about Facebook. Other social media platforms such as Instagram, LinkedIn, or Twitter are a part of everyday life.

Everyone is dealing with some form of data, one way or the other. This is the era of big data. Voluntary standards are not enough. Legislative changes are necessary, and this is exactly what this bill seeks to achieve. I look forward to submissions. The already busy Justice Committee is fully gearing up for a new mission and new challenges. Thank you, Mr Speaker.

Thank you, Mr Assistant Speaker. It’s my great pleasure to take a call on this, the Privacy Bill. The key purpose of reforming the Act is to promote people’s confidence that their personal information is secure and will be treated properly. It’s very relevant, obviously, and today with—like the chairman of the Justice Committee, Raymond Huo, was saying—the free flow of information, and all the social media platforms. I’m well known to not really use the social media platforms necessarily like they should be.

Denise Lee : Yeah, should be.

That’s right. But the fact of the matter is that there’s always a huge risk that our personal information can get out and become available to people that we may not necessarily want to see or have that information.

I think the Facebook example is very good and relevant, because Mr Zuckerberg, who recently in the last 48 hours appeared in front of a United States Senate committee, stated that he had had to employ an extra 20,000 people to make sure that they were actually monitoring the content and the privacy provisions on Facebook. He had to acknowledge that although they had a very big disclaimer and legal statement when you sign up to Facebook, not many people actually read it, it’s all in legalese, and they probably wouldn’t understand exactly what it means anyway. So it highlights that there’s got to be a big focus on privacy and how we deal with it.

I know that during my time as Minister of Statistics, it was interesting because we gathered a lot of information, and as part of our social investment programme, it was important to be able to use data and to be able to analyse data. For Government agencies to do that effectively, they also have to be able to collect information from NGOs or partners outside of Government that they’re working with. But to do that, you have to have a high level of credibility and be able to prove that some of that information, which is going to be sensitive, you’re going to be able to anonymise it, so that you can actually remove any information that will identify the individual themselves, whereas still being able to keep the data that actually shows trends and allows Governments to make good decisions. This is an important part for any Government in terms of the decisions that they’re going to be making.

So just very quickly, the changes made in the bill, as set out in the explanatory note: there’s going to be “mandatory reporting of privacy breaches: … compliance notices: the Commissioner will be able to issue compliance notices that require an agency to do something, or stop doing something, in order to comply with privacy law.”—this is very important, and—“The Human Rights Review Tribunal will be able to enforce compliance notices and hear appeals.” So there’s some good checks and balances that are contained within this bill. “[N]ew criminal offences: it will be an offence to mislead an agency in a way that affects someone else’s information and to knowingly destroy documents containing personal information where a request has been made for it. The penalty is a fine not exceeding $10,000:”. It’s got to be good penalty; it’s got to be a decent fine to deter and stop that type of criminal offending. So I think this is a very, very good part of the bill.

Finally, “Commissioner making binding decisions on access requests: this reform will enable the Commissioner to make decisions on complaints relating to access to information, rather than the Human Rights Review Tribunal. The Commissioner’s decision will be able to be appealed to the Tribunal:”. That, quite simply, is just streamlining the process and making sure that people get access to that service quickly, with, of course, the ability to still be able to take it to the Human Rights Review Tribunal if they need to, if they didn’t feel like there was a good outcome. So I’m very happy to have taken the call and stand in support of the Privacy Bill. Thank you.

I rise in support of the Privacy Bill currently before the House, and before I dig down into the intricacies of the actual bill, I just want to share a story which highlights just how necessary a review of the Privacy Act actually is. It wasn’t too long ago that I returned home after work one day and my sister was on her laptop, and she was talking on the phone to somebody in a distant country. As I walked into the house and I saw this happening, I said to her, “What’s going on here?” She said somebody had contacted her and told her that she had something going on in her computer—it was infected—and that she had to enter her password in and a few login details and then go to a couple of specific sites, which she was trying to do to try and, obviously, get her computer back on the straight and narrow.

When I revealed to her that she could, potentially, have been scammed, she then told the person on the end of the line, “My brother says that you’re trying to scam me.”, to which the person said, “No, I’m not trying to scam you—your brother is lying. Keep doing what I’m telling you.”, at which I then grabbed the phone and hung up for her and then looked at her computer screen, only to find that there were screeds of files that were currently flashing up on the computer screen in front of her. I turned the computer off immediately, and we had to have a little sit-down conversation about privacy and about how passwords shouldn’t be given out, especially to people over the phone that you don’t really know.

So as I look over this Privacy Bill that’s before the House, realising that it’s been a long time since we first had this brought before the House—the Privacy Act 1993—I think it’s about time for a refresh. I support the provisions of this bill, and I support them on behalf of my family too.

Let’s talk through some of the key messages. First of all, this here is to protect people and, obviously, their privacy online, and that can’t be minimised, because with the amount of work that we do now online, there is a lot of our private information currently out there, and we are in a very different world to the world that we were in in 1993.

Now banks are encouraging you to do all of your transactions online. Branches are closing down around the country in favour of online banking. We put all of our details in, and it doesn’t take much to ask for your name, your address, your phone number, and your email. Generally, any site that you go to and think, “That’s a cool site.”, you type in your information, and that’s your information’s that’s then being, sometimes—as we’ve found out in the case of Facebook recently—shared all around the world with third parties that we don’t really know too much about. So any moves by this Government to actually change things in a modern context, the context that we’re living in today, is a very good thing.

Again, the key purpose of the reforms is to promote and protect people’s privacy and give them confidence that all of their information online is going to be secure and adequately protected. The Privacy Act, in its current form, has been with us for nearly 25 years, and, as I’ve said before, it is time for a bit of a change because of, obviously, social media, e-commerce websites that we sign up to, etc., etc.

Let’s talk about some of the provisions in the bill. First of all, as the previous speaker who’s now departed, Mark Mitchell, has identified, there is the mandatory reporting of privacy breaches. So if an agency knowingly has a breach of privacy, they then need to, under the provisions of this new bill, actually tell that there has been a privacy breach, and that’s a very new but a very informative change that will be going through. It’s a great provision in there, and there will be criminal offences if they don’t tell. So it will be an offence to mislead an agency in a way that affects somebody else’s information and to knowingly then destroy documents once you’ve been requested to provide that information. The penalty for that is $10,000. So it’s a hefty penalty but it’s a necessary penalty as we move into the new age.

There is also going to be a strengthening of cross-border data flows and the protections around that. That’s incredibly important as the World Wide Web knows no bounds, and when we enter information into a website here, inevitably it can often be related to an overseas agency. So that begs the question: what is an agency? I’m glad that the bill has drilled down into exactly what that is, because some people out there might not know. An agency is the name used for any entity that handles personal information. So an agency can be just one person or it can be persons in both the public and the private sector, but it doesn’t apply to people in their personal or domestic capacity and it also doesn’t include the Sovereign, the Governor-General, Parliament, courts, and tribunals exercising judicial functions. So any agency that knowingly misleads the public about any kind of breach of privacy will be dealt to and dealt to very strongly.

One of the other provisions in the bill is also to strengthen the Privacy Commissioner’s information-gathering power. Now, the commissioner’s existing investigation power is strengthened by allowing him or her to shorten the time frame within which an agency must comply and increasing the penalty for non-compliance. I’ve already referred to that, but in giving more strength to the Privacy Commissioner, that gives more strength to New Zealanders so that we know that the right thing will be done if there are any of these breaches. The commissioner is able to make binding decisions, and again this is a very commendable provision—binding decisions on access requests. That reform is going to enable the commissioner to make decisions on complaints relating to the access of information rather than the Human Rights Review Tribunal. The commissioner’s decisions will be able to be appealed to the tribunal as well.

All of these, when you put them together, are provisions that are going to make the information that New Zealanders store online a whole lot more sound, so that we can sleep at night, especially in light of what’s gone and happened with some very famous privacy breaches around the world. It will enable us to sleep a lot easier, knowing that our information isn’t being sent out and divvied up to third-party agencies.

The Privacy Commissioner, John Edwards, when this piece of legislation was put before the country, was the first one to pipe up, saying that he welcomed the introduction of the bill to maintain New Zealand’s strong track record of protecting the privacy interests of individuals. It’s nice to know that our Privacy Commissioner has that kind of strength of character to believe that here in New Zealand we’ve been doing a really good job so far and we need to continue to do that. He said that privacy law reform, and this particular bill, was overdue and had become an increasingly urgent issue since the Law Commission made the recommendation back in 2011.

At this point, I think it’s only appropriate to acknowledge that the actual petition was put in place by the Opposition, who were the Government at the time, but they did kick off the work for the Law Commission to put in the review to make the recommendations. It’s a bit of a pity that all these years later—that’s seven years now—we’ve had to step in and actually finish this off, but, as we all know, good things take time, and this bill is currently before the House and it seems to have agreement on both sides of the House too.

So I have only support for this bill and for the protections that have been put in the bill. I think that this is something that New Zealanders should also be jumping in and supporting, especially as we move from the first reading stage through the select committee process. Obviously, if anybody’s got any problems with this, or with any facets of this particular bill, then they need to involve themselves in that select committee process. But, as it stands, I have absolute confidence that this is going to help New Zealanders to sleep at night, knowing that their information that we know we’re sharing online is going to be a whole lot more protected than possibly it has been in the past and that there are going to be severe penalties for agencies that intentionally break that law. This bill actually compels them to come forward, compels them to notify the individuals concerned where there are breaches, and also puts in place a very hefty penalty, one of $10,000. As I say, it’s been nearly 25 years since this Act has been revised and I commend this bill to House. Kia ora.

Bill read a first time.

Bill referred to the Justice Committee.