Privacy Bill

I move, That the Privacy Bill be now read a second time.

The Privacy Bill will repeal and replace the Privacy Act 1993. This much-needed reform will modernise our privacy laws to give people confidence that their personal information is secure and will be treated properly in an increasingly digital and data-rich society. I first want to thank the Justice Committee for its diligent consideration of the bill, and those members of the public who made submissions. The committee received 162 submissions. The submitters engaged comprehensively with the bill and have contributed greatly to its development. Almost all submitters supported the bill’s direction, but some had concerns about certain clauses and questioned how the bill’s provisions will operate in practice. I am pleased to see that the committee has taken these considerations on board and made several valuable changes to the bill.

I want to highlight some of the key changes that the committee has made in response to the submissions that it received. The committee has recommended clarifying who the bill applies to and when overseas agencies will be captured. This is important now that New Zealanders routinely submit their personal information directly to online retailers and other businesses based overseas. The committee has recommended a new provision, making it clear that the Privacy Bill will apply to overseas agencies that carry on business in New Zealand. These are agencies that may not have a place of business in New Zealand, but they do systematically and deliberately take opportunities to engage in trade here. If an agency does business in New Zealand, we need to be able to issue meaningful corrections to them if we think they’re not in compliance with our expectations. To ensure it doesn’t overreach, the bill will only apply to actions taken and information collected by the overseas agency in the course of carrying on its business in New Zealand. This change provides certainty about the extent to which the bill applies in a range of situations involving overseas persons, agencies, and information.

Another change concerns mandatory notification of privacy breaches. As introduced, the bill provided that agencies must notify the Privacy Commissioner and affected individuals of privacy breaches if the breach has caused harm or there is a risk it will do so. Many submitters thought that this threshold was too low and would result in a large number of relatively innocuous privacy breaches being mandatorily notified. Submitters worried that this would desensitise people to genuinely harmful privacy breaches and overload the Privacy Commissioner with low-value work. In response, the committee has recommended raising the threshold for what constitutes a notifiable privacy breach. Agencies will now be required to notify the Privacy Commissioner and affected individuals of privacy breaches where it is reasonable to believe the breach has caused or is likely to cause serious harm. This change better aligns the bill with overseas jurisdictions who have comparably high notification thresholds.

The committee has also recommended updating the news media’s exemption in the bill. The purpose of excluding the media is to enable them to perform their role of supporting the free flow of information to the public. It supports their right to protect their sources, which the common law, at least, recognises and accepts.

The committee has recommended clarifying the definition of “news activity” to encompass non-traditional journalistic works, such as books and blogs, but only provided that the author of those works is subject to an appropriate regulatory body. This is to ensure that news media have the freedom to publish news in different formats, including on the internet. The committee also recommended that Television New Zealand and Radio New Zealand be brought within the media exemption so that they can operate on an equal footing with other news media.

One of the strengths of our privacy regime is the adaptable and flexible nature of our principles-based approach to information privacy regulation. Importantly, the committee has recommended a new information privacy principle, which increases the total number of privacy principles from 12 to 13. The new information privacy principle 12 sets out the requirements for the disclosure of personal information outside New Zealand, which were contained within information privacy principle 11 in the bill as introduced. A New Zealand agency may disclose personal information to an overseas agency if that agency is required to protect the information in a way comparable to New Zealand.

There are a number of ways to satisfy this new requirement. The overseas agency may be in a country that is included in a white list of countries to be prescribed in regulation or such safeguards as can be imposed by contract. A person may also authorise their information to be disclosed overseas, but the committee has made it clear, in response to submissions, that the individual must only authorise disclosure after being informed that the overseas jurisdiction may not have comparable safeguards. The new requirement seeks to enable the free flow of data and give people confidence that safeguards will continue to apply to their information when it is shared overseas unless they authorise otherwise.

The committee has also recommended a change to information privacy principle 1 to discourage agencies collecting personal identifiers by default without considering whether it is necessary to do so. A further change to information privacy principle 4 seeks to protect young people, who may be more willing than adults to disclose their information online and who may not be aware of why an agency wants their information. The committee has recommended that agencies take into account the vulnerability of children and young people when collecting personal information from them. I’ll be interested to hear members’ views on the committee’s recommended changes to those information privacy principles.

Equally interesting is what has not been included in the Privacy Bill. As I’ve said, the bill contains important changes which will bring New Zealand law into better alignment with overseas developments, but many submitters wanted the bill to go further. In May last year, the European Union’s new General Data Protection Regulation was introduced. That law contained new rights, such as a right to data portability, a right to be forgotten, and requirements for algorithmic transparency. Many people, including our Privacy Commissioner, submitted that similar rights should be added into this bill. However, the Justice Committee did not recommend those additions, nor did it recommend substantial fines for individuals and organisations who seriously breach their obligations under the Privacy Act. I’m aware that the Privacy Commissioner has been a strong proponent of civil penalties, which the European and Australian regimes have.

These are important areas of privacy law, which would represent substantive changes to the bill and our current policy framework. They require careful consideration, policy development, and consultation, and need to be considered within the wider regulatory scheme to avoid unintended consequences. Adding such reforms into this bill would significantly delay the enactment of the important reforms it already contains and, frankly, are needed now. Instead, these issues can be considered as part of any future work on privacy reform.

I do not anticipate that this future work would form another large review of privacy law, which was carried out last by the Law Commission, but rather I anticipate a need for ongoing review and incremental reform given the rate of technological change and continual evolution of international privacy standards. The changes recommended by the committee will help strengthen and improve the Privacy Bill and better address the challenges of the digital age. On that basis, I commend the bill to the House.

Thank you very much, Mr Speaker. Can I thank the Minister for his contribution in leading off the second reading of this very important bill. I hesitate to say that we enjoyed ourselves on the Justice Committee, invigilating this bill, but we certainly worked very hard. It is an area of law that is of vital importance and it is an area of law that has been badly in need of an update, as the Minister has made clear.

This bill started life back in 2011, back in the 50th Parliament, and it’s taken until—what are we?—midway through 2019, and it looks like the bill will pass before the end of the year. It started life with a Law Commission report. I think there was an exposure draft as a response to that, and then I think the last Government, the last National Government, actually introduced the bill—I think I’m right in saying that—and the bill was sent to our committee for consideration. As the Minister’s rightly noted, it is a total rewrite of the law. Actually, various things had been kind of shoehorned on to the legislation over the last 25 years or so, and I think it is appropriate that we do have a total rewrite in light of the advances in digital technology. That’s the first point I want to make—that I think that the process has been a long one but it’s going to lead to a good outcome.

We did work really hard on the Justice Committee, on the bill. It’s a highly technical area of law, as I’m about to canvass, and I do just want to, at this point, acknowledge the hard work of the Justice officials who guided some people; some familiar with technology and privacy principles and some—it would be fair to say, on the committee, without disparaging my colleagues from both sides—not quite so familiar, but they led us through in a very good way and were very practically minded and did a really good job.

There are a couple of things I want to highlight in relation to the substance of the bill. The first is around the mandatory reporting of privacy breaches, which is clause 117 of Part 6 of the bill. We spent quite a long time on this in the committee, trying to find the right balance between making Parliament’s expectation clear that agencies would take privacy seriously and that when there were privacy breaches that occurred they would be notified, but also finding the balance between that and making sure that there weren’t so many notifications that it trivialised the value of privacy, and that actually, with so many notifications to people and to the Privacy Commissioner, people would stop taking things seriously.

I think we’ve about got the balance right. A notifiable privacy breach is one “that is reasonable to believe has caused serious harm to an affected individual or individuals or is likely to do so” and in clause 117(a) there’s a series of factors that agencies have to take into consideration. I’ve got residual concerns that we haven’t quite got the balance right, and maybe that’s something we can talk about in the committee of the whole stage, but we worked pretty hard as a committee to get that balance right.

The Minister’s made reference to the other area I wanted to mention, which is the quite serious attempt we have made to bring agencies based outside New Zealand into the law. We’ve recommended an amendment to insert new clause 3A to make it clear that it will apply to agencies outside New Zealand. It will apply to the actions by a New Zealand agency “whether inside or outside New Zealand” and apply to “all personal information collected or held by [a New Zealand agency] … regardless of where the information is collected”, and, as well as that, all agencies outside. We want to make that very clear in the bill.

The other thing I want to make clear is around the news media. Again, we had quite a long debate as a committee about what exactly the role of the news media is in relation to privacy. What’s clear in the bill is that clause 6 exempts news media, and it’s very important that they are able to play that role in a free and democratic society. We have actually widened the definition of what “news media” involves, in the bill. So we have widened, I suppose, the scope of the exemption from privacy, but at the same time we have made it clear that the only exempt media entities will be ones that are subject to independent standards of conduct, which include privacy standards and a complaints procedure.

So the examples of things we’re talking about would be the Broadcasting Standards Authority and the New Zealand Media Council, and we’ve given a residual power in the bill for the Minister, in conjunction with the Privacy Commissioner, to recognise another regime if something comes about in the future.

Debate interrupted.

The House adjourned at 10 p.m.