Privacy Bill

What a joy—twice in quick succession, a flood of favours! This is a massive rewrite of one of the most important pieces of legislation in our domestic law, and it was, I must say, in the Justice Committee, which I’ve sadly had to put to one side, looked at in great detail. I must say the officials were extremely patient as we worked through—

ASSISTANT SPEAKER (Hon Ruth Dyson): Sorry, I wonder if members could just keep the level of private conversation down a little bit. This is a very interesting contribution.

Thank you, Madam Speaker, I think. One of the really fraught issues, which I think is well worth discussing, is what officials essentially called the right to anonymity—that is to say the right to go online and on to a website and to not enter your personal details. There is—principle one, I think it is—a principle that says that an organisation is entitled and it’s appropriate to gather information for legitimate purposes. Now, quite obviously, if you are looking to subscribe to the Herald, they’ll want to know your name. They may well want to know your address for billing purposes, and probably they’ll want your credit card number. However, if you go to Stuff and all you want to do is read their free material, then the question is: is a website like that entitled to ask for details?

Of course, we know the big concern is that organisations of that nature acquire this information and may inappropriately use it for other means: to target you for advertising, to—God forbid—sell that information elsewhere. Now, we know that this would be a breach of privacy—to use it for a purpose for which it was not gathered—that in itself is inappropriate. But the really interesting conversation was whether there should be a stand-alone right to remain anonymous—a right not to give your details. Now, at the end of the day, it was hard to clearly articulate that right.

I guess, as a lawyer, I’m always concerned that something that you can’t say clearly, you can’t really say at all. In fact, if we can’t express that right appropriately then it’s not a right that can really exist. So the compromise was to look at principle one and to, essentially, tack on to it this right of anonymity. The fact is that in situations of that nature, there is no legitimate reason to inquire into those additional features.

This is important because it’s, essentially, building on the European framework. The Europeans, in fact, have a very clear right along those lines, but one which comes from an entirely different academic and scholastic framework—one where, in fact, the rights which people have are those given to them, rather than the common law approach, which we’re all very familiar with, I’m sure, which is that you have all of the rights unless they’re actually taken away. So what we have is a great move which took a lot of negotiation.

The other really important thing in the bill is making sure this is EU-compatible. One of the very interesting things is the fact that privacy law is now very much cross-border. The fact is that the websites we use and the information we give moves seamlessly across borders, and many of the internet service providers we use and the websites we visit are based elsewhere. Now, an important step taken here is to recognise overseas providers that meet EU standards—so buying, essentially, in to this EU framework. What that means is that rather than having to ascertain whether overseas providers are compliant with New Zealand privacy law, we can make an assumption that that’s case. Of course, that cuts both ways. So what that means is that because we are upgrading our privacy law to meet EU standards, our providers and our internet-based businesses won’t have to go through any rigorous vetting process. They are assumed, because they met our privacy laws, that they will, of course, meet European privacy laws.

So look, this was an excellent piece of legislation.

💬 Angie Warren-Clark: It’s a big piece.

It is a big piece of legislation there. Look, this is a substantial rewrite. May I say that it’s really important that we do this. This was a bill which was first drafted, I believe, in 1991. So it’s great to see that we went right through that and put it in much more accessible language. The Parliamentary Counsel Office did a great job in addressing that, in going through it, and in actually making it much, much more readable. So this is an excellent piece of legislation. I was pleased to be on the Justice Committee to see it through. It collaborated well, and I commend this bill to the House.

Thank you, Madam Speaker. I’m intrigued that both the Clerk and the member for Christchurch Central have indicated that we are talking about the Privacy Bill, because I recall, as a very young MP, probably about 10 years ago, speaking on a similar matter, and remembering that as a child my parents could never agree on the pronunciation of the word. My mother always used to correct Dad, because Dad would always say “pri-vacy” and Mum would correct him to say “priv-acy”. Well, sadly, Dad’s been dead for nearly 14 years, but Mum’s still hale and hearty, and she’s probably watching this debate—unless Coronation Street is on at the moment. I don’t think it’s on on a Tuesday night. So I’m going to curry favour and probably stick mainly with “priv-acy”, but I might lapse back into “pri-vacy” occasionally, in case Dad is looking down disapprovingly.

I do want to acknowledge that Dr Webb has recently left the Justice Committee, and that he was one of the members of the select committee who’ve worked hard on this bill. I’m a very new member of the committee. In fact, I attended my first meeting last week, and, therefore, I haven’t had the opportunity to work on the bill, but I have, nevertheless, been studying the work that the committee did, and, for the benefit of those who are watching, it’s a pretty weighty tome—there it is, the Privacy Bill—and I am genuinely impressed, as I read the report, at the obvious work that was undertaken by the committee members, and particularly pleased that there’s pretty broad consensus.

Well, one of the reasons the consensus is so apparent on this side of the House is that yet again, this is, effectively, a National Party bill. I want to acknowledge my very dear friend the retiring member for Selwyn and former Minister of Justice in the last Government, the Hon Amy Adams, because it was Amy Adams who did much of the work that has been picked up—and I’m very pleased has been picked up—by the current Government, and it’s good to see that it is now at the stage where it’s completed its work through the select committee. We’re into the second reading, and, presumably, it’s well on the way to being enacted, because, as Dr Webb has just said, this is an important measure, and, as I say, it contains some very significant provisions.

It’s certainly not possible in the time I’ve got available tonight to do justice to all aspects of it, so I am going to cherry-pick some of its key features and try to convey some of the issues that the Justice Committee encountered, and how both they, as a committee, and this bill responded to an environment, or are responding to an environment, that is rapidly changing. It’s quite hilarious, really, to reflect on the fact that the last measure of this type was about a quarter of a century ago, and, at that stage, the internet was very much in its infancy. None of us had smartphones. Very few of us would have had personal computers. I don’t think I had access to the internet back in the early 1990s. I’m not quite sure if you remember, Madam Speaker, the first time you did. It certainly was something that emerged through the 1990s. But the point is, clearly, the environment has changed considerably, and the implications for people’s personal privacy—I’m just thinking of Dad, now—are significant, and do, obviously, need to be tightened up in the bill that is now before us.

So some of the key provisions that are included in the bill, in recognition of the new technologies that have rapidly increased—the type, the quality, the quantity of personal data available to Governments and businesses, obviously, need to be dealt with. It’s important that we have better protection for personal information that is sent overseas. I think Dr Webb just covered that pretty well. It retains the complaints system, because, obviously, the ability to complain about breaches is vitally important, and the bill introduces new ways to enforce privacy principles, giving the Privacy Commissioner some new powers to make binding decisions on complaints about access to information. It also requires agencies to notify the Privacy Commissioner of unauthorised access or disclosure of personal information. We’re all aware of the fact that in recent times, there have been some high-profile breaches of people’s personal information, sometimes by Government agencies, that have caused widespread consternation. This bill is attempting to ensure that those sorts of things are, if they can’t be prevented, at least adequately dealt with under the law.

Well, as I say, in the time that’s available, I’m simply going to cherry-pick. But I do want to make clear that while the National Party supports the bill in principle, we do have residual concerns over two areas of this bill. The first is to do with the threshold for agencies to notify the commissioner as soon as practicable after the agency has become aware of a notifiable privacy breach. The amended bill, as we’ve got it before us now, would raise the threshold for agencies to report, but we in the National Party consider that there is still a risk of over-notification. By that what I mean is that our concern is that over-notification runs the risk of trivialising those very significant, genuine concerns and also will have the effect of causing considerable compliance costs, sometimes, maybe, for small businesses or entities that would be ill-placed to be able to cope with those. So we are a little bit concerned about the balance.

The second thing—we are aware that the Privacy Commissioner recommended quite substantial changes to the bill, and some of them went well beyond the scope of the bill as it was introduced and did cause us some concern. For example, it was the Privacy Commissioner’s view that there should be a right to erasure, also known as the right to be forgotten. Well, we’re pleased that the amended bill doesn’t pick up that particular suggestion, and we’re actually pretty sceptical that such a measure would be required in New Zealand.

Considerable consultation was undertaken. Just to name some of the organisations that the Law Commission, which did much of the work in 2011 to review the bill and led to this stage, undertook: they consulted with the Bankers’ Association, the Law Society, Business New Zealand, Google, TradeMe, Facebook, NetSafe, Telecom, Vodafone, InternetNZ, Consumer New Zealand, and the New Zealand Medical Association to—

ASSISTANT SPEAKER (Hon Ruth Dyson): I’m terribly sorry to interrupt the member—

I’m heartbroken, Madam Speaker.

ASSISTANT SPEAKER (Hon Ruth Dyson): —but the time has come for me to leave the Chair. This debate is interrupted. It is set down for resumption next sitting day. The House stands adjourned until 2 p.m. tomorrow.

Debate interrupted.

The House adjourned at 10 p.m.