Privacy Bill

Members, when we last debated the Privacy Bill, the Hon Tim Macindoe had the call. He has 3 minutes, 50 seconds remaining should he wish.

💬 Hon Tim Macindoe: No, thank you.

💬 Greg O’Connor: Mr Speaker.

ASSISTANT SPEAKER (Adrian Rurawhe): So that would be New Zealand First?

💬 Mark Patterson: No—he’s called.

💬 Dan Bidois: Mr Speaker.

ASSISTANT SPEAKER (Adrian Rurawhe): I call Dan Bidois.

Well, that was a bit of a kerfuffle there. I didn’t think I was going to be talking on this bill for a couple more speeches, but, nevertheless, it’s a pleasure to speak in the second reading of the Privacy Bill, in what is my first contribution to this bill.

Can I start out by acknowledging the importance of this bill at a particular time that we’re having this conversation, particularly as we look at the use of data around the world. Now, I’ve just watched a show called The Great Hack, which is all about the use of data for unfair gain, in particular in respect of political purposes, and, basically, companies like Cambridge Analytica that were using Facebook-extracted data to target advertising for political gain on Facebook. So I think it’s really important that we have an amendment bill around privacy and the use of data. I note also the European Union has been through this process. In particular, the Government Data Protection Regulation has come into force in the last couple of years, trying to strengthen and protect individual data rights on the internet. So I do think it’s really timely that we discuss and put forward this bill.

I want to acknowledge, certainly, the previous National Government, which started this process, and, in particular, the Law Commission, which did a review in 2011 of our data and privacy laws and came up with a whole bunch of recommendations on how we can strengthen our data protection and privacy. I would like to acknowledge the previous Minister, Amy Adams, who was the Minister of Justice, with respect to bringing this bill to the House, but also the current Minister of Justice, Andrew Little, for continuing this good work. Now, we are in the second reading of this bill, so I would like to acknowledge the Justice Committee for hearing submissions on this bill, and I would like to acknowledge the kaupapa, or the purpose, of this bill in respect of strengthening data protection with respect to the use of personal information on the internet.

What this bill does is, essentially, threefold. Firstly, it gives the Privacy Commissioner greater powers to intervene and also to enforce the regulations. It also sets standards for agencies, whether it be public or private and whether they be domestic or international. The last thing is that it gives greater penalties for those that are found in breach of the Privacy Act, and I think that is really important that we have this.

There were a number of changes that were made in the select committee process. Firstly, it was made clear who this bill applies to and who it applies for and who it doesn’t apply to. In particular, there was a carve-out for media organisations. It was felt that media organisations shouldn’t come under this legislation, to protect their rights to maintain freedom of speech and also their important constitutional role in New Zealand’s democracy.

There were 162 submissions to the select committee, and the select committee heard 48. I do, again, want to acknowledge and commend the work of the select committee. I acknowledge the importance that strengthening our rules around data protection plays, and, in particular, in light of the last few years with the likes of Cambridge Analytica and the other vast array of companies that have sprung up that are using personal information. I would encourage all members of this House, but also everybody watching at home, to watch this flick on Netflix called The Great Hack, which details the extent to which companies are extracting personal data and using that in terms of feeding that back in terms of targeted advertising.

It’s a pleasure to commend this bill to the House in the second reading. Thank you.

Thank you, Madam Speaker. I have just reorganised myself, and I thank the previous speaker, Mr Bidois, for saving my bacon on that one. I was just a little bit short of papers at the time. But in the interim I have actually brought myself up to speed with a bill that I did have the privilege of sitting through the whole select committee on, and it enhanced greatly my understanding of the very vexed issue of privacy in the modern world.

Obviously, the bill was actually originally looked at in 2011 but sat like much of the not only legislation but spending, infrastructure build, and everything else done on the other side of the House, waiting for a party to come along which actually wanted to do something about this country. The Privacy Bill was very much part of that, and it was put forward originally as a member’s bill.

One of the important aspects of this—and this will be a short call—is one of the vexed questions at the moment in the world is Brexit, and Brexit is actually going to be important around this because Britain is part of the General Data Protection Regulation (GDPR). The GDPR, basically, are privacy standards recognised around Europe. Fortunately for us, New Zealand is actually recognised within that system; Australia are not. That gives us important access because, in much of the trade we’ll be doing, there’s, obviously, going to be a huge privacy, particularly electronic, element to that. So being privy to that is incredibly important, and being part and being compliant with that is important. We’re sort of, obviously, not quite sure what is going to happen now, of course—whether Britain will remain part of that with Brexit.

So it is an incredibly important piece of legislation—an important piece of legislation to ensure, like everything else we are doing on this side the House, that we are war ready, we are actually ready to take on the challenges of the future. We’ve got good infrastructure in this Privacy Bill, which I’m very pleased to recommend to the House.

Thank you, Madam Speaker. An interesting speech from that last member, Greg O’Connor, who didn’t really give us the fire and brimstone that we’re used to getting from him in this House. In his last effort, on the previous bill, he gave an exhibition of his great speech-making, and we were looking forward to a similar thing here tonight, but we missed out and instead we got a lesson on Brexit from the Labour Party, which I’m sure will be something we’ll be able to take home and value entirely.

💬 Greg O’Connor: The Tories have mucked that one up over there, too, haven’t they?

See, that’s the savageness of the socialists on that side.

This bill is actually a bill that started under the National Government. It’s all the work of the National Party and the Minister at that time, Amy Adams, and it’s coming to fruition in this House tonight. It has a number of major clauses in it to deal with privacy—and privacy breaches in particular—and as we look through Government departments and Government organisations, privacy is becoming vital to individual information and data and also individuals’ trust in our Government network to make sure that there is that privacy of their data and also of their information. So that is something there will be ongoing reform of, I should imagine, in the future as everybody looks forward to protecting people’s privacy and making sure there is the compliance out there and also the sanctions if people breach that privacy. That’s what this bill here does tonight. So we commend this bill to the House and look forward to seeing it pass.

Kia orana, Madam Speaker. Thank you. I was not on the Justice Committee and have a limited knowledge of this bill, but the Green Party is pleased to commend it because, as previous speakers have noted, it did come out of the work of the Law Commission in quite a substantial review in 2011. It recognises—and I commend the Minister for its introduction—that, after 25 years, the Privacy Act is in need of review. One of the major benefits of this bill is that it does modernise the regime. It recognises the changes in handling information, the large amounts of data that are collected these days, and it takes and implements the recommendation of the Law Commission that the focus should be much more on identifying and preventing risks to privacy rather than on acting after those have occurred.

One of the key changes that it makes is ensuring that there is mandatory reporting of privacy breaches, because that in itself, by alerting people to that, then puts pressure on to make sure that systems are improved to ensure that those breaches don’t reoccur. It also has some new provisions around compliance notices as well—again, to strengthen the actual application of the legislation. The Law Commission, in its 2011 review, did recognise that there were major deficiencies. It’s a pity that there wasn’t more progress made on it under the former Government, but I am pleased, obviously, that the Opposition does appear to be supporting it, and so it should go through with widespread support across the House.

It’s a bill that the Green Party commends and are grateful to for the changes that the party sought from the Minister, to implement some more of the recommendations of the Human Rights Commission to build in some more protection there. Thank you.

The next call is a split call. I call Ginny Andersen.

Thank you, Madam Speaker. As a member of the Justice Committee, it’s a great privilege to be able to speak on the second reading of the Privacy Bill, a piece of work that has been a number of years in the making. In particular, the bill implements the very good work done by the Law Commission’s 2011 report, which called for the existing Privacy Act legislation to be repealed and to be modernised.

A key reason that was raised in submissions, which was fascinating as I learnt more, was how much and how quickly the landscape changes, and how difficult it is for this House, in the process of producing legislation, to keep up with the rapidly changing landscape in which modern technology is moving at a lightning pace.

Some of the issues raised, in terms of where those lines lie for protecting privacy, gave us a huge insight into the benefits of seeing this bill, and the protections in the Privacy Bill are very important. The key purpose always to remember is to promote and to protect people’s privacy and to give them confidence that their personal information is properly protected. We always need to be vigilant and active in the face of greater sharing of information—that those personal details need to be protected at the same time.

The protections put forth by the Privacy Bill are crucially important, and it’s also just as important that, at a time when we’re seeing the world more joined up, for want of a better term, we’re also in line with other jurisdictions, and a key factor of this bill is it will better align New Zealand’s privacy law with those in the EU and the OECD guidelines. That’s something that, for a long time, New Zealand has not been keeping up with, and some of the interesting submissions were about whether we have reached that gold standard that’s been set by overseas and how we manage to do that within New Zealand.

So I will not take a long time to discuss this bill, because it’s good to see that we have strong support from parties within the House in an area where New Zealand’s legislation needs to be modernised in order to protect those very important rights of individual New Zealanders to have their privacy protected. Thank you, Madam Speaker.

Thank you, Madam Speaker. I rise to speak about the Privacy Bill. It is a Government bill but, for the benefit of the Greens’ member who’s recently taken her seat, Eugenie Sage, a lot of the work on this was done when we were in Government. That’s one of the reasons why we’re supporting it. These things have a long gestation. The issues of the—[Interruption] There seems to be a live mike over there with Mr Lees-Galloway, or he’s got a particularly carrying voice.

ASSISTANT SPEAKER (Hon Ruth Dyson): If the front row team wouldn’t mind being a little bit quieter. It’s a very interesting contribution.

They were taping you for posterity! We heard every word.

So I’ll just begin again, having acknowledged the Greens, but I would say that this bill has been a long time coming. As sometimes happens in this House, I was on the Justice Committee and, along with the member who has just resumed her seat, we heard some submissions about this in Auckland. One of the things that I think worked very well about this was the news media exemptions, and we saw a group of people from my old life—from television and newsprint and radio—talking about why they needed an exemption and why it was important that this bill did not curtail their ability to gather the news fearlessly and in a forthright manner.

Bloggers took a little bit more time to consider. Were they real news or fake news? Did they really matter or not? Books and publications were also put under scrutiny because, when you are updating a bill that’s been around since 1993, with the Privacy Act, there is a lot that has changed, and particularly in the electronic media space. Books and blogs—that was a fairly easy one to get through, but the definition of “agency” in clause 6 was one of the things that the select committee recommended, and I see the previous chair there, chairman Huo, and I’m sure he will take a call on this as well.

It is important to know that the Justice Committee—a very hard-working committee that neither of us is on any more, so we can speak of it fondly and with some affection—applied a degree of rigour to going through the various elements in this bill, made a couple of recommendations for change, but, fundamentally, it’s one of those omnibus bills that covers a multitude, does a lot of things that needed to be done and tidied up, which is why I commend it to the House.

It’s a pleasure to rise on behalf of New Zealand First in support of the Privacy Bill. I don’t intend to relitigate a lot of the, obviously, positive aspects of this bill. It’s got wide support from all parties and it’s really, as the previous members have said, been a long time in the making—and, of course, just looking at the fact that the Privacy Act is dated 1993.

I don’t think you have to think too hard to realise that technology has changed dramatically. The environment of all data and privacy issues has changed dramatically since that time, and this bill is all about modernising the Privacy Act and tightening up those laws, and, of course, that’s common sense and it has some common-sense changes. Essentially it’s repealing and replacing the Privacy Act 1993. I think that it highlights a couple of the priorities within the bill, which are addressing digital privacy—which is obviously important in today’s day and age—records retention, and security issues that revolve around all of those things.

Some major examples in this country of late of data breach incidents that seem to happen—well, it did happen because of the issues, the holes, within the Privacy Act 1993—include Z Energy and Ticketmaster in 2019. So we don’t have to look too far to get some good examples and reasons why we need to get this done sooner rather than later.

A few of the main things that this bill will do is require the public and private sector agencies to notify affected individuals if they experience a data breach. I think one of the things, one of the issues, that it’s trying to remedy is the fact that often privacy breaches or notifications of privacy breaches are quite belated. So it’s an important area that it will be fixing up.

But importantly also, the burden on businesses is likely, actually, to be modest with the changes that are going through this legislation. That’s because most businesses are actually doing quite good jobs already, and they have good practices already embedded in operations. So we expect that the burdens on businesses in general will be quite small.

Also importantly, this bill ensures that global businesses doing business in New Zealand, irrespective of whether that’s individual or larger agencies and where it’s located, comply with the new Privacy Act. Obviously, most importantly, there’s more powers that are granted to the Privacy Commissioner to ensure New Zealanders’ private information is safe. New Zealand First supports this bill. Thank you, Madam Assistant Speaker.

Thank you, Madam Assistant Speaker. First of all, I would like to congratulate you for your new role. This is the first opportunity I am speaking in your presence.

As everyone has mentioned, this is a bill which is being promoted in this House on the recommendation of the Law Commission. It is a very important bill because it protects the privacy of individuals. As we know, the time has changed, the technology has changed, and we have seen that the quality and the quantity of personal data available with businesses and Government are huge. To protect that, it is very important we should have a modern law available so that people have confidence in the privacy of their personal data.

So there were many issues which were dealt with by the Justice Committee. I would like to congratulate all the members of the select committee and officials who worked hard to make sure this bill is up to standard. I hope that the people will be having more confidence in this.

As it has been mentioned, the news media were exempted on two fronts; they have got some leverage on that. Also, the Privacy Commissioner is required to inform if there is any breach of the privacy of any person. There are exemptions, like if the data is held for a personal condition of a person and it is breached, then the Privacy Commissioner doesn’t have to notify the person. But, otherwise, if there is any data breach, then it has to be notified. With these words, I commend this bill to the House.

Thank you, Madam Assistant Speaker.

By the time we reported this bill back to the House it was in its 45th edition—45th edition. Big thumbs up to the—

💬 Kieran McAnulty: That’s amazing.

—it is amazing—Parliamentary Counsel Office. We received advice from the Ministry of Justice, the Office of the Clerk, and Crown Law. I thank our officials and advisers, particularly the submitters.

We received and considered 162 submissions from interested groups and individuals. We heard oral evidence from 48 submitters at hearings in Wellington and in Auckland. I think anyone who was involved in this important legislative process must have a sense of achievement. Having said that, behind each and every such statement there must be a caveat.

The Privacy Bill repeals and replaces the Privacy Act 1993, as recommended by the Law Commission, following its comprehensive review of the legislation in 2011. The Act has been in operation for more than 25 years and the recommendations themselves were seven years old or so when the Justice Committee considered this bill. We need to appreciate and face the reality that much has changed since the Law Commission issued its report and the recommendations.

Secondly, we must appreciate and face the reality that the renewal of our privacy law takes place against a background of increasing invasions of our privacy, growing public concerns, and rising international standards, as well as an unprecedented advance of new technologies in exploiting and storing our personal data. The laws in any jurisdiction are struggling to keep up, but we’re doing fine. We’re doing better than our Australian counterparts.

To some extent, I should say we are lucky, especially for our businesses. New Zealand is one of the very few countries to which personal data of European citizens can be transferred as of right, without any additional safeguards; simply because New Zealand has been accorded privacy law adequacy status by the European Commission. In terms of this bill, as an Auckland-based barrister Mr Rick Shera observed, we have an opportunity to do what we did in 1993 when New Zealand, together with a number of other countries, used an earlier OECD report, to create a law that was fit for local purposes while adopting internationally consistent core principles. So our law was in step with the previous European law, and let’s keep it that way.

The General Data Protection Regulation (GDPR) came into force on 25 May 2018. GDPR is a new EU privacy regulation and represents, perhaps, the most important change in data privacy regulation in a generation. One of the key changes in the GDPR is the expanded territorial scope. For example, Facebook is a US company—we apply the GDPR to all companies that process the personal data of people residing in the European Union. The GDPR includes sweeping changes to how companies like Facebook collect and use personal data. Facebook and other high-tech companies have to take this seriously given the EU is threatening to impose penalties of €20 million or up to 4 percent of global annual revenue for violations. The long arm of GDPR will now reach many New Zealand businesses.

There are some key features I’d like to highlight here. First of all, the notification threshold: the bill, as introduced, provides that privacy breaches that have caused harm or pose a risk of harm to people must be notified to affected individuals as well as to the commissioner. The notification threshold attracted the largest number of submissions, 85 out of 162. Most submitters, including the commissioner, are concerned that the bill will require all low-level privacy breaches to be reported, even if they are unlikely to cause harm. They think this will lead to what they call notification fatigue, and they are concerned that this may cause harm to New Zealand’s international reputation if New Zealand appears to have proportionally higher notification for privacy breaches. Also, the test of the risk element is a very low threshold for notification. It was lower than the recommendations and also lower than the test applied overseas. Business submitters are concerned that the threshold in this bill as introduced is out of step with comparable jurisdictions, notably the EU and Australia.

On a more practical point, businesses operating across international jurisdictions are keen for the various notification thresholds to be as closely aligned as possible. We’re persuaded by the submitters’ concerns about the current harm threshold for notification, and we recommend that the threshold for notification for privacy breaches be amended to require notifications of breaches where serious harm has resulted. However, the new term “serious harm” will not be defined under the bill—should not be linked to the current definition of harm in the bill, under clause 75(2)(b).

Secondly, Part 5 of the bill would enable the commissioner rather than the Human Rights Review Tribunal to make directions on complaints about access to information. An appeal against the direction could, however, be made to the tribunal.

Thirdly, the issue concerning news media exemptions has attracted lots of attention. The Privacy Bill does not apply to news media carrying out their news activities. The purpose of the exemption is obvious. It is to ensure the news media can perform the role required of them in a democracy by supporting the free flow of information to the public.

But there are three points that are worth noting. The first is the definition of “agency” in clause 6, which excludes news media carrying out their news activities. That’s easy to understand. But what about books and blogs? We recommend widening the definition of “news activity” in clause 6 to refer to publishing news and observation on news and current affairs, including a definition of “publish” to make it clearer that it includes publishing on the internet. This means that publication in books or on the internet can now come under the news activity exemption.

There are generally two criteria for such exemptions. The first is independent standards of conduct, including privacy standards, the second is complaints procedure, and the third one is with regard to Radio New Zealand and Television New Zealand. Under the bill as introduced, Radio New Zealand and TVNZ were treated differently from their media counterparts, because information privacy principle (IPP) 6 and IPP 7 would apply to them in respect of news activities. But I’m very pleased to report that amendments have been made. Radio New Zealand and TVNZ are now brought within the media exemption. Thank you, Madam Speaker.

Bill read a second time.