Privacy Bill

Thank you, Madam Chair.

💬 Kieran McAnulty: They don’t even care.

Oh, I care deeply, Mr Iain Lees-Galloway. I care more than the Minister of Justice, clearly, because I’m here and presenting on behalf of the National Party.

We support the Privacy Bill, we continue to support the Privacy Bill, we have since it was largely—or at least, commenced in the conception and drafting thereof under a previous Government. We think that it is a matter of some importance to the nation, and it’s appropriate that the Parliament take it seriously. Privacy is a human right and should be recognised as such, at least in the form of a good bit of legislation such as we have before us today.

I think it’s worth noting that the Privacy Bill doesn’t cover every scenario in terms of protecting privacy in this country, but it is good as far as it goes and should be judged on those merits for the purpose of the committee stage. Obviously we’ll confine ourselves to making comments about that which is in the bill and not that which is not in the bill.

I look forward to something of a discussion with the Minister, or a Minister, in terms of a couple of questions that we have in the way that we conduct these committee stage exchanges. I will pose a number of questions, but happy, obviously, to engage throughout, and on a couple of areas that seem to me reasonably key. I did have the benefit of being a member of the select committee for some of the process of its consideration and the deliberation, albeit not all of it. So on some occasions I’ll be asking questions that I’m reasonably confident I know the answer to, but think it’s worth putting on record so that the Minister has an opportunity to provide some clarity and some guidance and also, of course, an element of testing, albeit from a point of view that is somewhat—not in an unduly or unhelpfully partisan manner for a subject area that as I began my contribution, I think is well agreed in principle.

So my first question to the Minister would be around the fact that we have a new piece of legislation that, like its predecessor, is based on a number of information privacy principles. There are 12 of them, and I wonder if the Minister would care to provide a comment. I’m just looking in his direction. I don’t want to catch him out, so to speak. But I’m curious to know if the Minister has any thought about whether there should be any further information in terms of privacy principles or if he’s happy that we, essentially, relegislate under the current framework of the existing principles, but merely update the detail under each of those. So that would be my first question, if the Minister is in a position to answer, failing which I’ll continue on another. In fact, I see he is.

Thank you, Madam Chair, and I thank the member for his question. This bill, the member might well know, goes back some years. In fact, it started under the previous Government, and it’s no criticism that it has taken this long to get to this point. A very important area of human endeavour—particularly in this day and age—is to ensure that we have a good legal framework to protect privacy.

So these privacy principles were well canvassed and well thrashed out in the original legislation. They were well reviewed and well considered in the review of the legislation, and in putting together this bill. Even though the bill started life in 2011, I think, and has been reconsidered since—and certainly on the change of Government, there was a further reconsideration about whether it met the mark. There were some changes made to bring it up to spec, particularly with the European data requirements. But these principles have proved to be enduring, and with some minor changes and tweaks, I think, generally, members on both sides of the House have got to the position that, actually, they serve the purpose well. They’re a good, high-level indicator of what is expected and the extent of protection that ought to be in place, and a basis on which the rest of the legal framework can fall.

So I stand by the principles as they are. They’ve been well considered, and they’ve been proven to work in practice.

Thank you, Madam Chair, and I’m grateful to the Minister for that answer. On this side of the committee, I think we’re in a very similar space, at least as far as the ambit of the bill itself is concerned, as I noted earlier.

I’m interested also to just flesh out a little bit of the Minister’s thinking around the operation of the new offences and penalties that are created by the bill. It’s one of its key features. So for those who haven’t had the benefit of reading it closely, I’ll note, for the sake of the debate, that the bill does create new criminal offences, including misleading an agency to obtain access to someone else’s information or destroying a document containing personal information, with the context being that it was known that a request had been made. There are penalties of up to $10,000, which is considerably higher than the fines under the current legislation. So no small matter, but that’s appropriate if we regard privacy as a serious matter of protection, or indeed as a human right, as I characterised it earlier.

So my question for the Minister is how he views these penalties under the Privacy Bill—soon to be the new Privacy Act—in relation to the penalties that are available under the civil regime. So where the tort of privacy currently exists and it’s available to a person to take a cause of action against another person for a breach of privacy, I’d be interested to know from the Minister how he feels that these should interact—whether, for example, an offence allegedly committed under the Privacy Bill would preclude a civil action in a similar kind of space or in relation to the same action and vice versa, bearing in mind, of course, the principle of double jeopardy at play. So I’d welcome any comments that the Minister has on that.

I thank the member, Chris Penk, again for his question. I think the member can be assured that the level of penalties for offences in this bill are comparable to offences in, for example, the Human Rights Act and those that would also be considered by the Human Rights Review Tribunal. So we know that at that sort of civil level of penalty, that $10,000 mark for an individual is pretty much the top end. It is a pretty severe penalty for an individual who offends against the provision. But it’s not at the $100,000 or $500,000 mark. You wouldn’t expect that for this sort of thing.

These penalties are greater than what appears in the current legislation, but that is right, not only because inflation will have eroded the value of those penalties but also because there is, for good reason, greater sensitivity in this day and age about privacy and about breaches of privacy that ought to attract a material enough penalty, which I think these provisions do.

Thank you, Madam Chair, for the opportunity to continue a little bit on the subject of penalties, and I’m grateful to the Minister for his explanation of the level of penalties set by the bill, but I wonder if he can provide any guidance on how he sees the operation of offences under the Act as compared with what might be available to a private litigant? So, in a civil action under the tort of privacy, it might be available for a person to sue for a breach, and I’m wondering if the same action that falls within the ambit of this bill might also be available to a person to sue in respect of that in that civil realm.

The jurisprudence on privacy in New Zealand has really been geared around the Privacy Act, and it’s what the Privacy Commissioner and what the Proceedings Commissioner has done in relation to the Human Rights Review Tribunal. In terms of private action or a piece of civil litigation in relation to privacy, a litigant would have to demonstrate harm, which is what they’re, effectively, seeking, either compensation for that or reparation for that or some sort of exemplary damages. But that area in New Zealand common law is not well developed, so I’m not particularly fussed that the offence provisions here don’t allow somebody who has suffered a civil wrong to launch litigation for that. This is the means by which people can enforce their privacy rights. They can do it through the Privacy Commissioner and they can do it through the Proceedings Commissioner, who takes cases to the Human Rights Review Tribunal. So that’s the important part of the privacy jurisprudence for New Zealand and will continue to be so.

Thank you, Madam Chair, and, again, grateful for the interaction on that one. My next line of questioning, or perhaps exploration, is in relation to the exemptions for news media.

I note that the way that the bill is structured is that it is an “agency”, as defined in the legislation, who has certain obligations for the treatment of private information. There are a number of exclusions, one of which we might come to a bit later, but, initially, I’m interested in the exclusion that an “agency” does not include a news entity in relation to its news activities. We see that a “news entity” means one that is, essentially, conducting news activity, which in turn means, among other things, publishing news observations and current affairs and so on.

So given that “publishing” in the bill can mean publishing on any medium, just wondering if the Minister’s got any views about how this may apply, whether immediately or perhaps in due course, to social media platforms. I appreciate that it’s a vexed area more generally and outside the realm of privacy legislation as well, and I do acknowledge that it’s an evolving area, so I don’t think it’d be reasonable for anyone to expect the Minister would have a complete answer in that regard. But, certainly, any guidance he can give I think would be useful to sort of develop the thinking of this committee, and no doubt for others who are interested in developing and, indeed, applying privacy law going forward.

Thank you, Madam Chair. I think, from the outset, the current Privacy Act was conceived on the basis—and it was a very debateable point at that time—that the news media were able to protect their sources. As a liberal social democracy, we’ve long cherished the role that the fourth estate plays as part of our democracy, not just calling politicians to account but calling private organisations and public organisations and individuals to account, particularly those who wield power or exercise power and influence. So protecting the news media has always been a vital objective in the legal framework that we’ve got.

In terms of defining what that is, clause 6, which is the interpretation section, is very clear in its definition of both news activity and news entity. So news activity involves gathering, news gathering, observation on news, current affairs. Now, somebody might say, well, somebody with a Twitter account is observing news, sometimes very insightfully and sometimes not—in fact, I’d say more often not insightfully. But I think where the rubber hits the road is in the definition of news entity, and a news entity is one that is subject to oversight by the standards agency—so the Broadcasting Standards Authority, the New Zealand Media Council, or equivalent.

So it’s not anybody who rocks on up and says, “Right, I’m a news outlet.” We expect them to observe basic journalistic principles: the need for fairness and balance, a commitment to accuracy. No one’s perfect and people get it wrong, but you want an institution that is committed to that. So I’m satisfied that the definitions in clause 6 of the bill provide the safeguards in relation to the protection afforded news media. We want them to have that protection, but we don’t want anybody just rolling around claiming that they’re somehow a news entity and doing news activity, when that isn’t the case. I think there’s a very clear definition here that protects those who are subject to the accountability of the real news media and it protects the news media in doing their job.

Thank you, Madam Chair, and, again, thanks to the Minister. I suppose I might just add, if I may, an observation on that area, having had the benefit of a discussion at the select committee level. We thought that it would be helpful to provide as much clarity as possible—notwithstanding that it is a developing area, of course—in the social media space. So with “news entity”, which the Minister rightly highlights as being a key aspect of that definition, essentially—and, therefore, that exclusion—we talk about those who are, or are employed by one who is, subject to the oversight of the Broadcasting Standards Authority, Media Council, or other body prescribed as a regulatory body by regulations made under the relevant section of this Act. So I presume it would be within the purview of the Minister of Justice, in whose name this bill comes before us, effectively, to be able to control that. In fact, actually, I should acknowledge I might be wrong in terms of the Minister who would be suggesting that those regulations be made. But, in any case, it would be within the ability of the Government of the day to make regulations to acknowledge updating circumstances in the media space as a bit of a compromise whereby we want to provide as much certainty as possible and not merely talk in general terms about what it is to be a publisher, and so forth. So I think that’s, if I may say, a helpful discussion that we’ve been able to have on both sides of the House, and, indeed, following the select committee process that was also very constructive in that regard.

I did have one other question in relation to the definition of “agency”, and it was an invitation for the Minister to comment on the exclusion to do with inquiries. So, for anyone following along at home, or, indeed, the Minister himself, in the “Interpretation” section—that’s clause 6(1)(b)(x)—an inquiry is not included in the definition of an “agency”, whereas some of the other exclusions are very worthy. For example, members of Parliament in their official capacity are excluded, which, I have to say—albeit with a vested interest—I think is very right and proper. For an inquiry to not be subject to the principles and the prescriptions and the proscriptions of the Act seems to me, perhaps, surprising, but there might be a good explanation for it. So any thoughts that the Minister may have, and I appreciate I’m putting him on the spot somewhat, in a relatively small aspect, albeit important, given the number of inquiries that are conducted. If the Minister has got any comments in relation to that, I would be grateful to hear them.

Thank you, Madam Chair. I think the reason for that, if I could assist the honourable member, is because the framework around inquiries is generally covered by the Inquiries Act. So an inquiry, as we commonly understand it, which is usually public, is subject to a number of constraints and rules and regulations, and so any privacy obligations and obligations to protect privacy are covered under that legislation. So it doesn’t need to be replicated or duplicated under this, the generic Privacy Bill.

Thank you, Madam Chair, for the opportunity to have one more call—thank you.

I’m just, finally, curious on the subject of what is described in the commentary, as reported from the Justice Committee—that fine body—in relation to commissioners’ decisions on access requests. And so what we’ve got is an understanding that the commissioner, being the Privacy Commissioner, would be able to make directions on complaints about access to information. And then if the person who’d made a complaint was not satisfied with the finding, or, perhaps, someone being dissatisfied in having a finding made against them to be able to appeal that to the Human Rights Review Tribunal. So that’s a deliberate policy decision that’s been made. I make that observation on the basis that, previously, I think I’m right in saying, the Human Rights Review Tribunal would have a prior involvement in the process. So if there’s any particular thinking behind that that the Minister’s able to share with us, that would be useful to know. Thank you.

💬 Simeon Brown: Madam Chair.

I think the Minister’s—do you want to respond to that or do you want a bit more time?

💬 Hon Andrew Little: If Mr Brown wants to take his call and I’ll respond to both.

Thank you, Madam Chair, for the opportunity to take a call on the Privacy Bill, an excellent piece of legislation which was brought to this House by the National Government—a great piece of National legislation which the Government’s still progressing many years into its first term, and only term, in Government—this, the Privacy Bill.

I just want to cover a couple of points in this legislation. I’d like to talk about cloud services, which are not to be covered by the principles relating to overseas disclosure. It says in the commentary, “We consider that the obligations in clause 19 of the bill as introduced, IPP 11(3) to (6) (which, for reasons … we recommend renaming to IPP … should not apply to an agency transferring information to a cloud storage provider or other overseas processor.” I was wondering if the Minister would like to give the committee some explanation as to why that has not been covered in those principles and that those principles do not apply to an agency transferring information to a cloud storage provider or other overseas processor.

A big issue which is developing—cloud storage services are becoming more and more part of our lives, and I think it would be helpful for the committee to be able to understand the issue that is at play here and the impact that it has on cloud storage services, which New Zealanders use in their day-to-day lives. Thank you, Madam Chair.

Thank you, Madam Chair. Just responding to Mr Penk’s—I was going to say his final question, but I hesitate to tempt fate on that regard, but just to say that access to information is a vital principle and a vital objective. So the Privacy Commissioner has a role to play to ensure that those seeking or who have been declined access to personal information from an agency can go to the Privacy Commissioner and get a ruling on that, and the Privacy Commissioner can take an interest in that. That is important, and the bill is about—as, indeed, is the current Act—maximising access to personal information held about you so that you can get that or a person can get that.

In relation to Mr Brown’s question, a number of issues arise with information stored on the cloud. The question is, of course, who controls that, and if a cloud operator is an overseas entity, it’s going to be difficult for the Privacy Commissioner to have jurisdiction over that. The way the Privacy Commissioner operates and what we seek to do is to ensure that where information is stored in the cloud, the agency who has stored it is the outfit who you go to to claim your right of access where that is an issue. And we are currently working with many countries about ensuring that we can protect the rights of citizens, of individuals, in terms of access to their information that, although it might be controlled by an agency, is stored by cloud services that themselves are controlled offshore, and we want to make sure that individuals don’t lose control over that data and the way that is processed and used by that cloud operator. But the ability to do that cannot be covered in this legislation because it is confined to New Zealand territory. The extraterritoriality requirements that we might have will be covered by other provisions.

The question was put that the following amendments in the name of the Hon Andrew Little to the proposed amendments set out on Supplementary Order Paper 482 in the name of the Hon Andrew Little be agreed to:

in clause 2(2), replace “1 November 2020” with “1 December 2020”.

in clause 19, information privacy principle 12(3), delete “and sections 212A and 212B”.

in clause 47, replace “an individual” with “a person”.

in clause 64(2), replace “individual” with “person”.

in clause 67, replace “an individual” with “a person”.

in clause 74, definition of action, replace “section 6” with “section 6(1)”

in clause 75(3), replace “request made by an individual” with “request made by a person”.

replace clause 102(1) with:

(1) This section applies if a complaint or matter is referred by the Commissioner to the Director under section 84A, 89B, 96(5)(b) or (6), or 99(4)(a) or (5).

replace clause 127(2) with:

(2) The agency must—

(a) comply with the notice as soon as practicable after receiving it unless it is cancelled or suspended; and

(b) if applicable, remedy the breach by the date stated in the notice unless that date is varied or modified.

in clause 191, replace “8 November 2020” with “8 December 2020”.

in clause 216, replace “8 November 2020” with “8 December 2020”.

in Schedule 1, clause 1, replace “1 November 2020” with “1 December 2020”.

in Schedule 8, replace “1 November 2020” with “1 December 2020” in each place.

Amendments to the amendments agreed to.

The question was put that the amendments set out on Supplementary Order Paper 482 in the name of the Hon Andrew Little as amended be agreed to.

Amendments as amended agreed to.

Parts 1 to 9, Schedules 1 to 10, and clauses 1 and 2 as amended agreed to.

House resumed.

The Chairperson reported the Climate Change Response (Emissions Trading Reform) Amendment Bill with amendment, the Mental Health and Wellbeing Commission Bill without amendment, and the Privacy Bill with amendment.

Report adopted.