Privacy Bill

on behalf of the Minister of Justice: I move, That the Privacy Bill be now read a third time.

The purpose of this bill is to promote and protect people’s privacy and give them confidence that their personal information is properly safeguarded. Privacy can mean different things to different people, but I think we can all agree that privacy law and data protection are vital, particularly now, when information in the hands of agencies and corporates has the power to affect the lives of individuals globally. It’s imperative that our law relating to privacy is fit for purpose.

New Zealand privacy law has been well served for 27 years by the 1993 Privacy Act. Applying to almost every person, business, or organisation in New Zealand, the Act’s privacy principles guide how personal information can be collected, used, stored, and disclosed. However, information technology has revolutionised how we deal with personal information. We’re collecting, storing, and disclosing more personal information than ever before. This bill updates the Privacy Act to modernise its language and strengthen privacy protections to better address the challenges of our data-rich society. The bill retains the existing principles-based approach to privacy regulation, which is the strength of our privacy regime, while further strengthening it in a number of respects. I will highlight a few of these.

The Privacy Bill introduces new mechanisms to promote early intervention and risk management by agencies, rather than relying on people making complaints after a breach has occurred. The bill’s reforms will also enhance the role of the Privacy Commissioner. One of the key reforms in the bill is the new requirement for agencies to report privacy breaches that pose a risk of serious harm to people. A privacy breach is any unauthorised or accidental access to or disclosure, alteration, loss, or destruction of personal information. Privacy breaches can affect people significantly. It’s important that people are aware of what’s happened to their personal information so that they’re able to take steps to prevent or mitigate any harm. Requiring agencies to notify affected people and the Privacy Commissioner of privacy breaches brings our privacy law up to date and aligns it with overseas best practice.

This bill also gives the Privacy Commissioner new powers. It allows the commissioner to issue compliance notices which will require an agency to do something or to stop doing something in accordance with the bill. This power will enable agencies and the commissioner to take more proactive steps to address privacy concerns. Currently, compliance relies on an individual bringing a complaint rather than placing accountability on the agency to address privacy concerns, and issuing compliance notices will fill this gap in the law. The Privacy Commissioner will also be given the power to make access directions requiring agencies to provide people with access to personal information that they hold. Currently, the commissioner can only mediate and make recommendations regarding access; so this will streamline the existing complaints resolution process so that people can access their personal information quickly.

The bill provides certainty about the extent to which it applies in a range of situations involving overseas persons, agencies, and information. This is important now that New Zealanders routinely submit their personal information directly to online retailers and other businesses based overseas. To strengthen protections, New Zealand agencies will now be accountable for ensuring that acceptable safeguards will apply to information that is sent overseas. Cross-border disclosures will generally only be allowed if the information is subject to comparable privacy protections overseas as apply in New Zealand or the person concerned consents to the disclosure. The bill also clarifies an agency’s obligations when they send personal information offshore for storage or processing. It provides that personal information is still treated as being held by a New Zealand agency when it’s held by another agency for storage or processing, even if that other agency is outside New Zealand or stores the information offshore.

I’m aware of concerns that the bill’s reforms do not go far enough. In 2018, the European Union’s new General Data Protection Regulation was introduced. That law contains new rights, such as a right to data portability, a right to be forgotten, and requirements for algorithmic transparency. Many people, including the Privacy Commissioner, submitted that similar rights should be added into this bill. However, the Justice Committee did not recommend those additions, nor did it recommend substantial fines for individuals and organisations who seriously breach their obligations under the Privacy Act. These are important areas of privacy law, which would represent substantive changes to the bill and our current policy framework. They require careful consideration, policy development, and consultation, and they need to be considered within the wider regulatory scheme in order to avoid unintended consequences. Adding such reforms into this bill would significantly delay the enactment of the important reforms it already contains. Instead, these issues can be considered as part of any future work on privacy reform.

At this point, I want to acknowledge the road that we’ve taken to get to this stage of the parliamentary process and all of those who’ve contributed to this bill’s passage. In particular, I want to thank the members of the Justice Committee for its work on this technical piece of legislation and to those who submitted. The submissions that were made informed the committee’s refinements of the bill, which assists the bill in achieving its aims of enhancing protections for personal information. It’s satisfying to get to this final stage. I commend this bill to the House.

Well, I have to say that this is probably one of the best bills that the Government has brought to this House, when you put it up against their reformist agenda, like the prisoner voting bill or protecting the name of the Ombudsman. But the reason why this is probably one of their best pieces of legislation is that this is the work done by the Hon Amy Adams when she was justice Minister in the previous Government; so of course we’re in support of this bill.

The protections in the Privacy Bill are extremely important. The key purpose of the reform is to promote and protect people’s privacy and give them confidence that their personal information is properly protected. We support these privacy reforms, which were a large piece of work instigated, like I said, by the previous Minister of Justice, the Hon Amy Adams. I see Darroch Ball looking with admiration as he considers just how good this bill is and thinking thank goodness that, actually, this Government was able to pass at least one decent piece of legislation while they were in Government.

We support balancing strong privacy protections for individuals with sensible use of data and data sharing by agencies. Having sensible and practical privacy laws makes a huge difference to how effective Government programmes are. We’re very happy to stand in support of this bill. Thank you.

Thank you, Madam Speaker. I rise to briefly speak on the bill in support of it as well. What occurs to me as I stand here is that this was a bill that was originally—well, the principal Act we’re amending was—put in place 25 years ago and yet here I stand with a device on me that tracks where I shop, what I look at, and develops algorithms about my habits. We live in a vastly different privacy environment to that that was around when the principal Act was put into place, and so it’s timely and appropriate that this bill is developed at this stage. It’s been done so with cross-party support, and I strongly commend it to the House.

Thank you, Madam Speaker. I just want to acknowledge the reference to the age of this bill. This bill’s almost as old—or the law that it’s replacing, the Privacy Act 1993, is almost as old—as me. But it’s great to be here to see—

💬 Dr Duncan Webb: It’s taller.

It’s taller than me. That’s right—very good point. There’s a lot of things which are taller than me, including this bill. It’s probably quite a big one.

But it’s great to be in the House to be talking about a piece of legislation which has put forward the review done under the previous National Government, the work done by the Hon Amy Adams, to update our privacy legislation. These protections which are in this bill are incredibly important to New Zealand, and it is important that they do keep pace with ever-changing technology and the way the world is operating.

It’s important, though, as well, that it does go through due process; so this piece of legislation has gone through a huge amount of consultation from the Law Commission’s report review back in 2011, which recommended complete modernisation by repealing and replacing the previous Act and then bringing this bill in, which reflects new technologies, the way data is stored, the way Governments use it, and providing new provisions around this.

So this piece of legislation will make a number of key changes, one of which will be that it brings in a new criminal offence to mislead an agency in a way that affects someone else’s information, and to knowingly destroy documents containing personal information where a request has been made for it, with a penalty fine of $10,000. These are important changes. It will make important steps forward for New Zealanders whilst protecting their privacy rights. The National Party commends this bill to the House.

The Green Party supports the Privacy Bill and would acknowledge the huge amount of work that the Law Commission did in 2011 with its review and its report, finding that the Privacy Act was essentially—the foundations of it were good, but it was in need of overhaul and updating to recognise new technology and the challenges that that creates, and also to recognise that we’ve got a view now of privacy and the need to protect it that is evolving in the light of new technology. So this bill retains the flexibility that was in the Privacy Act, but the new reforms also encourage agencies to address privacy risks at an early stage, so that citizens can be assured that their data, their information, is protected. The Green Party commends the bill to the House.

Bill read a third time.