Statutes Amendment Bill

Members, we come now to Part 31, the debate on clauses 124 to 134: “Amendments to Privacy Act 2020”. The question is that Part 31 stand part.

Thank you, Mr Chair. I want to start by just checking with the Associate Minister of Justice on clause 126, which amends section 27. Essentially, it’s saying that information privacy principals 5 to 12 aren’t applicable to an individual who is holding information for the purpose of that individual’s personal or domestic affairs. Recognising that for those particular principles, a lot of the time it does refer to when an agency holds personal information, but from a different perspective, how would that work when that person is holding personal information for individual use or domestic affairs? It’s like placing their personal—well, not so much personal information, but I guess their personal information, on a social media platform. How would that work in terms of them retaining the privacy of that information? In the age of social media, sometimes one could argue that you’re putting stuff on there for personal use, but some will argue that while that’s why you’ve put it on there, it’s now available publicly. So I just wanted to check in terms of the breadth of individuals’ personal or domestic affairs.

Thank you, Mr Chair. The proposal in clause 126, which is amending section 27(b)(ii), is really just to correct an omission. This personal information was never intended to be within the scope of a complaint to the Privacy Commissioner or proceedings in the Human Rights Review Tribunal. This proposal restores the policy position in the Privacy Act 1993 that was intended to be retained in the Privacy Act 2020.

Thank you, Mr Chair. I’m sure my friend Rachel Brooking will have something insightful to say shortly. I just want to talk about both clause 131 and clause 132 because these relate to the Privacy Act. Clause 131 relates to the procedure after completion of an investigation relating to access to personal information, and then clause 132 relates to the procedure after completion of other investigations. The Privacy Commissioner has looked into something, and the question is, well, what do you do next?

One of the things the commissioner must do under the current framing is to seek for the parties to resolve the issue by settlement, mediation, or whatever, if the investigation shows the complaint has substance. So that’s a mandatory direction. What these two amendments do in clauses 131 and 132 is insert “and [the commissioner] considers it appropriate to do so”. So no longer is it that if the complaint has substance, you must seek to resolve the issue; it’s that if the complaint has substance, you can, if you want, seek to resolve the issue, and that’s a significant watering-down of the rights of people who are the subject of privacy breaches and other investigations.

I’m a little concerned because these provisions relate to steps that the commissioner is required to take if the complaint is found to have substance. In particular, under the current section 91, they’re required to seek settlement of the complaint, or seek an assurance that the breach will not reoccur—that’s subsection (4). This amendment would make that subject to the discretion of a commissioner. The question is whether it’s appropriate once it’s been established that the complaint has substance that such a discretion exists, and that’s the same in the respect of situations where there’s another investigation in respect of some other matter, as well.

Thank you, Mr Chair. To the member, I say that this particular change will give the Privacy Commissioner the discretion to use best endeavours to settle or seek assurance across all complaints he receives, providing consistency across the Act, and the commissioner is not required to seek settlement or assurance where the conduct of the parties to a complaint would render this effort futile or a waste of resources. Sections 77(1) and 83(2) already give the Privacy Commissioner the discretion to decide whether to use best endeavours to secure a settlement or assurance while he is investigating a complaint.

Thank you, Mr Chair, for allowing me to make a contribution in this committee stage. I want to note that the Minister is answering all the questions, and thank you for doing that.

An earlier question from my colleague from the Greens was about clause 126, and the Minister’s answer referenced 132(a). I note that the select committee report also references 132(a), and I would like the Minister to tell me if I’m right or wrong: that this seems to be one of the more substantive parts of these changes to the Privacy Act, and it is to enable that six-month period to be widened to include any related—if there is more than one matter going on, then the six months goes from the end of the final matter. So that seems to be a good change to be making. So, one, if I’m right if that’s the major policy change here.

Two, if she could explain how that relates to the changes at clause 125 and also clause 126. So if we go back to clause 126 which we talked about earlier, the wording is changed around from the principal Act and it’s now about whether or not “(ii) received by the individual unsolicited; or (iii) created by the individual.” If those changes relate to the changes at clause 132.

Further to that, going up to clause 125. This is the replacement of subclause (1)(e) and some of it is very similar. So you “believe on reasonable grounds that B is subject to privacy laws of a prescribed country…”, but the bit that is new is this: “and the disclosure is not precluded by any limitation or qualification prescribed in respect of that country under section 214(3);”, and 214(3) doesn’t change. That relates to “A country may be prescribed…” based on the type of foreign person or the type of personnel.

I was just wondering if the Minister can tell me if these changes relate back to clause 132(a) or if they’re totally different and it’s a different sort of tidy up.

Thank you, Mr Chair. The member may not have been in here when I just answered the question more recently on clause 126, so I’ll just abbreviate and answer again.

Hon Rachel Brooking: No, I was.

Hon NICOLE McKEE: OK. So what these are are just small, minor technical amendments on clauses that affect—there’s no rolling effect of one will affect another unless there is a change that specifically makes an effect on a different clause, if that makes sense. So with clause 125 for example, that amendment clarifies that information can only be disclosed when consistent with section 214 of the principal Act. The Act requires that information shared with prescribed overseas countries—countries with broadly similar privacy protections to New Zealand—are subject to any limitations imposed when the country is prescribed.

However, the wording of IPP 12(1)(e) does not mention this and creates uncertainty. That’s why we’re making the changes to clause 125, because of that uncertainty.

And then, of course, clause 126 was correcting an omission and the proposal restores the policy position in the Privacy Act 1993 that was intended to be retained in the Privacy Act 2020.

And then clauses 131 and 132 is giving the Privacy Commissioner some discretion as to the best endeavours to settle or seek assurance for that settlement.

So the only time that you’ll see the rolling effect is when we make one change that actually influences or has a minor or non-technical amendment to something else. But really these are all just tidy-ups—individual tidy-ups.

Just further to that—thank you, Minister. I was in the Chamber for that discussion of clause 126 and I might have misheard the Minister. So the point is that 132(a) is the most important change and then everything else is some unassociated other tidy-up, or it could relate to 132(a). I think I just heard the Minister say that those changes to clause 125 and clause 126 not related to the change at 132(a) and they are their own separate tidy-ups, is that correct?

Correct. Clause 125 is a clarification, clause 126 is correcting an omission, and clause 131 and 132 is giving the Privacy Commissioner discretion.

Part 31 agreed to.

Part 32 Amendments to Public Service Act 2020