Privacy Amendment Bill

Members, when we were last debating this bill, we were up to call number four, which was the ACT Party call. I call Todd Stephenson.

Thank you, Madam Speaker. Yes, it was interrupted on 20 May, so it’s been a wee while since we’ve discussed this bill. But we are discussing the Privacy Amendment Bill. It’s my happy pleasure to speak on behalf of ACT. This was a bill that was before my select committee. It is an important bill, updating some pieces of the Privacy Act; in particular, introducing a new privacy principle to ensure that individuals are properly informed when their personal information is being collected from third parties. It makes sure that public expectations around this information are clear, and we’re operationalising some nice changes.

I don’t want to say too much on this bill, because I think it is pretty straightforward. But I, again, just do want to reiterate one of the important changes that the select committee did make was around ensuring that information, when it’s being used for public good—so galleries, libraries, archives, and museums—wouldn’t be inhibited by these new principles, and there was an exception added to the bill which was accepted. So I’m really very happy to commend this bill to the House and get this new privacy principle in place.

I rise on behalf of New Zealand First to speak on this, the third reading of the Privacy Amendment Bill. It is an important piece of legislation to exercise privacy rights. It is important to have knowledge about the collection of the information when it is not from the source—that is, the individuals themselves. Putting these protections in place will be upholding the individual’s rights to privacy. It is good that there will be a lead-in implementation time, to give that scope to make sure these things are corrected. But in this day and age, it is really critically important that individuals know and have control over the information that is held about them, and you cannot invoke that power if you’re not clear about where this information is sourced from. So this is an important piece of legislation. New Zealand First commends the bill to the House.

The next call is a split call.

Thank you, Madam Speaker. I rise on behalf of Te Pāti Kākāriki to give our support to this bill. It’s always nice when there are bills that come through the House that most of us can support and work together on. The Privacy Amendment Bill was one of the first few bills that came through the Justice Committee at the beginning of this term and it was great to be contacted by different librarians and archivists who have a real interest in making sure that people’s rights and privacy and information are both protected but also treated with sensitivity, and also that when information is within the public interest, it is able to be accessed.

So we have a fairly short contribution to make, like the two speeches before me, to say that we support this bill and that we hope that this will ensure both private information is held sensitively and securely and that people who collect information, such as libraries, archives, and the like, and all of those groups that have been involved in developing this bill, are able to do their jobs. Thanks.

Thank you, Madam Speaker. It’s a pleasure to rise in this final reading for the Privacy Amendment Bill. What I’d like to just comment on is that in this fast-changing digital world, it’s great to progress a bill like this that further protects the personal information of all my neighbours in Takanini. I commend this bill to the House.

Kia ora e te Mana Whakawā. I wouldn’t be dismissive about this bill. It is an important bill, but some speakers in this debate have kind of skimmed over why. This bill is about the collection of information and the provision of it to third parties. I just want to identify what a huge trade that, in fact, is. If we think about it, there is a steady business in trading in personal information—for example, marketing schemes. Your loyalty card that you use at the supermarket is gleaning information which, by using that card, you have agreed can be provided to third parties. So they know what kind of pâté you like with your wine on that side of the House or what kind of toast you like with your baked beans on this side of the House. That can be passed on for marketing information. That’s just one example.

Another example, of course, is credit reporting, where any time you go to a bank or another financial institution or get your Q Card or use Afterpay, you are also agreeing to that information being passed on to third parties for their use. I think we need to recognise that each of us will have, if you’ve borrowed money at all—and most of us will have—essentially, a file held at various credit agencies. That information has been provided by third parties.

Then there’s another one that’s cropped up recently—and I see the Minister of Police in the House—and that is the use of digital images that are gained from, generally, security or surveillance cameras. They are private surveillance cameras—they might be in public places or in supermarkets—but they are cameras where the feed is sent to a central repository, raw, and that data can be filtered. So it will know, for example, what supermarket you were in and when, and what your car number plate is. That car number plate can be tracked. This is what the police have been using it for recently, so that if they know that a suspect was in a particular car, they go to this commercial provider and ask for the information that it has gleaned from its network of cameras, and you can track the car. So this use of third-party information is not without its risks and pitfalls. For everyone to stand up and go, “Oh, it’s a good bill. I want to go home. Thanks very much.”, it isn’t really good enough. It’s not doing our job.

So what this bill actually does is adopt some frameworks and standards which are based on the European Union best practice; we have tended to lean towards the European Union for guidance in this area. It is also important that we do that because our trading relationships and so on rely on that. What this bill does, and the guts of the bill is set out in clause 4, amending section 22, is it provides that where an agency collects personal information about an individual, other than from the individual concerned—so if I want to know what cornflakes you get and I don’t ask you but I ask your supermarket, who has your permission to provide that information—then the agency must “take any steps that are, in the circumstances, reasonable to ensure that [the] individual concerned is aware” that the information is being collected, the purpose for which it’s being collected, and who the intended recipients are, so that when we enter into these arrangements, we actually know that our information can be provided to credit agencies and to marketing agencies.

Of course, when your information—and I do think the surveillance cameras raise real issues, because I’m not sure any of us consent to information about our movements being provided to third parties, including the police. So there is a real rights issue in there; not just of privacy rights but wider rights issues about search and seizure as well. So I do think we’ve got to be vigilant around this. This is actually about vigilance, and this is why we had the museums and archives come to us and say, “Well, hang on. We collect information about third parties all the time but in a very non-invidious way.” It’s not really about them; they’re just on record as having been the collector or the author of particular documents. It’s more for historical purposes. But I think there’s going to be a lot of people out there who, once the Privacy Commissioner starts educating people around this, will get a bit of a fright, because they’ll realise, “Oh, I’ve been collecting all this information”. Essentially, they have been harvesting it, either for not-for-profit purposes or for profit, whether it be an NGO who’s got a social purpose, but they’ve still got to comply with this legislation, or someone who’s getting information, using AI to curate it—for the very best, targeted advertising, is the classic example—and then passing it on or selling it off to someone who can best use it. They’re going to have to buck up their ideas. I think they really will need to know about that.

So that’s why we’re supporting the bill, because it’s actually an important privacy protection. Actually, it’s a bit of a gap in the legislation that’s been there to date, where you could get this information from third parties. So, look, we do think it’s good, but we don’t think it’s trivial. That’s why we’ve spent considerable time thinking about it and improving it through select committee and, of course, committee of the whole House. So we do commend this bill to the House.

I commend the bill to the House.

We take privacy very seriously on this side of the House, and therefore I want to lay out a few reflections and thoughts on this legislation, the Privacy Amendment Bill. Obviously, we’re at the stage, in the third reading, where, I guess, this evening, depending on how things go, it has the potential of becoming law. My learned colleague the Hon Dr Duncan Webb has far more to say and has far more eloquently told you the importance of what this legislation does and why we need it.

As I was looking at the legislation, and as I was looking at some of the commentary and some of the information that prepared us for it, it did mention Transparency International and their critique of New Zealand and the New Zealand Government. Transparency International talked about New Zealand having some of the lowest perceived corruption, and ensuring that members of the public know when agencies have collected or held personal information and how it goes a long way to strengthening that trust, and that this bill is in line with high-quality privacy. Now, in this modern day and age, as the world moves and shifts and changes, there are so many places and spaces, as my colleague has said, where information is gathered. We need to make sure that we know, that I myself as a consumer and I myself as a citizen understand and know, what happens with information about myself—where it goes; who has it—to make sure that my privacy is protected but also that the privacy of my family is protected and the privacy of my community.

That’s why this legislation is here. As has been said, it’s taken its time, it’s come through the House, it’s been through the Justice Committee, and it is here today to receive the approval of this Parliament. Currently, there is no requirement for an agency—public or private—to notify an individual when it collects personal information about the individual indirectly. As has been talked about, things like your EFTPOS cards, things like car registrations—for example, how often do you park at a Wilson car park or other private car parks? In terms of the information you have to share on the machines but also the cameras and the CCTV that is around, that actually informs people of what is going on and what your movements are.

I also think about us as parliamentarians and some of the challenges in some of the spaces that we occupy—for example, our electorate and constituency offices—and the fact that when we meet with constituents about issues that are important to them, sometimes those issues are sensitive. Sometimes those issues do involve law enforcement. Sometimes those issues do involve challenges that they’re facing in front of the courts, etc. So it is for us to make sure that their privacy is protected, to make sure, if there are CCTV cameras outside offices, of what happens when they want to actually disclose, maybe, some serious offending or they want to speak to us about something that has happened in their community or someone of note that needs to see us. We need to make sure that privacy is upheld, that organisations like Transparency International can continue to look at New Zealand favourably and say it’s not only the perception of what we’re doing but it’s also that the laws of this land are in place and are set to make sure that we do have decent privacy.

Now, individuals need to know who has collected their information in order to make corrections to information. Individuals need to know who has collected their information so that they are aware of what is going on in their world, what is going on in their wheelhouse, to make sure that they can protect themselves and their families, as I said. We on this side support this legislation. We think it is practical, it is important, and it is necessary. I commend this bill to the House.

Normally, I’d stand here and talk about how focused we are on making life more affordable and on delivering better opportunities to every family in this country—

DEPUTY SPEAKER: Except it doesn’t fit in this bill.

TIM COSTLEY: —but for this bill, I just want to say I commend it to the House.

Thank you, Madam Speaker, for an opportunity to stand and speak in favour of this bill. Much like my colleague the Hon Dr Duncan Webb, I’m of the view that this is an issue that we ought to give the House’s time to. It’s actually an extremely important issue.

When reviewing the bill—I must admit, I wasn’t on the Justice Committee when submissions were being considered—I thought about how the concept of privacy has shifted over the last 30 years. When we had the 1993 Act in place, I would have been probably about 11 or 12—do the backwards math. But it was in the days when most things were on paper, whether you were interacting with your medical practitioner or with your school. Certainly, in terms of interacting online, these were the days of turning up to school to have your five to 10 minutes playing Lemmings before school. It was a very, very different time in terms of how information was generated, a very different time in terms of how information was held, and a very different time in terms of how information was shared.

So it’s unsurprising that when we got to 2020, we absolutely did need a very substantial update of both how those rules of privacy would operate in a modern world and also the associated penalties, which is where we saw a lot of that reform in 2020. And we’re supportive of this reform as well, because I think the massive change we’re seeing is that sharing between third parties. It is no longer about being sure that you can access and correct information when you hand it over to an entity; you simply can’t always be sure of where that information will end up. So it is absolutely the right time for us to be thinking about this important issue in terms of being notified.

However, like Dr Duncan Webb, I would like to point to a few issues where I’m of the view we need to very closely monitor whether the legislation is sufficient, because I do think this is an area where our notion of privacy will continue to shift and move, but also some of the specific exemptions in the current legislation are drafted quite broadly. I think that the House should bear in mind whether those are being used in the way that we intend them in the coming years.

The first thing I wanted to raise was something that was raised by the Law Society. They raised the issue of the connection between knowledge and control. A privacy right should involve both the ability to know where your private information is but also to have it corrected or deleted if it’s inaccurate. There is a bit of a gap in terms of this legislation coming through the pipeline. There are, of course, administrative and logistical issues in terms of why you wouldn’t want to overwrite an ability to demand that something be deleted; however, I do think that it is a valid gap that was raised by the Law Society, and I would to urge the House to keep an eye on how this plays out and whether that gap creates issues.

The exceptions that are in there at the moment—we have the exception of the individual who has already been notified through other processes. This one’s fine; I think that’s absolutely acceptable, and, of course, there shouldn’t be a double obligation to notify an individual who, essentially, already knows.

The second one is interesting. This is new information privacy principle (IPP) 3A(4)(h), inserted by clause 4. It is where it’s the entity that determines there’s no prejudice to the individual. Now, that is extremely broad in terms of the judgment that we’re handing over, for an entity to decide whether there is no prejudice to the individual.

The third one is where it’s not reasonably practical to do so. Now, the rules are helpful, and they state that this goes beyond inconvenience or cost. The burden must be clearly disproportionate; however, there is still a subjective element there, and I do think this is another thing that, of course, we would expect the Privacy Commissioner to be monitoring, but the House must as well.

Then there are additional exceptions which apply in a more limited context. The one that I will note is where notification would undermine the purpose of collection such as an internal investigation. Now, we need to think carefully about that, because these are circumstances where an individual is potentially under investigation by a third party whom they did not share their information with, and the exception here is applying to those circumstances. I think we need to be very cautious about how this might play out in terms of employment scenario and how it might play out in terms of law enforcement scenarios as well.

There are some useful protections within the legislation, having framed some of those broad provisions in terms of decision making. One of them is that the agency should maintain a documented basis for relying on their exceptions. So they can’t rely on an exception and expect it to hold for the end of time; they have to continue to justify that exception. I think that that’s correct.

Another concern I have is the direction that the commissioner should only be notified where there is a risk of serious harm. So we’re coming into the territory of determination again. We’re, essentially, creating a set of rules, which are great. We’re adding additional protections to privacy. But we’re creating huge discretion that we’re placing in the hands of entities to determine when those circumstances happen. So you’ve got the Privacy Commissioner there, and we’re now saying, “only instances where the entity thinks there’s serious harm.” That’s one layer of the problem.

The second layer of the problem, in terms of access to justice, is that when people make a complaint to the Privacy Commissioner, they don’t have an automatic right to go to the director of the Office of Human Rights Proceedings—the Privacy Commissioner will make a referral. From what I can see, the referrals from the Privacy Commissioner are fairly few and far between. You might have one or two cases progressing every year. Unless you can afford to take your own case through that channel, you’re relying on getting through several more hurdles before you can actually have your case heard by the director’s office and then brought before the tribunal.

Your next barrier is actually being heard by the Human Rights Review Tribunal. If you’ve got a complaint—“my privacy has been breached”, “someone’s breached the Act”—you go to the Privacy Commissioner; maybe one or two are referred to the director’s office for pro bono representation, and you’re then facing a one- to two-year delay, potentially, before your claim is heard. Now, my issue here is that in this year’s Budget, that timeline is, potentially, much worse, and it’s because we had six decision makers at the Human Rights Review Tribunal—two chairs, four deputy chairs. In this year’s Budget, those four deputies have been taken away—their roles have not been renewed, new appointments have not been made. Essentially, we’ve gone down from six decision makers to two decision makers. If you want to have your privacy issue heard, you may be waiting for several years to have that issue heard.

My point here is this: we commend the fact that the Government are looking at developing the right to privacy in accordance with what we’re seeing happen in our world—that we have departments and entities who are interacting with each other more. We’re looking at an online world, and we’re very much going to need to develop the right to respond to that as well. But the development of the right and legislation alone doesn’t allow people access to justice, doesn’t allow people to have that right upheld. If you change the right but you remove access to justice—you take decision makers down from six decision makers to two decision makers—you have a bottleneck in terms of accessing the right to privacy.

So I just urge the Government to think through the full scope of access to justice when they’re thinking about the development of a right, whether it be privacy or another right, and ensure that not only do we have adequate provisions for the right to privacy but that we’re monitoring how it plays out, that we’re monitoring the discretion that we’re giving, that we’re monitoring whether we should be developing that right in accordance with what we are seeing in terms of the EU, and that, fundamentally, we’re funding our courts and that we have the appropriate number of decision makers to ensure that people truly have access to justice.

For people in Mount Roskill, this bill is a critical step towards protecting our privacy and ensuring fairness for all New Zealanders. I commend this bill to the House.

Hon Kieran McAnulty: Madam Speaker?

The Hon Kieran McAnulty won that race by—I guess we can’t call it “by a nose” in this House, can we? But this is the race for the Te Pāti Māori call. I call the Hon Kieran McAnulty.

Thank you, Madam Speaker, and I appreciate the reference; of course it is a horse racing reference and that is my background, so thank you for saying that. I certainly do not have the background of my esteemed colleagues. I guess, you know, it makes someone a little bit self-conscious when you’re following a professor of law and a distinguished human rights lawyer in Glen Bennett, who contributed to this speech. But at least they contributed; it has been a pretty dismal display from the Government, really, to be honest. They’ve certainly earned their pay cheque today, standing up and saying, “I commend the bill to the House.”, and then they sit down.

But this bill does deserve commentary, and before I do provide some comments on this, I want to acknowledge that, very shortly, a member of this House will be doing their valedictory speech, based on a decision that they’ve made for their safety and the safety of their child. I think that situation should give us all pause for thought—every single one of us in this House, and, indeed, every single member of this country. I think it is a significant moment in the history of this Parliament, and it is a very sad moment, frankly. I wish Benjamin and their whānau all the very best after this moment.

This bill, ideally, would be a situation where the public could see that both sides were cooperating. It is indeed an example of that. Many people, as my mate Duncan Webb pointed out, would be quite surprised that the provisions in this bill that the bill proposes aren’t actually already in place. I would count myself as one of those, frankly: I would have thought that what’s being proposed are pretty basic provisions, really—that people should really know who is collecting that sort of information about them and what their rights are and what they are able to do about it. I do think it is lamentable, though, that we aren’t actually giving the public of New Zealand the opportunity to understand the amount of work and the amount of collaboration that’s gone into where we are in this bill. So often, the proceedings of this place and coverage of politics is portrayed to be adversarial, but, actually, more often than not—well, certainly more often than people are made to realise—there is collaboration in Parliament, and this is an example of it, because, of course, there isn’t much in here that would warrant opposition to it.

My colleague Vanushi Walters pointed out some very sage points of concern, but it doesn’t warrant strong opposition to what’s being proposed. But it does send a warning that we need to be very careful about how we go about this. The fact is that not just with the digitalisation but, in large part, because of it, and all of the things that we have on our phones—the various apps, the shopping cards, everything else, whether it’s your Air New Zealand app or whatever; everything we use to go about our daily lives—collects information. So often, when we just go about our daily business, information about us is being shared, and we don’t know about it. That is actually quite extraordinary.

So it is only right that the bill proceeds and that New Zealanders are given the opportunity to understand who has what information, who is sharing it, and for what purpose, but, more importantly, the rights of the individual related to that, which they have if they want to look into it or do anything about it—or indeed correct the information, because the information that’s being shared might not be accurate, and that’s a concern as well. But we’ve all seen it—various things: it might be social media, it might be all sorts of other things, we might start to get targeted mail; we might start to get targeted advertisements because they’ve been monitoring what sort of garden tools you like that you’ve been searching for, or whatever.

I’ll tell you what: the thing is that when there is an exemption, there needs to be a good reason, and I think, in general, what the bill proposes makes sense. But I do want to echo the concerns raised that, of course, when things of national security are at threat, there should be an exemption. But who decides that? According to this, it’s the agency themselves, and if they are abusing that exemption against the intention of the law, how does an individual have the opportunity to know that, and how long will it take for them to find that information out? I think it’s a valid question, and it’s one that actually deserves ongoing oversight. Yes, this bill is good; yes, we support it; but there are still some questions.

Motion agreed to.

Bill read a third time.