Privacy Amendment Bill

This is an interrupted call; this is a Labour call.

Thank you, Mr Speaker, for the opportunity to say a few words on the Privacy Amendment Bill. It’s been quite some time since we last spoke about this bill in this debating chamber. As you quite rightly said, it was interrupted and several contributions had already been made. But it’s one of those bills that went through the Justice Committee, and there were several submitters to the bill. In itself, when you look at it, it seems relatively straightforward but the theme of it was quite nuanced because—as with many pieces of legislation—there were some potential unintended consequences that could arise from some of the more bespoke applications of this particular piece of proposed legislation.

The Privacy Amendment Bill, at its heart, obviously seeks to adhere to and to uphold the fundamental concepts of privacy which, obviously, are incredibly important in a well-functioning democracy that holds those tenets very—well, in high esteem, really, because they’re fundamentally important. So it’s incumbent upon this House to make sure—and this Parliament to make sure—that when amendments go through to the Privacy Amendment Bill that not only is it doing what it says on the tin, but it also doesn’t have those adverse, unintended consequences that could easily arrive.

So the Privacy Amendment Bill, as we said, amends the Privacy Act 2020 to improve the transparency for individuals about the collection of their personal information, and to better enable individuals to exercise their privacy rights at the same time. We commend the bill to the House.

Thank you, Mr Speaker. I rise on behalf of the Greens to also speak on the Privacy Amendment Bill. We do support this bill and we did have quite a nice engagement with the Minister of Justice during the committee stage.

I think, again, just to recap in terms of the context of this bill, the Privacy Amendment Bill introduces a new information privacy, and this is particularly under new IPP 3A, which is mainly about agencies and collecting personal information from other sources. So it’s very much something that is for a third party when it comes to information collection. Some of the context when it comes to the collection of the information—we’re looking at how the information has been collected, the name and address, the purpose, the intended recipient, and also the rights of the individuals relating to access, and the correction of that information.

Fundamentally, a lot of this bill, in terms of information, is already something that we see in terms of the Privacy Act refresh in 2020. But one of the things that was addressed and has been picked up on subsequent to that is the fact that IPP 3 doesn’t quite cover the extent that we would like to cover, particularly when it comes to third-party collection of information.

Now, in terms of the committee stage, there were a number of issues that we were kind of exploring. I think the first thing is the fact that when we are looking at this, at that stage when the debate was going through the House—and this was a little while ago, bear in mind—we do see the fact that this particular legislation is coming into force, and particularly Part 1, on 1 June this year, and even though a little while ago, when we thought that this bill was going to go through the House a lot sooner, one of the questions we did ask is whether there is sufficient time to actually implement this bill, because one of the things that the Privacy Commission will have to do is to be able to socialise and communicate the new intent and to be able to draft those kind of things and be able to distribute it, also in multiple languages, to people within the communities.

So now the question is raised again that we have to delay this particular bill and the legislative agenda over the last few weeks—in which case, is there actually sufficient time to introduce this bill as it was first intended when Part 1 was introduced through its first reading? And that concern of the feasibility of the implementation is something that we do kind of consider to be something that everyone should keep an eye on.

In terms of the substantive part of Part 1, some of the things that we discussed—and this is, again, things that we’ve discussed when we were looking at the consumer products and data bill—were around the interaction between how data is kept locally and also how data is kept internationally. Through that debate, one of the things that we did ask the Minister about is around the use of the collection and how our international free-trade agreements (FTAs) and the comprehensive economic partnership agreements may play a role in some of this, both in terms of productive but also counter-productive to our domestic legislation around data protection and also privacy.

Now, one of the things that is really, really important when we’re looking at, for example, the context of the EU FTA and the use of privacy regulations is that the EU FTA has a really stringent and very robust data-protection legislation, which is something that we are mirrored on, something that the refresh of the Privacy Act in 2020 was largely looking into, as well. So we weren’t so concerned in terms of some of them, but the concern fundamentally comes from other trade agreements that we have. For example, in terms of the Comprehensive and Progressive Agreement for Trans-Pacific Partnership, there is no requirement when it comes to local legislation or local authorities to be able to request information from international tech giants, for example, when it comes to a copy of the source code that we do see here in Aotearoa, indeed, partially because of the fact that for some of those source codes, we do not need to have a local domain for it. Therefore, it is hard for us to even find a way to hold them accountable under domestic legislation.

Part of the conversation and discussion that we had with the Minister at the time was around how we, again, see this piece of legislation and our Privacy Act interact with certain trade agreements where we have allowed big tech overseas to be able to sue us for, potentially, competitive measures which—you know, any sort of updates to the Privacy Act or to consumer or data protection can potentially be construed as such, because we have seen some of those tech giants suing other countries and Governments for increasing their regulations around this area as anti-competitive measures. So something like this fundamentally is about what sort of conversations we have had in introducing new bills on data protection, and also on privacy in the context of our international agreements.

When we are looking at some of those, as well, I think, fundamentally, one of the things that was very heartening that we’ve heard from the Minister over and over again, both in terms of this bill and other related bills, is the fact that we, as consumers, or we, as people in Aotearoa, should be able to have control of our own data, and we should be able to know where our data goes and make amendments and adjust that kind of data under the Privacy Act or under consumer data protection. In that sense, with this piece of legislation—and while the Minister’s intention is very heartening for me, both from the position of being the Greens’ justice spokesperson but also the trade spokesperson, in terms of being able to potentially push back on some of the challenges we may potentially see internationally when we are looking at big tech and tech giants being able to hold us to account for some of the anti-competitive measures here. So, in that sense, this is a really, really important thing to address, and we did have quite a robust discussion during the committee stage around this.

Another angle to discuss—and it was one that we did explore during the committee stage—was around the idea of liability when it comes to things like hacking, etc., because, again, when we’re looking at the third-party collection of information, it’s really important to also know what some of the potential risks are that come with that. As we see with some of the latest reports coming out of the Privacy Commissioner and also the Privacy Commission, the way that we collect data and the way that we address it when something doesn’t go well is something that we haven’t quite perfected, even with the latest legislation on the Privacy Act in 2020, and now we’re putting on a new spin in terms of third parties. So what that means when it comes to having that level of liability and having that level of safety when we are now introducing this new legislation—again, this comes back to the fact that although we support this bill, we simply don’t think that some of these will be able to be teased out by 1 June 2025. So those are the bulk of concerns about Part 1.

Now, moving on to some of the discussions we had during the committee stage on Part 2, particularly when we’re looking at clause 13, “Section 49 amended (Protection, etc., of individual as reason for refusing access to personal information)”, some of the disclosures of information that we are considering are around the use of social media, and, again, how social media is able to be held liable for some of the third-party access that we are seeing here. Again, if a company uses social media or online platforms as a form of collecting other people’s data, what are the sorts of precautions we have when it comes to that particular provision?

Overall, the Greens do support the Privacy Amendment Bill, but, at the same time, I think there are a lot of interesting things, and we would like to see how this bill progresses and how the legislation is going to be introduced. But, fundamentally, when we’re looking at the values of the Privacy Act, it is really, really important that we do put the privacy of our people first and foremost, as opposed to, potentially, being consistent with some of our international obligations but not being able to be held accountable to or being challenged by some of the tech companies, particularly when it comes to third-party liability or third-party data collection agencies. With that, we support this bill.

This debate is interrupted and is set down for resumption next sitting day. The House stands adjourned until 2 p.m. tomorrow. Goodnight.

Debate interrupted.

The House adjourned at 10.03 p.m.