Privacy Amendment Bill

Members, the House is in committee on the Privacy Amendment Bill. We begin with debate on Part 1. Part 1 is the debate on clauses 4 to 9B, “Substantive amendments to principal Act”, and the Schedule. The question is that Part 1 stand part.

Thank you, Mr Chair. It gives me great pleasure to be in the chair for the Privacy Amendment Bill wearing another hat. We sat through this on the Justice Committee, so it’s very interesting to be able to be back and to consider this bill.

I just thought I’d very quickly touch on what Part 1 does. So Part 1 is where the substantive amendments to the principal Act are contained. It is, I guess, the guts of the bill. It also, in clause 9, amends Schedule 1 of the Privacy Act. So Part 1, the gist of the bill is that it introduces a new information privacy principle, IPP 3A, into the Act, which relates to the indirect collection of personal information. It is closely based on IPP 3, which is related to information that is directly collected from individuals concerned. So this deals with a situation where information is collected not from the individual but via a third party.

Under new IPP 3A, an agency will be required to ensure that the individual is aware of a range of matters when collecting that individual’s personal information indirectly. That includes the name and the address of the agency, the purposes for which the information’s collected, and the rights of access to and correction of the information. It effectively reflects IPP 3.

The new principle is designed to minimise compliance burden for agencies while increasing the protection for individual’s privacy at the same time. For example, the requirement is subject to a number of practical exceptions to ensure the efficient administration of certain public functions and to protect against other unintended consequences. The committee, during the select committee stage, considered some submissions from what is known as the GLAM sector—galleries, libraries, archives, and museums—for exceptions to their procedures and processes around archiving and, essentially, establishing exhibitions in museums which were eventually accepted by the committee and by this House at second reading.

The most significant change to the bill, as introduced, was that exception to the GLAM sector, but for other submitters who made submissions around how this may impact compliance costs and burden their businesses, there were other exceptions in the bill which could address those concerns.

There is an Amendment Paper tabled to extend the commencement date for IPP 3A to 1 May 2026. This extends it from six months to a year. That just ensures that agencies have enough time to prepare the new requirements. We can discuss that when we get to the commencement clause.

Just finally, clause 9 of Part 1 amends Schedule 1 of the Privacy Act, which deals with those transitional arrangements. Very briefly, that new Part 2 would be inserted into Schedule 1 to provide that IPP 3A does not apply to personal information collected before, on, or after the commencement date of Part 1 of the bill under an approved information-sharing agreement or an information-matching agreement that is in force immediately before this date.

Thank you, Mr Chair. It’s a little bit of a surprise to see the chair of the Justice Committee in the chair in a different capacity. I would have thought he might want to actually query the Minister of Justice, but then again, perhaps a little tricky.

Rima Nakhle: Wow.

Hon Dr DUNCAN WEBB: Well, I do find it quite unusual. But I am keen—for the record—for the Minister for Hunting and Fishing to express his views on some of the kind of scope of this new privacy principle. It has, essentially, been imported from the EU for good reason, because we need to have an international framework for privacy so that organisations can work in a cross-border way. So in the spirit of a to and fro, I’m interested particularly in the exceptions, because the principle itself is pretty well expressed and clear in new section 22(4), inserted by clause 4. The new privacy principle 3A has a long list of exceptions, and it’s actually the first one that I’d like the Minister to address in the first instance because it seems to me to have a degree of subjectivity to it, which is that non-compliance is not required if it would not prejudice the interests of the individual concerned.

The difficulty being that the individual by definition doesn’t know that the information is being shared. The classic example we see is loyalty schemes and so on, where you get your Everyday Rewards card and they collect all kinds of information on it. They know what kind of biscuits you like, and so on and so forth, and they have your email address. So they can provide that email address, for example, to an online biscuit shop who can send you your favourite specials for your favourite Toffee Pops.

Now, it may well be that the person who receives the information thinks that it’s not prejudicial. I’m just wondering what the threshold for prejudice is. Is marketing information prejudicial? Is data harvesting not for personal uses, but to understand population trends; is that prejudicial? I do think that’s actually probably the biggest carve-out. The danger, I guess, and the reason I’m inviting the Minister to kind of put on the record what is intended by this is the danger is that the people who receive information will take a large and liberal interpretation of what is permitted and a narrow interpretation of what is prejudicial. So I think it’d be really interesting to hear the Minister’s comment on that.

Thank you, Mr Chair. In a similar vein to some of the questions we asked previously when we were discussing particularly around the Customer and Product Data Bill and the fact that we are requiring agencies or requiring companies to comply, essentially, with our Privacy Act—today, we’re here discussing new information privacy principle 3A as part of this. I think I want to ask similar questions to the Minister for Hunting and Fishing, first and foremost, around the interaction between our domestic privacy legislations and how it intersects with some of the broader international best practices, but also the broader international commitment around this. I think, previously, we’ve heard from the Hon Dr Duncan Webb around the fact that this largely is following in line with what the EU is doing in terms of privacy, which, by the way, is one of the golden standards when it comes to privacy protection, as opposed to, for example, the US.

But I want to check here two questions in terms of this new principle broadly, and I’m sure we’ll drill into specific content of clause 4, which is the bulk of this. The first question is whether, currently, the agency that is here fulfils the same definition under section 4 of the Privacy Act 2020 that you require? The agency is defined as both a New Zealand agency and an overseas agency, as well as an individual. If it’s the same consistent sort of definition, then we can go from there and then look at the parameters of some of that. Looking at 3A more broadly and looking at page 5 of the regulatory impact statement, which is a nice diagram, if we’re looking at “Individual B”, who under the current legislation must be informed by “Agency A” when they are disclosing information, we’re telling how the information should be used. But when “Agency A” passes that information on to “Agency C”, no notification is required, which is what this bill is hoping to address.

However, because often we assume “Agency A”, in this case, is, let’s say, a company or an agency, let’s use the Ministry of Health or Ministry of Education as an example. We would naturally assume that one of those agencies, or a particular company, is that “Agency A”. However, when they use our data-collecting software that is outsourced to an overseas company, let’s say Google or Microsoft, are those software companies in fact “Agency A”, and then the ministry or a company or anyone else is “Agency C”, or are we looking at overseas companies such as Google or Microsoft as “Agency C” in this case? Therefore, this bill would allow those agencies, such as those overseas big tech companies, to also, in some ways, inform “Individual B”, in this case, of how their data might be used under, let’s say, section 4(1), and all of the concern and also awareness as listed there.

One of my first questions is: how does this reconcile with the fact that we are seeing more and more outsourcing of our data-collection software internationally as opposed to domestically? What is the agency in that sense? I’ll leave that for now because I know that that’ll form the basis of my subsequent questions.

Thank you, Mr Chair. I’ll try to address Dr Webb’s questions first: there is a difficulty with the example that was used, because, under that situation, where a rewards scheme collects an email address and then proports to pass it on to a third party, they would only be able to collect the information under information privacy principle 3 in the first instance, with the appropriate usage or disclosure intentions being made aware to the person the information is collected from.

Assuming that is the case—and that’s covered by subclause (3), which is that you are not required to take the steps referred to in subclause (1) if the individual concerned is already made aware of it—if you’re the rewards company and you are collecting someone’s email address and you intend to pass it on to a third party, you would be required to tell that individual in the first instance in order to pass it on, which would then be covered by subclause (3).

I think the example doesn’t quite work in that situation, but the core of the question was: what does “prejudice” mean in this instance? There are two parts to it: one is that it requires a belief on the agency, on reasonable grounds, that it would not prejudice the interests; so that is a subjective belief but with a reasonably objective test, and there are various definitions, or case law, throughout the statute book about what prejudice would require, including within the Privacy Act itself. So I’d refer the member back to those previous definitions.

In terms of the questions from Lawrence Xu-Nan—is the agency in section (4) the same as in the rest of the bill—yes, the definition is to apply the same. Just generally, are overseas companies subject to the Privacy Act? If they are carrying out the course of business in New Zealand, they are subject to the Privacy Act. I think, in the situation you are referring to, it is the question of whether or not Google or Microsoft Word or a cellphone is collecting information itself or whether it is an agent of the agency collecting information, and I’ll seek some more advice on that. But my assumption would be that the “collecting agency” would be yourself and that a piece of software that you’re using to do that—say, a Google doc or a Google survey form—is just a mechanism by which to collect the information; so it’s not the agency itself.

Thank you to the Minister in the chair, the Hon James Meager, for that answer, because I think that does actually land very nicely into my second question around what it looks like. I understand where the Minister’s coming from, that let’s say we’re filling out a Google form or a Microsoft form, that the agency itself is the person who drafted the form, but the medium or the mode that is being used to process the data may not be the agency that is collecting it. However, we also know that, for example, Microsoft or Google—I’m going to use those two examples because they are universally understood—are also the ones who keep that information. That’s how you get the backup system, etc., and are able to retrieve that from their data-processing centre. I just want to know: does this bill allow greater scrutiny and accountability of big tech, for having to declare some of those to the person whose data is being collected?

Now, the reason that I am focusing on this in particular—and when we’re looking at, for example, what needs to be declared as part of clause 4(1), you know, it comes into the broader understanding, and we talked about this yesterday as well, which is that people in Aotearoa want to know that this is our data and we would like to know how our data is being used and being processed. We heard that from another Minister as well. But the fact is that often we don’t know how data is being used and being processed by large tech companies. So, in this case, if the large tech is being held accountable in the same way under new information privacy principle 3A (IPP 3A) in section 22, amended by clause 4, and then they are liable to let us know, in particular, the purpose that the information has been collected for, that potentially can be huge. If that was the case, and the collecting agency and the big tech have that level of accountability or scrutiny, I then want to check with the Minister—for the purpose of this particular bill as well—has the Ministry of Foreign Affairs and Trade (MFAT) been consulted in terms of our current trade agreements, particularly when we’re looking at the Trans-Pacific Partnership and the Comprehensive and Progressive Agreement for Trans-Pacific Partnership, among others—noting that the New Zealand - European Union Free Trade Agreement is actually very good about this—and whether that fulfils our requirement under the digital trade chapter of those international trade agreements. Because, again, there are certain obligations, that we have, unfortunately, signed up to, in those trade agreements that actually prevent us from holding certain big tech accountable, including how our data can be used offshore.

So I just want to check with the Minister in terms of getting clarity that in that case, does that mean that Google or Microsoft, for example, are required to also fulfil the requirement of IPP 3A under section 4(1), and, if they do, then has that been consulted with, for example, MFAT to ensure consistency with our existing trade agreements?

I understand that the legal obligation for compliance with the Act lies with the agency doing the collecting. So if there is an agent acting on behalf of the agency, the responsibility ultimately lies with the agency itself—so the individual or the company doing the collecting—and there are various protections in place under the existing Act to deal with that. It’s probably a little bit confusing, but in that situation there is no third party involved: the agency doing the collecting, yourself, and the mechanism by which the collection is happening, the survey, are one and the same, and the legal obligations lie with the agency itself, not the provider or the individual.

I’m advised that the Ministry of Foreign Affairs and Trade were closely involved in the development of the policy, including discussions with the EU during their adequacy status review, and they’re comfortable with where the law is sitting. Just for the avoidance of doubt, the Act does apply to social media companies. They are expected to comply with this where they are the ones doing the collecting themselves. The Act is technology-neutral, so the method of collection has to apply generally with the information privacy principles (IPPs) that already exist, including with the current or the proposed IPP 3A.

Thank you very much, Mr Chair. Look, I had a question in relation to—I think it’s section 22(5)(a), inserted by clause 4, in relation to the carve-out of the agency collecting “personal information for the purpose of determining whether the information is of enduring value for general public interest and should be archived for public reference, study, or exhibition”. I know that this was a hot issue during the Justice Committee, and we had various submitters who were concerned that this might curtail their ability to do archival work, particularly studying things like whakapapa and family heritage and having the ability to go in and look over those past records that may contain issues or details around personal privacy. I’m just interested to know from the Minister for Hunting and Fishing if he believes that the concerns that he was present for and saw at the committee are adequately addressed by the provision here.

I would also note that under (5)(b) it stipulates that “compliance is likely to seriously impair the agency’s achievement of the purpose”. So just to check that we’re not concerned that there are any prohibitive restrictions on the ability for that important work to happen that will be capturing history and is now more important than ever given we live in an age where facts can be manufactured. The work of historians and those people who go back through time is probably more valuable than ever.

That’s a good question. It’s probably helpful to outline an example for this case, and the exception applies to what we were told, and I learnt, was the GLAM sector—and that stands for “galleries, libraries, archives, and museums”.

One of the examples given during the select committee process was around something akin to, say, a Hillary exhibition, where hundreds or thousands of photos are collected and provided to an archive or a museum for exhibition purposes. Now, without an exception, there is an argument that every individual that can be identified in each of those photos would have to be notified that their information is being collected, by whom, and find an address for each of those individuals and go through a significantly substantial pre-checking process before you actually get to the point of putting the photos up. That would seriously impair the purpose of the project in the first place, which is to display a series of archives or photos.

We’re very comfortable that the exception provided allows those GLAM sectors to undertake the valuable work that they do in the interests of the public, and we also consulted with Government agencies involved with the GLAM sector, and they support the drafting that’s involved there as well. It’s very similar to the drafting of exceptions that exist in other jurisdictions’ legislation to provide similar kinds of exceptions. And then, when we’re talking about meeting the concerns of similar submitters who didn’t quite get the express exception, there are other protections in place under section 22(4). That was referred to previously around when non-compliance might not be necessary.

Thank you, Mr Chair. Thank you to the Minister for Hunting and Fishing for your answers. In particular, I think it’s important to note that in this case if it’s the social media company themselves doing it, like the Minister has mentioned, that they are also held liable under the new information privacy principle 3A (IPP 3A).

I do have an example that I want to seek the Minister’s guidance on. This is particularly to do with this particular bill was introduced because we identified that there was a gap in the way that we look at, let’s say, third parties or potentially when there are two different agencies involved or the information is passed from one agency to the other. I’m just checking with the Minister whether there has been any consideration around other aspects where information might potentially be—other IPP where this might also be a factor. So to give an example—again, I’m using the fact that we are currently at an age where the way that we collect data electronically is often done through a third-party provider, usually one of the big tech companies, but in terms of this when, let’s say, you mention that although they are collecting but they’re not an agency who collect it—however, I would like to know who would be liable, for example, in an instance where the software or the holder or the retention of that data has been hacked due to lack of maintenance on the part of the software programme and on the part of the software provider, as opposed to the agency in this case, because, again, there are two parties at play here. Would the liability lie on the agency itself or would the liability lie on the software provider? I think that that is also a consideration when we’re looking at how the IPP should be interpreted today in the digital age, essentially.

Another question I have for the Minister is in section 22(4) inserted by clause 4, and this is to do with when an agency doesn’t need to comply with the requirement under paragraph (a). I just wanted to—and one particular term sort of stood out to me, and I would like to see if the Minister wouldn’t mind providing an example of this; what does it mean when they say that “if the agency believes, on reasonable grounds, (a) that non-compliance would not prejudice the interests of the individual concerned;”? So then is it up to the agency itself to determine the interests of the individual to decide whether compliance is required?

I’ll try and address the first one because it seeks, in essence, a legal opinion on where liability will lie, and it’ll depend on a case-by-case basis. Issues arise when you talk about negligence under contract compared to the actions of the agency making the collection itself, so I’m wary of providing a legal opinion on where liability will arise, apart from the fact to say that the legal obligations sit on the agency doing the collecting, whether that is directly or indirectly, and other contractual relationships that sit underneath that may well have vicarious liability or not. But from the Act’s perspective, obligations are with the agency doing the collecting.

The question about prejudice to interests: one example in order to undertake non-compliance would be you would have to notify the individual concerned. Now, if the agency making the collection considered that non-notification to the individual wouldn’t actually prejudice their interests, because perhaps the information being collected was contained in an internal or closed system, that may well be justified. But, again, it’s a subjective test based on a reasonable standard, which would be subject, probably, to fleshing out by either the Privacy Commissioner when they received a complaint or through the Human Rights Review Tribunal under some sort of privacy proceedings, should they be able to get through in a timely manner.

I move, That debate on this question now close.

Look, I’m just interested because, as some of us know, there was some discussion by commercial providers who didn’t manage to get—and started talking about what’s not in the bill, in some ways. I do think it’s important because they made a quite comprehensive submission. These are the commercial providers who, essentially, deal in information, so they actually have a business—particularly mobile phone numbers in today’s world, but also email addresses. I know the Minister for Hunting and Fishing alluded earlier to rewards cards and so on and the use of email addresses there. The point was made that it will be costly and onerous for these commercial providers who have permission to hand on the information, and in other cases to receive it—it will be very costly for them to conduct their business in a way which is compliant with this Act.

It would be good, again, in some ways, for the record to explain why, in terms of the exceptions we’re finding in this clause, that an exception wasn’t provided where person A who has consented to the sharing of their information—because you always do when you click “yes”, right? Your privacy conditions, you click “yes”. So a person who has consented to share their information to a commercial provider, why it is, as I understand it, that, under this piece of legislation, they will still have to be told that their information has been passed to a third party, even though it’s within the bounds of the arrangement that they have agreed to. I understand that to be the case.

Obviously, if you say, “You can provide this to”, and you name an entity, then that’s all well and good. But the way the commercial providers work is they go and, essentially, gather the information and then they’ll hand it on to anyone who will pay the money who’s the legit organisation. Now, it’s a perfectly legitimate enterprise, and this will make life harder for them. In terms of the minimum reasonable regulation and only preventing harm where it’s necessary, it would be really useful to show why that compliance cost on those businesses—and I see you getting some advice—is being imposed, and why, in your view, or the Minister’s view, it was not appropriate to accept that submission.

Thank you, Mr Chair. I do have the advice and I’ll just read it out. During the select committee process, those additional exceptions were sought and the Office of the Privacy Commissioner provided some additional thoughts. They thought that the existing exceptions, combined with guidance from the Office of the Privacy Commissioner, is sufficient.

I think the example in the bill itself relating to information privacy principle 3A(3) outlines it quite well and I can read it out for the House: “[If] An agency [let’s call it an apple] (A) has collected personal information from the individual concerned. [and apple] A has disclosed the information to another agency (B) [ banana], after collecting the information, [they are] is not required to comply with subclause 1”, which is providing the information or awareness to the individual, because the individual concerned would already have had that information disclosed to (B). So if you go to the example in clause 4 of the bill, that will cover that off as well.

Also, there are a number of other exceptions. If you go to section 22(4)(d) inserted by clause 4, “compliance would prejudice the purposes of the collection”—so if those third-party or indirect collectors have already been given permission to collect that information from the direct agency, because the direct agency has told the individual who they’ve collected from that this is going to be passed on to a third party, then to have to go and then make all those notifications to those individuals would prejudice the purposes of that collection in the first place.

I move, That debate on this question now close.

The question now is that the Minister’s amendments to clause 6 set out on Amendment Paper 258 be agreed to.

Amendments agreed to.

Part 1 as amended agreed to.

Part 2 Other amendments to principal Act