Privacy Amendment Bill

I present a legislative statement on the Privacy Amendment Bill.

ASSISTANT SPEAKER (Greg O’Connor): That legislative statement is published under the authority of the House and can be found on the Parliament website.

Hon PAUL GOLDSMITH: I move, That the Privacy Amendment Bill be now read a second time.

The purpose of the bill is to improve transparency for individuals about the collection of their personal information and to better enable them to exercise their privacy rights. It amends the Privacy Act 2020 to introduce a new information privacy principle 3A (IPP 3A). Under the new IPP 3A, an agency that collects personal information from a source other than the individual themselves must take reasonable steps to ensure that the individual is aware of specified matters. These specified matters include the fact that the information has actually been collected, the name and address of the collecting agency, the purposes for which the information is collected, the intended recipients of the information, and the rights of the individual, relating to access and correction of the information. The bill also makes several technical amendments to address some minor issues that have arisen since the principal Act came into force.

The collection of information from a source other than the individual concerned was highlighted as a gap in our privacy regime by the European Union during its assessment of our EU adequacy status. Having EU adequacy means Kiwi businesses can share information with the European Union without more onerous requirements, and places New Zealand in a small cohort of international peers recognised for our commitment to protecting individual privacy. Progressing the bill will support New Zealand to retain our adequacy status into the future.

I want to thank the Justice Committee for its diligent consideration of the bill. The committee received 55 submissions. I also want to thank those submitters for taking the time to contribute to the development of this bill. Many submitters supported the bill, either unreservedly or with minor clarifications or changes and a number of concerns about how the bill would apply to certain sectors or how the new IPP 3A should be implemented in different contexts. I’m pleased to see that the committee has taken these on board and has made some, I think, important changes to the bill.

I want to highlight some of those key changes. First, the committee heard concerns from gallery, library and archives, and the museum sector that the new IPP 3A could disrupt their operations and have a chilling effect on organisations collecting personal information for archival purposes. In response to these submissions, the committee has recommended an exception to IPP 3A for archiving practice where it’s in the public interest. The exception means that the agencies indirectly collecting personal information would not have to notify the individual concerned if they’re engaging in archiving practices and the notification would seriously impair their purpose. This new exception will ensure that our country’s heritage is preserved for future generations.

The committee also recommended expanding the range of exceptions to IPP 3A relating to national security, defence, and trade secrets. The exceptions in the bill as introduced were narrower than the grounds in other sections of the Act that relate to these matters. IPP 3A (6) and (7) mirror the matters set out in sections 51 and 52 to ensure that the areas are treated consistently across the Privacy Act. The committee has also recommended amending the Policing Act 2008, which would exempt Police from complying with IPP 3A when assessing someone’s suitability for employment. At the moment, Police are exempt from complying with several information privacy elements for that purpose, and the exemptions allow Police to robustly vet applicants as part of an employment process.

Finally, the committee recommends an exception to IP P3A for information-matching agreements. The bill, as introduced, provided that it does not apply to personal information collected before, on, or after, 1 June 2025—the commencement date of the bill—under an approved information-sharing agreement that is in force immediately before this date. An information-matching agreement is another type of information-sharing mechanism set out in the Privacy Act, which enables Government agencies to compare their respective records of personal information. The recommended amendment will extend the exemption to information-matching agreements for consistency between the two mechanisms.

Some submitters were concerned about the compliance burden imposed by IPP 3A. There’s no denying it will impose additional compliance burdens on agencies who indirectly collect information. We consider there are several ways in which this burden is minimised whilst still upholding important privacy protections. First, I consider the changes outlined before will make a difference. Second, the bill has been designed to minimise compliance costs. There is flexibility in how an individual may be notified and reasonable periods within which this can occur. There are also several practical exemptions drawn from comparable IPPs that that agency will be able to rely on under scenarios where notification is not appropriate. These include when compliance is not reasonably practicable in the circumstances of a particular case, or where the compliance would prejudice the purposes of the collection.

To further support agencies, I intend to submit an Amendment Paper during the committee of the whole House to change the commencement date of Part 1 of the bill so that the agencies benefit from a six-month lead-in period after the bill is passed, to prepare for the new requirements. The Office of the Privacy Commissioner will also be able to issue guidance under the new IPP 3A, which I’m sure agencies will find useful when considering how to meet their obligations. The changes recommended by the committee will help ensure the bill contains workable requirements which also strengthen our reputation for being a country with a strong commitment to providing privacy. I commend this bill to the House.

The question is that the motion be agreed to. I call the Hon Duncan Webb.

Thank you, Mr Speaker. I was hoping you were going to do that, Mr Speaker. Thank you for that.

That was well read, Mr Goldsmith, considering you’d clearly only just seen that speech—good to see that the literacy of the National Party is still holding up. The idea of a legislative statement is that you don’t have to read it; you can actually say what you really think, but, you know, let’s hold that on for another day.

The issue underlying this bill is actually a relatively simple one, despite the long speech of the Minister of Justice. The fact is that we’ve got pretty good rules around the collection of privacy when information is collected directly from the person who it relates to. If someone wants to collect information about me from me, they have to let me know what the scope of the information is and what they propose to use it for and a whole lot of other details. All very straightforward and one we’ve got really used to actually since the original Privacy Act was passed. But there is a bit of a hole—a gaping hole that you could drive a truck through—in the sense that there are agencies out there that collect all kinds of personal information, but they don’t do it directly from the person it relates to; they obtain it from third-party sources. Supermarket loyalty cards, or loyalty cards generally, are a classic example of this, where information is gathered—quite significant personal information—and then traded.

Now, that’s fine, because when you tick the box, you’ve agreed to it. but if there’s some third-party organisations out there, going and hoovering up information about you to use for a particular purpose, then the fundamental principle underlying this piece of legislation is that you’re entitled to know about it. Of course, a key precept of the Privacy Act is that you are able to know who holds information about you, what that information is, and really importantly, to require it to be accurate. And, of course, if you don’t know that this third party has this information, then how on earth can you exercise your privacy rights, your right to ensure that information is both correct and used only for the purpose for which it was gathered?

The bill as it came to the Justice Committee—one of the many bills; one of the less invidious bills currently being considered by the Justice Committee—actually cast the net, arguably, a little wide. I do want to recognise that some businesses came to the committee and made the case; these are businesses that, essentially, trade in personal information, mobile phone numbers, buying habits, those sorts of things, essentially for marketing purposes. They don’t like this bill because this makes their life more difficult. They, arguably, will now have to—if the information isn’t already publicly available, they will have to let people know that they’re collecting information about them. They made a decent case, but at the end of the day—and I want to recognise that the committee did deliberate on this—it was thought that, no, those people who for their own commercial purposes gather information, it doesn’t matter how responsible they are, they don’t get a kind of carve-out just because they can.

On the other hand, we heard from a range of people in the kind of information and curation sector, if you like, including hearing examples about geological samples being collected with students’ names on them. It’s an important part, to be able to trace back where some biological or geological sample has come from, that you write down that it was Duncan Webb and “I collected it down in Otago”—on this date, at this place, and so on. It’s all part of the record.

Now, at least on one analysis, that’s personal information, because it tells you who collected it, where they were, so on and so forth. Quite rightly, it would be an entirely unnecessary fetter on the gathering of information if, when that information about that sample was catalogued in another institution, we had to go back to the student from the 1980s and say, “Oh, by the way, we’ve collected information about you.” The same with any other kind of archiving curation: art galleries, museums, libraries, archives. The information is kind of quasi-public, but even if it’s not, it would totally undermine an important public purpose. That’s, in essence, why we listened very carefully to those people and thought that the public interest weighed quite differently in that situation and there was an exclusion for that.

The other interesting one was we decided it should apply to the Realm countries, in terms of some of the other exceptions. There are exceptions around national security and national interest and defence, and we just thought we should throw in Tokelau and the Cook Islands—oh, and I see even the Ross Dependency, just in case that crops up. They’re tidy-ups, but really just making sure it was complete.

Again, it’s not a contentious bill, but, Minister, next time why don’t you actually just have a chat about the bill itself and get away from your speech notes? Kia ora.

Thank you, Mr Speaker, and also I would like to wish everyone in the House a happy Lunar New Year, today being Lunar New Year’s Eve. I rise on behalf of the Green Party of Aotearoa in support of this particular bill. There are a couple of points that other people have mentioned, but I think we would just like to mention some of these points again in context. I think the first part is this bill is set out to add a new information privacy principle—or IPP—which allows for the requirements around information that is collected about an individual indirectly.

As part of the select committee process, we’ve heard from a number of submitters. A lot of the submitters did in fact support the bill, but there have been concerns that were raised as part of that. The first thing that we have heard—and the previous speaker, the Hon Dr Duncan Webb, has also spoken on the fact—is that some of the submitters, particularly in the gallery, library, archives, and museum sector, spoke on the potential impact that this will have. As a result, the Justice Committee has made amendments to this bill that will, hopefully, address some of that.

We also heard from businesses that this will add, sometimes, an administrative burden to the bill. However, I would say that, in terms of this, particularly in light of the ever-changing technology and digital landscape, some of these—and particularly in alignment with the much more robust EU legislations around data protection—are necessary. I think, for a lot of businesses, for example—and particularly some of the businesses that have ties to or are in collaboration or cooperation with the UK or EU, particularly as part of the NZ-EU Free Trade Agreement—we’re actually required to have to upgrade their privacy protection to include some of these provisions anyway, to be in line and to be able to operate within the EU context. That, I think, is the crux of a lot of this bill and for a lot of the submitters: what is the goal for privacy in Aotearoa?

I mentioned before that in the context of privacy, and particularly in a much newer and ever-changing media and also social media and also in terms of tech, we do need to be nimble in terms of our approach to information security and data security and how information can be collected by third parties. This is particularly true not just of the agencies and of the various elements that are mentioned in this particular bill, but also thinking about it more broadly.

There is one particular element of this around exceptions related to national security, defence, and trade secrets that I would like to address. I think that in terms of when you have exceptions related to national security and defence, certain aspects of that is understandable, but I would like to know from the Minister—and I will be really interested in asking the Minister more questions around this during the committee stage—around the scope of what is considered trade secrets. Again, understandably, there is a level of commercial sensitivity that we need to be upheld, but as we see with some of the social media giants in particular, the collection of big data and the use of big data—whether they’re collected directly or indirectly—is often a grey area both in domestic legislation but also under international law. In this particular case, what is some of the advice that has been taken around the broader scope and the broader boundaries of this particular trade secret or commercial sensitivity aspect of the exception we see in sections 51 and 52 of the principal Act?

For the next part, a number of submitters have also spoken in terms of the monitoring and also in terms of the accountability. We see that the Privacy Act has just gotten a refresh in 2020, and, again, we are seeing that within a few years’ time we’re doing an overhaul. Prior to that, we haven’t seen an update to the Privacy Act for a number of decades. Again, we are seeing this increased need for us to play catch-up with some of the overseas jurisdictions. A lot of that does come down to, if that does happen, when we do see a potential violation, what is the accountability and what role is the privacy commission being able to take on monitoring the compliance with the IPP—the information privacy principles—and particularly this new one that has been introduced?

Finally, in connection with this particular bill and the broader context of privacy in Aotearoa, I think the importance around education and the importance around education of cyber-security is absolutely crucial in making sure that the people of Aotearoa, both as individuals but also as businesses, are able to keep their data safe; and for businesses, and also for the various sectors, understanding their obligations under the Privacy Act.

I think if we’re looking from a particular cyber-security perspective, we’re looking at some of the overseas jurisdictions around what they are doing, particularly around the physical, logical, and also the virtual layers of cyber-security—and in this case, I’m referring to the logical layer of cyber-security around the education of scams, of cyber-security, of privacy, of personal information—this is something that we have seen that hasn’t been done particularly well, both in terms of our education system, in terms of our community education system, but also in terms of educating and also keeping up with the compliance with our businesses.

As the privacy officer of my previous workplace, we had to ensure that all of our staff went through like a suite of education programmes around the privacy principles and the update of the privacy principles. However, we’re often finding that those sort of education bases are based around a singular session, a singular workshop, without the consistent reinforcement of our staff when it comes to understanding of the privacy principles. I think, in this particular case, it is also empirical—and also a golden opportunity—as we are looking at the passing of this bill, considering that there is a number of support for this bill. How is the Government going to be able to work with the Privacy Commissioner on ensuring that when we are rolling it out, when we are rolling these new principles out, that there is a robust education system that is able to be reinforced over and over again so that way people don’t inadvertently and unintentionally violate our Privacy Act?

To finish, as the Green Party, we do support this bill and there are a number of things, as I mentioned, that I would be interested to ask the Minister during the committee of the whole House stage. But, broadly speaking, we are incredibly heartened by the submission process and also by the calibre of submission that we saw during the select committee stage and the succinct sort of feedback that we did receive from the communities and also the Justice Committee’s adaptability, being able to incorporate some of this feedback and making the required and necessary updates to the legislation. With that, the Green Party supports this bill and we look forward to further discussions during the committee stage.

Thank you, Mr Speaker, and happy New Year to you. This is my first opportunity this year to address the House, and it is my pleasure to speak in support of the Privacy Amendment Bill. There is actually probably nothing more important than ensuring that we actually do continue to protect privacy. It is actually a fundamental human right, along with freedom of speech and a number of other foundational rights in our important democracy. While this is a fairly simple bill doing some tidy-ups, it was actually taken very seriously, I can report, by the Justice Committee, which I am lucky enough to be a member of. We did diligently work through the issues, and it is very pleasing that the Minister of Justice has actually accepted the changes recommended by the Justice Committee.

As has been outlined already this evening, this bill originated, really, in feedback from the EU and wanting to ensure that New Zealand did continue to have the adequacy status in relation to privacy laws. That’s how this came about, and then there were, obviously, also, some other minor improvements we were able to put into the bill.

We really recommended four major changes, and, again, it’s just worth reiterating that this creates a new privacy principle, 3A, which, as Dr Duncan Webb, another colleague on the Justice Committee, has outlined, really is specifically around this third-party collection of privacy information. It is very important that New Zealanders do understand what organisations hold their personal information, what they’re doing with that personal information, why they are holding it, etc. Again, it’s this idea that when this information can move through a number of parties, it may not be as clear to the individual who actually has their information. Again, that’s why this privacy principle is being introduced into the Privacy Act of 2020.

As has been outlined tonight, and as I said, we really made four suggestions as a select committee. The first I want to talk about briefly was this public interest exception, and we did have some submissions on this bill—55, and we had 16 oral submissions. A number of them were from the sector representing, really, galleries, libraries, archives, museums, and they really outlined to us how important this public interest exception was for archiving. Again, we had some really practical examples where you could have a historic exhibition of photos or a historic archive of photos, and if they didn’t have this public interest exception, you’d actually be required to go back and try and actually contact everyone in the photo, and that might not be possible. It could have been a collection of photos of just people on the streets of Wellington in the 1960s, 1970s, 1980s—whenever. It would be very difficult to comply with the law if it didn’t have this public interest exception. We do want to be able to let these very important institutions actually capture our history, whether that’s oral history, photography, or other things. We had a number of submissions around that, and we listened intently, and we worked through a way to put in place this public interest exception.

As has been outlined already tonight, some other sectors of the community also wanted exceptions, and, again, we did listen to their arguments but, on the balance, did not agree that they should require it—only this public interest exception for archiving.

One of the other amendments we did was just, yeah, really tighten up this area around exceptions or expand this area around exceptions for national security, defence, and trade secrets, and I can assure the House that we did look at this carefully. There are some already established rules around trade secrets, etc., so, really, it was just tidying up where that exception would be allowed and making sure that was appropriate.

Again, as we diligently work through this process—and I can say this is one of the bills where everyone on the select committee was contributing, and we’re actually taking a very positive approach. That often happens in the Justice Committee, despite reports to the contrary. Another area which we did uncover, working with our officials, was that we needed an amendment related to the police Act. The police Act actually already has some exceptions for when it’s complying around privacy principles, and we wanted to make sure that, when we’re introducing this new 3A, those same exemptions for the police remain. Really, it was just making it consistent, and this hadn’t been picked up earlier, so we’ve worked through that and made sure that happened. There was another issue around information and data-matching agreements, which, again, we worked through and make sure this bill was consistent.

Again, I would say it wasn’t the most controversial piece of legislation that we’ve had before the Justice Committee, but, as I said at the outset, it is very important that we actually do look after our privacy laws. Privacy is a fundamental human right, as I said, and just making sure that we update these laws and make sure they are fit for purpose and that New Zealanders can rely on them is a very important function of both select committees and this Parliament.

Privacy will continue to evolve. Again, some speakers earlier in this debate have talked about some of the issues. We have seen data links. There obviously are large data-collection companies now all over the world. What’s most important is that people are willingly able to give up their personal information if they wish—but they know that they are doing so and they are informed when they are doing it. Actually, our modern society and world couldn’t operate without us providing some personal information, but it’s making sure that that’s done in a way that we understand, that it’s disclosed to us, we know who holds it, and we know how we can correct the record if necessary. I am delighted to be recommending this bill to the House on behalf of ACT. Thank you.

I rise to speak on behalf of New Zealand First, in support of the Privacy Amendment Bill. The key note, I think, we have to acknowledge is that a privacy Act exists to ensure that New Zealand citizens have the ability to exercise their fundamental rights of protection. This bill seeks to address the fact that you cannot exercise your fundamental rights if you’re unaware that your rights have been breached. We are, by nature, becoming an increasingly data-driven economy; information is a valuable commodity and it is traded as such. The knowledge of the individual of their rights is essential, and this is why the new principle, information privacy principle 3A, has become so important.

I would like to acknowledge the Justice Committee, which has an enormous workload and has been incredibly diligent in all the legislation that it has put forward. I think it’s important to note that despite this being a small piece of legislation, it was carefully reflected on and it was important to note that there were some nuances. I think, as the previous speaker, Todd Stephenson, talked about, it was really considered around the practicability and public interest test as to whether they were sufficient to address all the concerns that were raised.

I think that is a key component in this space, because it is a complex area, but our application of law has to be practical, it has to be weighing up public interest, and not onerous to the point that we are constraining ourselves from being able to collect information in any shape or form. It is necessary—and I think this has become more apparent—that there are so many ways which our data and information can be gathered about us, and the fact that we tick a box and we sign and we know is the only mechanism we have; once we have done that, we need, as citizens of a free country, to be able to know what happens after that point, and this piece of legislation is a positive step to allay those concerns. Because we need to be able to collect information, we need people to have faith in their ability to hand over information and know that they have the protections of a good piece of legislation.

I have, without hesitation, on behalf of New Zealand First, great pleasure in commending this bill to the House.

Tēnā koe, Mr Speaker. Tēnā koutou e te Whare. Happy New Year to everyone. The Green Party, as my colleague Lawrence Xu-Nan mentioned earlier, is supporting the Privacy Amendment Bill. It is a very technical change, but it enhances our privacy law and it’s in line with other jurisdictions.

The Privacy Amendment Act would require companies and other organisations to notify people when they indirectly acquire their data from another party. The idea of the law, as many of the speakers tonight have referred to, is to improve transparency so individuals know who is using their data for what purpose. I think that’s really important. This is an amendment to an Act that was just passed in 2020. It seems like not that long ago, five years ago, but, actually, in terms of the evolution of technology, it’s moving very, very fast and seems to be increasing, the speed with which it’s changing, at an exponential rate.

I think that privacy is something that we have probably taken for granted, that democracy is something that we have taken for granted, and this amendment is striving to promote and protect that fundamental right in a changing environment. I think, particularly with the rise of artificial intelligence, we are going to have to continually review the legislation aligned with these changes to ensure that people’s personal information—they know how it’s being used; they know how it’s being shared with others. I just think about how much social media has enabled some players to gather so much personal data about people, and that is being used often to target advertising, and maybe that’s very effective, although I think it’s really important that there’s clear transparency about who is using information and for what purposes.

Now, I note from the select committee report—I don’t sit on the Justice Committee, so my colleague would have sat on that and heard all of the submissions—that it does sound like some really useful submissions were made, particularly by library archives, people in the museum sector, talking about how the initial proposal could disrupt their operations, which could have really negative effects. There is an amendment to clause 4 to insert a new exception in new information privacy principle 3A, which Todd Stephenson referred to at length, and I think that’s a really sensible change.

I myself have had to fill out compliance with Privacy Act stuff when being interviewed by an archivist specifically. And this might happen to other members here, where they want to interview you at length about different aspects of campaigns you’ve run in—I think it was a by-election that I ran in—and you have to go through this whole process. Obviously, they have to take privacy very, very seriously, but we don’t want to put an enormous administrative burden on them or disrupt their operations. I think, overall, this legislation is good, and we are supporting it.

The Hon—and I believe it is the first time you’ve been called as “the Hon”—James Meager.

Thank you, Mr Speaker—thank you for that.

Look, I’m very pleased to take call No. 7 on the Privacy Amendment Bill, a bill which was referred to the committee way back in May of 2024, so it seems a while ago since we did consider the bill. As many speakers today have said, it is a bill which is, essentially, supported across the House and one which was discussed and considered in quite good spirits. I just thought I would take the House through some of the key changes that are being recommended in the select committee report, and also just speak a little bit about some of the submissions we received.

Unlike some of the other work the Justice Committee has been doing in the past few days, we received a relatively modest number of submissions. We heard oral evidence from only 16 submitters, but what I would say about those submitters who came in—and I’m sure members who were on the committee would agree—is that, I think, to a submitter, they all provided something of substance and quality.

I actually quite enjoyed hearing from a range of submitters from across sectors who would be impacted by this bill, including from what I first heard termed the GLAM sector, and that is the—now, I’ve got to get the actual acronym; come on, Mr Brewer, help me out here—galleries, libraries, archives, and museums. That’s the GLAM sector. When they came and made a submission, they were concerned about the provision in the bill which would require them to notify someone when they had collected information from a third party, or they were a third-party collector, and it was their view that this could impact some of the work that they undertook, whether that’s in archiving or whether that was the oral historians. When you’re putting together a large collection and you have a donation of perhaps tens of thousands of photographs, the risk that they thought that the bill might cause was that in going through those photographs, if they were ever to display them, they would then have to go and notify, or try and do the work to identify individuals in each individual photograph—and I think Sir Ed Hillary, Mr Brewer, was used as one of the examples.

The risk that they saw was that that might be overly onerous to the value of the exhibition and that it would put so much cost on the process that it would prevent them from doing the work in the first place, and some of that valuable archive material may never see the light of day. We heard those submissions from a number of submitters, and the committee did agree to make an exception for archiving in the public interest, based on some similar exemptions made in other jurisdictions, and I note in the departmental report that it actually refers to initial Cabinet decisions by the previous Government to include an exception which was then removed on the proviso that it could be considered by a select committee if there was merit in doing so. We considered that exception and we thought that it was worth putting in, and so we’re going to recommend that to the House, as well.

There were many other submitters who made similar arguments that some of the provisions in here would be overly onerous on their business and may prevent them from operating in a reasonably efficient way. We took those on board and we considered them, but we thought that there were other protections in the bill which would make that change not as overly onerous. That includes the requirement for those agencies to take reasonable steps to notify, and what would be reasonable in each individual situation would differ, depending on whether or not you had readily accessible information or the extent of information which you might need to notify. We thought that those protections for the vast bulk of those industries would be sufficient, so we didn’t recommend any changes to those.

Then, finally, in terms of the remaining changes recommended in the bill, they were some alignments with some of the other information privacy principle (IPP) sections that already exist in the Privacy Act. They were things like aligning exceptions relating to national security, defence, and trade secrets which already exist for IPP 3, but haven’t been carried over for IPP 3A. We just tried to align those, as well as amending section 57 of the Policing Act. Look, I think it was another example of where the Justice Committee works really well, and we worked well together to recommend amendments to the bill which will improve the bill. As it continues its journey through the House, I’m sure that it will continue to be supported by many members. With that, I will commend the bill to the House.

It’s no surprise that the Labour Party supports this bill, because it was ours. I think I remember doing the first reading quite a while back. It’s been interesting to see it progress through the Justice Committee, and we’ve all worked incredibly well to get to this point in time. It goes a long way to strengthening our policy framework and enabling people to be well informed when an agency has their information and to know what they’re doing with their personal information.

As we live in an age where there’s a lot of that going on and it can be used for nefarious purposes, it’s really important that our legislation is up to date to make sure people have all of those protections in place. That’s exactly what this does. It improves in a real way the transparency of Government, for which we are well known in New Zealand, to make sure that we are holding that personal information in way that is protected, and it should come as no surprise that we were keen to continue to work on this space. As we see breaches of information, as we have people more concerned about how their information is being used, it is incumbent upon Governments to make sure that protections are in place to give people confidence in how they use that.

It was really interesting to get lobbied by—I think it was the librarians and archivists. They came in pretty cross and explained that they were concerned that some of the parts of this bill might actually impede upon their important work in terms of gathering histories and putting together interesting facts of our past and bringing those together and collecting those parts. So an exception for archiving in the public interest has been made. It is not necessary for an agency to comply with requirement in information privacy principle 3A if the agency believes, on reasonable grounds, that non-compliance would not prejudice the interests of the individual concerned. This is a good example of it.

It might be, say, 50 or 60 years ago—you might be using the information or data of someone who’s passed away but you’re wanting to bring that together in a record of how it’s worked. We wouldn’t want to stop the storytelling and the history making within New Zealand. Quite rightly, there’s been a carve-out for that, particularly when that information is already publicly available. It’s not really going to the heart of what that bill was trying to do. It also states that, if compliance is not reasonably practicable in the circumstances—so if someone is going through a huge effort to compile a whole lot of different sources, having to go back and seek agreement for each of those would just simply mean that that history making doesn’t take place. That would have been an unintended consequence. It was a good example of a bill having the right intent but, unaware, catching a group, and through the select committee process, changes being made to make sure that that did not include those who are simply doing archival work in New Zealand.

It’s a good bill. This is an area that continues to evolve and we will have to continue to be vigilant to make sure we give the right protections in place to make our Government transparent but also give people confidence to be able to give their information to Government in a way that is not compromised. I commend it to the House.

It’s great to stand up in support of the Privacy Amendment Bill. If we reflect, as some of our members on the Justice Committee—Mr Meager; the Hon James—it was referred to the committee back in May, and since then we received a number of submissions, 55 from interested groups and individuals, and 16 oral submitters. Some of the traps were canvassed, that we needed to ensure that this bill excluded those in the GLAM sector—gallery, library, archives, and museum—so they could operate in the public good that they always, always have, and not be caught up by having to allow for provisions that were not workable.

Going back to the whole purpose and the first principles of this bill, it’s all about aligning New Zealand’s privacy laws with the standards set by international agreements and best practices that we see around the globe. As others have alluded to, it’s not just about protecting the privacy of New Zealand individuals but also ensuring that our businesses remain competitive in the international market, which, of course, is demanding higher and higher standards, as are consumers, in and around data protection.

The bill introduces new compliance obligations, as has been examined, and it is crafted, as I have alluded to, to ensure there are many practical exemptions to enable those archivists in galleries, libraries, and museums to get on with their business. As it was, there was a real concern that without the new information privacy principle 3A—that is, the agency that is collecting the personal information about an individual from other sources is to take reasonable steps to ensure that the individual is aware of specific matters, including the fact that the information has been collected—this is what was going to be unworkable—that the name and address of the collecting agency be documented, that the purpose for which the information has been collected be detailed, that the intended recipients of the information be named, and that the rights of the individual relating to the access and correlation of the information also be sought.

When you are, as I think Mr Stephenson alluded to, talking about photos of the streets of Wellington in the 1960s and trying to get permission—

Todd Stephenson: I wasn’t there.

CAMERON BREWER: Well, maybe it was Dr Webb that was talking about those days. But trying to sort out—as the archivists and the historians took us through, and the potential Sir Edmund Hillary Collection was one of them—the permissions, as I’ve just detailed, would be a very difficult task, to find everyone that was alive and/or their descendants in any photo taken in a public setting. This was examined by the committee, and subsequently the chilling effect that that would have on these organisations and their work and the public archive going forward was avoided. Those galleries, libraries, archives, and museums can get going and continue with their work, albeit with very stringent rules around the direct impacts on someone’s privacy, more so than having to scoot around hypothetical, indirect impacts that it might have on people’s privacy that have been included.

Oral historians said that all it would take is for someone to mention a person that was part of their life story or their work story, and then that person—it might have just been a momentary glimpse in the life of Sir Edmund Hillary, but then that oral historian would have to go through a whole process of tracking down that person and looking, and then if permission was not granted, that story was gone.

This has been well canvassed and the GLAM sector are very happy with the work. I commend this bill to the House.

Thank you, Mr Speaker. It’s lovely to be back in the Chamber. I hope everyone had a good break; I certainly did.

I want to speak about this just really from the point of view of coming in from—I’m not on the Justice Committee, but I do have a background applying the privacy law, and I can see that the committee has done a really good job of looking at the potential unintended consequences of this law. I don’t think that this is a particularly simple area of law; it’s evolving and it’s going to have unintended consequences and they’re going to crop up and we are going to have to change the law fairly frequently if we’re going to keep abreast of a situation.

Also what we had here, which I think was really interesting as an outsider, was a clear discussion in the select committee about the needs of the public and the public purpose of some of the organisations versus, perhaps, private interests and commercial interests in another. The solutions that were found are quite different as a result. I think that’s a really interesting evolution—that people got to that point. They made a distinction between people who might have the protection that the test gave of just reasonable grounds, of reasonable inquiries perhaps being made, but still a compliance and a respect for people in that situation which was higher than a situation where there were perhaps archivists who had a public purpose, who were going to be gummed up by too much compliance in this area and also weren’t looking at self-interest.

That’s very much our job, so I’m really impressed with what has happened in this committee. It doesn’t mean that with all best intentions there won’t need to be further changes and subtleties in the law of privacy; there certainly will.

I was also really interested to see the exceptions for the police. That seemed really grounded. There are a lot of real discoveries in the area of data matching, etc. We really do have to, again, look at the public need and purpose and not confuse ourselves over that. We really do need police to have more powers in this area than we would give a private institution, and so it’s really nice to see that as another example of where the law has been applied with what looks like common sense in this new law.

I’m really pleased to see what I see. It doesn’t look particularly simple to me. It looks like an evolution in the law of privacy, and a good one—a good step in the right direction to protecting our citizens where necessary, making sure that they haven’t lost their power as data becomes more and more something that we really are going to have to control, because, otherwise, we’ll lose control of it and it will become the property of someone else and we’ll fall victim to a system, or our citizens will. Our job is to protect them; it looks to me like the committee’s done an excellent job of that.

I’d just like to say there were 16 submitters, by the sounds of things, who took the time to orally address the Justice Committee. Those submissions sound like they were really helpful to the committee. Thank you for giving your time and contributing to the process. I’m always telling students in my electorate that the submission process is one that’s very real and genuine, and if you come along and you say something and point out something, people will take that seriously. It looks like, in this case, that’s exactly what happened, as I hear repeated stories of archivists and Sir Edmund Hillary. Obviously, people did have their ears on and they did listen and they did amend. Thank you to the submitters who took the process seriously, and thank you to the Justice Committee for giving it the time it deserved. I commend the bill to the House.

This debate is interrupted and set down for resumption the next sitting day. The House stands adjourned until 2 p.m. tomorrow. Thank you for your efforts today.

Debate interrupted.

The House adjourned at 9.59 p.m.