Privacy Commissioner - Te Mana Matapono Matatapu

Skip to content

New Zealand Report - Greece 2000

27th Meeting of the International Working Group on Data Protection in Telecommunications Greece, 4/5 May 2000

New Zealand Report

An outline country report describing New Zealand's legal framework in respect of both privacy and telecommunications was presented at the 23rd meeting of the Working Group. Accordingly, this report offers an update on relevant developments since April 1998.

Office of the Privacy Commissioner

The Office of the Privacy Commissioner deals with telecommunications privacy issues in a variety of capacities. For instance in answering public enquiries, investigating complaints, issuing codes of practice, reviewing decisions to withhold personal information from a requester, scrutinising government proposals for legislation.

Complaints
In one complaint an individual requested access to the identity of a person who had repeatedly anonymously emailed her. While there are clear procedures for dealing with malicious telephone calls the same cannot necessarily always be said for harassing emails. Normally an ISP will act if threats are made (although a new account can easily be opened to replace one that has been closed). In this case the messages, although not overtly threatening, were unwelcome as they contained anonymous statements of affection (with a disconcerting feature that suggested the sender knew where the complainant lived). Although the messages were directed from a US "hotmail" account, the email header revealed the sender's New Zealand ISP and hence the complainant's access request could be reviewed. The legal issues included whether the sender's identity could be said to be "about" the recipient (and hence "personal information" to which there is a right of access) and, if so, whether that could be properly withheld to avoid an "unwarranted disclosure of the affairs" of the sender. The complaint remains under review.

Review of Privacy Act 1993
In December 1998 the Privacy Commissioner presented a report to the Minister of Justice on the results of a major review of the Privacy's Act's operation. Although not focusing directly on telecommunications, there were recommendations and observations touching upon related issues including that:

a judicial warrant process be established for covert video surveillance in the investigation of offences (recommendation 22);
the issue of database browsing be expressly addressed (23);
the correction principle be supplemented with a right based on the EU Directive to prevent the use or disclosure of personal information for direct marketing purposes through deletion or blocking (25);
controls on unique identifiers be altered, which may have implications if "lifetime" telephone numbers were to be adopted (28);
data export controls be established (35);
enforceable requests for access be allowed to be made from other countries (61);
further information privacy principles be applied to intelligence organisations (83);
public register information not be made available electronically to persons outside New Zealand unless an enabling law expressly provides (88);
bulk release of addresses/telephone numbers from public registers be constrained (91);
new computer crimes be enacted, including one relating to hacking.

Highlights from the report, including the text of all recommendations, can be obtained on the Internet at http://privacy.org.nz/recept/rectop.html.

New legislation
The Privacy Commissioner has a function to comment on proposed legislation which might affect the privacy of individuals. In this capacity, he has commented upon laws dealing with the powers of intelligence agencies to intercept private communications and of prison authorities to monitor inmates' telephone calls.

Telecommunications code of practice proposal
The Privacy Commissioner can issue codes of practice which modify the information privacy principles to make the standards more stringent or less stringent, to provide how the principles are to be complied with, or to exempt any action from the principles. The telecommunications industry several years ago prepared a draft code for the Commissioner's consideration but other priorities prevented the project being progressed. This year the Commissioner re-commenced work on a code. The content and exact scope of the code has not been settled and will be the subject of industry and public consultation. It is likely to cover telecommunications companies and network providers, ISPs, publishers of telephone directories and some major telecommunications users, such as those operating telemarketing businesses. The EU Telecommunications Directive will be studied. The first public step is to be the release of a resource document and issues paper.

Interception of private communications

The Crimes Act 1961, makes unlawful the "interception of private communications" by use of a "listening device". This law thereby criminalises eavesdropping into private communications whether by placing a "bug" on premises or "tapping" into telephone lines etc. As a corollary there are several laws providing for the authorisation of interception for law enforcement or national security purposes. The laws require "interception warrants" to be obtained. Judicial warrants from the High Court are required in the case of law enforcement interception with Ministerial warrants for national security purposes.

NZ Security Intelligence Service
The law requiring a Ministerial warrant for interception in cases of national security has recently been amended. The New Zealand Security Intelligence Service (NZSIS) is the sole agency involved in domestic intelligence gathering. In December 1998 the Court of Appeal rendered a judgment in relation to a case where the NZSIS installed a listening device pursuant to a Ministerial warrant(1). In effect, the Court found that while any interception was lawful, the NZSIS had acted unlawfully in breaking other laws (namely trespassing onto private premises to place the device). The Government acted urgently to amend the law to allow such actions also to be authorised by warrant. This allowed for public debate and the Privacy Commissioner and others called for the Ministerial warrants to be replaced with judicial warrants. The outcome in a second amendment was the appointment of a new officer, the Commissioner of Security Warrants, to consider any application for an interception warrant for the NZSIS jointly with the Minister in charge of the SIS (by tradition the Prime Minister). The Commissioner of Security Warrants must be a retired High Court Judge.

The Privacy Commissioner repeatedly called for enhanced public reporting in relation to interception powers. In a report to the Minister of Justice he cited the International Working Group's Common Position on Public Accountability in relation to Interception of Private Communications adopted at the 23rd meeting in Hong Kong(2). The Commissioner was not, at first, successful in his calls for enhanced public reporting but as a result of a second report(3) the NZSIS will, from now on, be required to make an annual report on its activities.

Law enforcement interception
Expansion of the powers of the Police to intercept private communications for law enforcement purposes was noted on in a report to the Working Group's 23rd meeting. The most recent developments concern public announcement by the NZ Police of their proposals to the Government for further changes to interception law(4). These proposals are contained in a briefing resource document by the New Zealand Police to the Minister of Police in December 1999.

The principal proposals are:

to amend the Telecommunications Act 1987 to require networks to be interceptable for law enforcement; and
to expressly allow the Police to intercept, pursuant to an interception warrant, data transmissions rather than simply private "oral" communications.

The Police also seek a power to oblige persons searched to assist Police to access computerised material when executing a search warrant. Their hope is that thereby passwords etc would be provided to enable the Police to obtain crucial evidence.

Monitoring of inmate telephone calls
In 1999 the Department for Corrections obtained an amendment to the Penal Institutions Act to enable a monitoring system to be established whereby every telephone call made by an inmate in a New Zealand prison would be recorded. Calls might be listened into on a "real time" basis, or after the event, randomly or as part of an investigation. The object was to address a problem whereby some inmates were believed to have organised escapes, drug deals or witness intimidation by telephone. While the Privacy Commissioner accepted a case for taking suitable action, he expressed concerns about the proposal to the Minister of Justice(5).

Numerous issues arose around such matters as the randomness of the monitoring (as against targeted action based on a reasonable cause to suspect), the practice of recording all telephone calls rather than just those fitting some kind of risk profile, the warnings to be given to inmates and persons to whom they communicate, the lack of independent oversight or authorisation, and the inadequacy of annual reporting. The political environment meant that "firm action" had to be seen to be taken and very few of the Commissioner's recommendations were heeded.

The Committee studying the bill recommended that the powers be extended to enable prison authorities to carry out "scanning" of cellular telephone calls to identify users of smuggled mobile telephones. This was raised very late in the process and without adequate study of the policy implications, feasibility and safeguards that might accompany such a power. The Privacy Commissioner publicly expressed severe reservations as to the intrusion into the private communications of the users of mobile telephones around prisons and the Minister decided not to proceed with the proposal.

Electronic Commerce

The New Zealand Government is studying the issues of electronic commerce with a view to removing barriers and ensuring maximum benefits to our economy. New Zealand is a small isolated economy heavily dependant upon exports and international trade. In a November 1998 Government statement on electronic commerce the Minister of Information Technology used the analogy of "the freezer ship of the 21st century". This referred to the fact that over a century ago a breakthrough in technology brought increased wealth and prosperity to New Zealand when the SS Dunedin transported the first shipment of frozen meat to our major market in Britain.

Recent work has principally been undertaken in three contexts.

First, has been participation in certain international organisations, notably the OECD and APEC. Care has been taken to ensure that any New Zealand action is consistent with that taken internationally.

Second, inter-departmental working groups have been established to address electronic commerce issues. The Privacy Commissioner has contributed to some of the work of the Consumer Protection, Privacy and Property Committee. The Ministry of Commerce coordinates this work and has established a website containing key electronic commerce documentation and linking to relevant sites(6).

Third, as part of the New Zealand Law Commission's project on international trade, a series of major reports on electronic commerce is being produced. The Commission has so far released two reports:

Electronic Commerce Part One: A Guide for the Legal and Business Community, October 1998(7); and
Electronic Commerce Part Two: A Basic Legal Framework, November 1999(8).

One outcome expected of the Law Commission's work is an Electronic Transactions Bill implementing the UNICTRAL Model Law on Electronic Commerce (1996).

As part of its work the Law Commission is seeking to identify legal barriers to electronic commerce. It has examined the Privacy Act 1993 in that light and found that not only is it technology-neutral, and therefore offering no problems to electronic commerce, but indeed encourages electronic commerce through the provision of effective data protection law. However, it has identified the issue of "caching" for further study.

Electronic Government

As part of on-going work to find efficiencies in the delivery of public services, and as a spin-off to electronic commerce work, public officials are increasingly describing projects to automate public document handling as "electronic Government" or "e-Government". Frequently proposals have an on-line component. Typical initiatives involve businesses electronically filing returns or members of the public finding government information, or personal details held about them, through an Internet facility.

It is likely that the first wave of projects is likely to include what are termed "public registers" in New Zealand. These are registers maintained under particular laws in respect of which there is an explicit right of inspection and access. Public registers are ideal candidates for "electronic Government" projects as:

they are highly structured and standardised databases;
major automation projects to convert manual records have been undertaken over the last decade;
there is existing public access to the databases and on-line access can be presented as responding to user demand;
there is scope for cost saving with, for example, discontinuance of manual records, the closing of local offices and reduction in staff.

The Privacy Commissioner has been concerned that the availability of technology is driving changes in public recordkeeping and access without the social impacts, particularly the privacy impacts, being studied first. The Privacy Commissioner has recommended that:

the public register privacy principles be reformed so that, as far as possible, access to public registers is made consistent with the finality principle;
bulk release of personal information electronically from public registers be constrained;
any decision to place public registers on the Internet be taken by Parliament rather than administratively;
privacy impact assessments be undertaken for major technological projects.

Two case studies of completed projects to put public records on-line follow:

Checking electoral enrolment on-line
The Electoral Enrolment Centre (EEC) suggested electors be enabled to check their enrolment status via the Internet. The suggestion was endorsed by a Parliamentary Select Committee which described the proposal as follows:

"The suggestion is that an elector be able to check his or her electoral status by keying in his or her full name, street address and date of birth. The electoral roll would then be searched and if there was a match the elector would be informed by a message appearing on the screen. If there was no match, the elector would be prompted to print out or request an enrolment form. The unpublished roll(9) would not be made available via the Internet and the EEC has indicated that it would not proceed with this proposal unless it can be satisfied that the privacy interests of electors and the integrity of the electoral information on the rolls can be effectively protected."(10)

The EEC developed its proposal including appropriate "firewalls" to protect the integrity of the database. Discussions were held with the Office of the Privacy Commissioner to ensure that the process did indeed verify details supplied by the person rather than, for instance, supplying address details in response to an enquiry. The only information displayed in addition to the electoral confirmation message is the national and local authority constituency names. Some issues arose in respect of the variations in the way that New Zealanders write their addresses (for example numbering of flats or apartments, rural addresses may not include house numbers) and therefore partial address information, constituting a street address but not house number, is recognised. However, otherwise the project was seen as unproblematic from a privacy perspective and represented a valuable use of new technology to better serve the public.

The facility was made publicly available in late 1998 and can be accessed at www.elections.org.nz. A range of electoral forms can be printed from the site, including an enrolment form and a form used to ask for details to be suppressed for personal safety reasons from the published electoral roll. Such forms are not filed electronically but must be signed and posted to the EEC or presented at a Post Office.

Personal Properties Securities Register
The Personal Property Securities Bill involved combining of existing registers into a single "super register" of personal properties securities. The Privacy Commissioner took a close interest in the proposal since the character of the existing registers would significantly alter and the effect on privacy would probably be detrimental. For example, under the existing law a search might be made of a motor vehicle to see if a loan is secured against it. The new register, conversely, might allow a search by an individual's name to see if that person owns vehicles subject to security interest. Furthermore, the register was to be available for accessing through the Internet.

The bill posed a number of problems for assessing and addressing privacy and data protection issues principally because it only dealt with high level issues and contained no detail about the content of the register and how that would be accessed. The Commissioner raised a number of points for the Parliamentary Committee to consider and worked with officials in an attempt to address the issues.(11) The bill as finally enacted differed significantly from the version introduced. For instance, it attempted to outline the purposes of the register and provide a mechanism to ensure that access would be restricted to compatible users. It is not yet clear whether the new law will be effective to address the data protection issues since the measures taken were grafted on to a framework originally developed without any attention to such considerations.

Court-ordered suppression of name

The common law requires that court hearings be held in public and allow judges to suppress the publication of evidence only where necessary in the interests of justice (e.g. identities of complainants in blackmail cases). As the common law approach is unable to protect competing public interests, NZ has developed an extensive statutory regime for hearings to be closed to the public, for identities to be withheld in open court, and for the suppression of publication of certain details, in exceptional cases. Judges have powers to suppress details which would identify respondents, complainants and in very limited circumstances witnesses. The grounds on which such orders can be made include the interests of justice, national security, personal safety, and in some cases privacy.

Where an accused person obtains a suppression order, this is normally on an interim basis and will expire if the person is convicted. Cases of permanent suppression stir more public controversy. A recent case, involving an American billionaire who was found in possession of small quantities of cannabis, has gained some notoriety. Having pleaded guilty the man received a "discharge without conviction",(12) and permanent name suppression. A newspaper is campaigning, and taking legal action, to have the suppression lifted.

The interesting aspect is that the man has had his name, and details of the offending, widely broadcast and published in the USA. The information was widely available on news organisation websites. Some NZ sites established hyperlinks to US pages containing the man's name. Although the ability to bypass local court suppression orders is not new, the technology makes the issue far more immediate and difficult to control. This case arose in the vexed context of conflict between the right in the right to privacy and the right to see justice dispensed openly. However, the issue could also arise in cases involving a right to a fair trial or where a person's safety is at risk.

Future invitation

The New Zealand Privacy Commissioner would be pleased to extend an invitation to the International Working Group to meet in New Zealand for one of its future meetings. The Commissioner had intended to offer to host the 2001 meeting but understands that arrangements have already been made for that meeting. Accordingly a general willingness to host a future meeting, say in 2002, is indicated.

Contact Details

The Privacy Commissioner has offices in Auckland and Wellington, New Zealand.

Correspondence should be addressed to:
Office of the Privacy Commissioner
P O Box 466
Auckland
New Zealand
Telephone: +64 9 302 8680
Facsimile: +64 9 302 2305
Email: privacy@iprolink.co.nz
Internet: www.privacy.org.nz

Blair Stewart
Assistant Commissioner
Office of the Privacy Commissioner,
New Zealand
27 March 2000

 

Footnotes

1. Choudry v Attorney-General ¹⁹⁹⁹ 2 NZLR 582 (CA).
2. Report by the Privacy Commissioner to the Minister of Justice in relation to the New Zealand Security Intelligence Service Amendment Bill emphasising the inadequacy of public reporting obligations in relation to interception warrants, 9 February 1999. This report, and others by the Commissioner referred to in these footnotes, is available on the Commissioner's web site.
3. Report by the Privacy Commissioner to the Minister of Justice in relation to the New Zealand Security Intelligence Service Amendment Bill (No 2) concerning amendments to the law on interception warrants and the establishment of a Commissioner of Security Warrants, 12 April 1999.
4. See briefing resource document by the NZ Police to the Minister of Police, December 1999.
5. Report by the Privacy Commissioner to the Minister of Justice in relation to the Penal Institutions Amendment Bill (No 2) monitoring inmate telephone calls, 2 August 1999.
6. http://www.ecommerce.govt.nz. The "freezer ship book" is available at that site and there are links to, amongst others, the Law Commission and Privacy Commissioner sites.
7. http://www.lawcom.govt.nz/pub_index.html
8. http://www.lawcom.govt.nz/pub_index.html
9. The "unpublished roll" refers to entries suppressed for personal safety reasons.
10. Electoral Law Committee, Interim Report on the Inquiry into the 1996 General Election, House of Representatives, 1998, p 29.
11. The Privacy Commissioner's report to the Commerce Committee on the bill can be found at http://www.privacy.org.nz.
12. Discharge without conviction is allowed for first offenders where they are though unlikely to offend again if given a second chance.