Cast your mind back to 2013. Same-sex marriage was legalised in NZ, we learnt more about the activities of the NSA than we ever cared to know, Prince George was born, Margaret Thatcher died and our long Marmite (marmageddon) nightmare finally ended.

2013 also marked the year the New Zealand Customs Service began reviewing its 17-year-old legislation, the Customs and Excise Act 1996. It is now 2017 (nearly 2018), the Customs and Excise Act is 21 years old and the Customs and Excise Bill has just had its second reading in Parliament.

Our office has been involved in the Customs and Excise Act’s review since its inception. We are pleased that following the Foreign Affairs Defence and Trade Committee’s consideration of the Bill, New Zealanders are going to have:

• clearer legislation governing the searching of their electronic devices;
• greater protections for privileged information gained from these searches; and
• better oversight of Customs’ information sharing practices.

Electronic device searches

The border is our first line of defence against many threats. Customs needs the ability to fully investigate these threats, which can include examining electronic devices. However, it is also important that NZ Customs consider individual privacy.

We’ve talked about NZ Customs having access to people’s electronic devices like smartphones, tablets and laptops before – see here and here. Phones in particular are a touchy issue. In 2017, smartphones rule and often contain our lives. The information they hold is sensitive, highly personal and needs protection from prying eyes.

We were therefore pleased to see that the Bill reflects[1] the advice we gave Customs about requiring a threshold before a device is searched. The threshold is reflected in the two types of electronic device searches Customs officers can undertake under the Bill: an ‘initial search’ and a ‘full search’.

Initial search

For an initial search of an electronic device, the Bill requires Customs officers to have “reasonable cause to suspect” the person in possession of the device is or is about to be involved in the commission of an offence. An initial search means:

• the device may be searched manually or using software* that scans for objectionable images like child pornography;
• the transmitting function must be turned off; and
• Customs can’t keep any information gained from an initial search unless it shows evidence of offending.

Full search

To conduct a full search, Customs officers must have “reasonable cause to believe” the device contains evidential material about offending. A full search means:

• the device may be accessed and searched using any technology aid;
• the information contained in the device may be copied (including by cloning);
• the device may be detained in order to conduct the search;
• the search must not damage the device; and
• the transmitting function must be turned off.

Duty to assist

People having their device searched have a ‘duty to assist’ NZ Customs. This means that if your device is locked or encrypted, you must give the Customs officer the information or assistance they need to gain access. Failing to do so may result in a fine of up to $5,000 and your device being held (until access can be granted through other means).

Information sharing

The Bill also deals with NZ Customs’ ability to share information through direct access agreements, disclosures to New Zealand government agencies and disclosures to international government agencies.[2]  NZ Customs wanted:

-       an expanded ability for the Chief Executive to enter into a direct access agreement with any other government agency for a broad range of functions;

-       a new power for the Chief Executive to disclose information to any other government agency; and

-       the extension of an existing power to disclose “any information” overseas without any requirement to consider the relevant risks of that disclosure such as human rights considerations.

During the select committee process, the Privacy Commissioner made submissions that the information sharing clauses presented significant privacy concerns – our written submission can be found here. In short, we said:

-       the expanded ability for the Chief Executive to enter into direct access agreements should be removed as this can already be facilitated through the AISA provisions in Part 9A of the Privacy Act;

-       the new power for the Chief Executive to disclose information to any other government agency should be removed. Information disclosure could already be achieved through either an AISA or the regulation making power found in the Customs and Excise Act. The Commissioner noted that entering into information sharing agreements such as those proposed, without ministerial oversight, represented an inappropriate delegation of power to the Chief Executive and would inappropriately intrude on the privacy of New Zealanders; and

-       the extension of the power to share information overseas should be amended to restrict the information that Customs is able to disclose overseas, ensure adequate oversight and review of international information disclosures and require NZ Customs to consider the implications of the sharing such as torture or capital punishment. The Commissioner noted that NZ Customs collects a vast amount of sensitive information including political affiliation, sexual orientation and religion and that this could put persons at risk if shared with a less progressive country.

As a result of our submissions the Select Committee amended the Bill to provide for greater transparency and oversight of Customs information sharing. The amendments included:

-       agreements for direct access must be entered into by the Minister of Customs, specify why the accessing agency needs the information and how it will be accessed, have safeguards like audit and compliance regimes and proper procedures for access, use, disclosure and retention of information and require the Privacy Commissioner to be consulted on any new agreement;

-       the ability for the chief executive of NZ Customs to enter into a disclosure agreement with another agency is removed and reassigned to the Minister of Customs. The Privacy Commissioner is required to be consulted on any new agreement;

-       both the ability to enter into direct access agreements and disclosure agreements require the Minister to be satisfied of certain things, such as the reasonableness of the information to be accessed/shared and that there are adequate privacy safeguards;

-       international disclosure agreements can be reviewed at the request of the Commissioner.

We are grateful to Customs officials for their proactive engagement with our office and the constructive manner in which they approached our feedback.

The amendments to the power to search electronic devices and the information sharing provisions in the Bill are major improvements on the original draft and will help ensure that our borders can be properly protected while still protecting individual privacy. The Bill will be reported back for its Committee of the Whole reading in the House in 2018.  

* NB: Any technology aids used for an initial search must have completed a privacy impact assessment in consultation with the Privacy Commissioner.

Image credits:

Watching the watchers - Slane Cartoons

Customs logo via Wikimedia Commons.

customs & immigration