Updated on 01/02/2023: to include further information on the High Court’s second decision regarding the disclosure of Māori vaccination information”. 

If you’re reading this on your phone, you may have unlocked your device using your face or fingerprint. If so, you’re one of a growing number of people who regularly interact with biometric technologies.

Technology developments can be challenging to privacy laws. We all know our phones are powerhouses of data collection, and that our data is the key asset for big tech. But we don’t always know what data is being collected, nor how it is being used.

Under the Privacy Act, the Human Rights Review Tribunal (“the Tribunal”) can award damages for emotional harm caused by a privacy breach. Damages are compensatory rather than punitive; the goal is to compensate individuals for specific harm rather than punish a defendant’s bad behaviour.

In recent weeks, the Office of the Privacy Commissioner has been contacting individual organisations about specific privacy breaches that have been raised with us. We’re taking a more proactive approach to remind and warn individual organisations of their statutory responsibilities under the Privacy Act 2020.

The Privacy Act empowers the Privacy Commissioner to receive complaints about breaches of the Privacy Act. The Act compels the Office of the Privacy Commissioner (OPC) to focus on settling complaints and preventing any issues they give rise to from re-occurring.

A recent decision by the Human Rights Review Tribunal (HRRT) illustrates how other legislation can interact with and override the Privacy Act.

A woman worked as a receptionist for Manawatū Community Law Centre (the Centre) on a one-year contract. During her employment she alleged workplace bullying and harassment and filed personal grievance claims.