Our website uses cookies so we can analyse our site usage and give you the best experience. Click "Accept" if you’re happy with this, or click "More" for information about cookies on our site, how to opt out, and how to disable cookies altogether.

More Accept ×

We respect your Do Not Track preference.

Close ×

opc header logo

Print | Email this page

Annual Report of the Privacy Commissioner 2024

Read the full 2024 Annual Report (opens to PDF).

Michael Webster is New Zealand's Privacy Commissioner"Thousands of times each day New Zealanders provide their personal information in exchange for goods and services. They could be face-to-face with a small business or online with a large government department. All of these exchanges involve privacy.

A society that values privacy and personal information is one where its people can have greater trust in government and businesses because they know their information will be looked after. This Annual Report is the first under theStatement of Intent 2023–2027, which sets my Office’s purpose as ensuring that privacy is a core focus for agencies. We do this to protect the privacy of individuals, enable agencies to achieve their own objectives, and safeguard a free and democratic society.

Our strategy is to push us towards the four objectives set out in the Statement of Intent:

  1. We will work in partnership with Māori to take a te ao Māori perspective on privacy.
  2. We will engage and empower people and communities who are more vulnerable to serious privacy harm.
  3. We will set clear expectations to provide agencies with greater certainty about their responsibilities.
  4. We will promptly use our full range of investigation and compliance powers to hold agencies accountable for serious privacy harm.

It is my belief that achieving these objectives over the next few years will improve privacy outcomes for New Zealand. While it is early days yet, there are some promising signs of success in this report. For example, our biennial public survey of New Zealanders has shown a slight increase in public awareness of their right to access personal information under the Privacy Act 2020 (the Act)." 

~ Michael Webster, Privacy Commissioner

A brightly coloured table of annual data from OPC. The text says, 10003 total privacy complaints received. 864 total privacy breach notifactions. 724 privacy complaints received for a 'fast reponse' approach. 414 serious privacy breaches notified. 279 privacy complaints received for investigation. 3385 call centre privacy enquiries. 2751 in-house privacy enquiries. 899,670 visits to our website. 199 media enquiries.


Our strategic framework introduced this year

A diagram of the organisation's straetgic framework.


The weaving of a cloak, the weaver of people

Our Statement of Intent introduced the whakataukī of tuitui kākahu, tuitui tāngata – it speaks to the process of weaving a kākahu or traditional Māori cloak and aligns that to the weaving of people.

It is a whakataukī that works well in describing the privacy system, the role of the Office of the Privacy Commissioner (OPC), and the place of Te Tiriti o Waitangi. This includes:

  • tiaki – protecting and safeguarding the privacy of all New Zealanders 
  • taunaki – supporting the aspiration of rangatiratanga as expressed by Māori over their taonga, their data, and their privacy
  • tūhono – partnering with Māori.

Tuitui kākahu, tuitui tāngata describes the process of weaving and the completion of the garment, or cloak that can then be used by individuals, whānau, hapū, iwi, and Māori to protect their privacy. Tuitui kākahu, tuitui tāngata represents how the principles of Tiriti o Waitangi and the Act work together to achieve the outcomes of the privacy system.

An illustration of a woven panel with three sides. The top says 'privacy system outcomes.' The left side says 'privacy act principles' and the right side says 'Tiriti o Waitangi principles.'


Privacy benefits all New Zealand

We have set our purpose as ‘ensuring that privacy is a core focus for agencies’ because we believe it’s the best way to improve the outcomes of the privacy system. OPC’s interventions are designed to drive improvements to the privacy understanding and capabilities of agencies and to increase the priority and importance of privacy in their decision making.

Our indicators on the performance of the privacy system and privacy outcomes are outlined in the section, ‘Progressing toward our objectives and privacy outcomes’.

The privacy system contributes to three important outcomes for New Zealand.

An illustration of two hands shaking with a dollar sign over top. The text says 'the average settlement amount for emotional harm or injury to feelings is $20,000.'1. Individuals are more confident that their privacy is protected

When people trust that their personal information will be treated as a taonga, it gives them confidence in an agency.

Good privacy practices reduce the likelihood of a breach happening, and if it does occur, they reduce the harms caused by privacy breaches, whether emotional, reputational, financial, or physical. Where OPC helps settle a privacy complaint with a financial settlement, the average settlement amount is over $14,000. When the Human Rights Review Tribunal has considered privacy cases and determined there should be a financial settlement, the average settlement amount for emotional harm or injury to feelings is $20,000.

An illustration of a pie chart with a large 70% to the right of it. The text says, '[70%] of survey respondents would change service providers if they heard that their provider had poor privacy and security practices.'2. Agencies can better achieve their own objectives through respecting the privacy rights of New Zealanders

Agencies use the personal information that people give to them to deliver goods or services, either for profit or as a public service.

Privacy breaches create high costs to agencies both in remedying what went wrong and, in some cases, reimbursing customers. It can also impact the ability of the business to deliver products or services, as important data may have been lost, and there could be a loss of existing customers or clients. In our 2024 survey of New Zealanders’ attitudes to privacy, 70% of respondents said they would likely change service providers if they heard that their provider had poor privacy and security practices (an increase of 7% from 2022).

3. The right to privacy and the protection of personal information is valued in New Zealand

The outcomes of the privacy system extend beyond the interactions of individuals and agencies.

Collectively, a society that values privacy and personal information is one where its people can have greater trust in government and institutions because they know that the information that is precious to them will be well treated. This trust helps drive better outcomes by encouraging engagement in democratic and consultation processes, helping to inform the design of effective services, and tackling complex problems. This trust is especially important for whānau, hapū, and iwi in achieving their aspirations for equitable outcomes and data sovereignty. We contribute to this trust through our statutory independence that provides the public with a ‘watch dog’ who advocates on their behalf.

Read our content about how privacy benefits all New Zealand has a PDF (page 9 and 10 of the 2024 Annual Report).

We need Privacy Act modernisation

The need for change is increasingly urgent

We proposed four specific amendments to the Act
We have recommended a specific set of amendments to the Act to the new Government that would further modernise it and strengthen privacy outcomes.

Modernising the Act is required because the 2020 Act was based on work completed in 2011 by the Law Commission. Since then, there have been significant technological advancements that we need to keep pace with. Like-minded countries have been modernising their privacy regimes to capture the benefits and avoid the harms of new technologies.

Most countries have explicitly higher protections for sensitive information such as biometrics. The Act’s protections are only implicitly higher through terminology such as “security safeguards as are reasonable in the circumstances”. Biometric technologies are increasingly used and are associated with a range of privacy risks. While OPC is assessing the tools we can apply under the Act to better protect the biometrics of New Zealanders, the cross-cutting issues raised by biometrics are such that legislative amendments may also be necessary to safeguard this sensitive personal information.

The Act also provides insufficient incentives for many agencies to understand or to meet even the basic privacy requirements, leading to non-compliance. For example, we have seen a growing number of small-to-medium sized agencies who do not establish policies and practices to effectively manage privacy impacts of their activities or have failed to appoint a privacy officer.		 1. Empowering New Zealanders to better protect themselves with new rights, such as a ‘right to erasure’ that would provide individuals withthe right to ask agencies to delete their personal information.

2. Establishing strong incentives for agencies to take privacy seriously through establishing a new and significantly stronger penalty regime.

3. Requiring agencies to be able to demonstrate how they meet their privacy requirements, such as the privacy management programmes recommended by the OECD.

4. Providing New Zealanders with stronger protections for automated decision making like artificial intelligence (AI), which can have issues with inaccurate predictions, discrimination, unexplainable decisions and a lack of accountability.

Read about the need for Privacy Act modernisation as a PDF (page 11 of the Annual Report).

Read other parts of our Annual Report 

A cover image for a section divider in the annual report. The text says 'office and functions' and that text is also translated into te reo. A cover image for a section divider in the annual report. The text says 'finance and performance' and is also translated into te reo. A cover image for a section divider in the annual report. The text says 'appendices' and is also translated into te reo.
Pages 40-44 of the 2024 Annual Report (opens to PDF). Pages 45-73 of the 2024 Annual Report (opens to PDF). Pages 74-88 of the 2024 Annual Report (opens to PDF).
Back to top