2 August 2011

A package of new proposals from the Law Commission will make privacy law more equal to the task of protecting New Zealanders' personal information in the digital age, said Privacy Commissioner Marie Shroff. 'These reforms will power up our 18 year old privacy law to bring it more in line with world class standards of protection New Zealanders are entitled to expect. It will give people more power to control their own information.

'Since the Privacy Act was passed 18 years ago we have seen huge technology-driven changes. The Law Commission recognises that individual New Zealanders have countless new opportunities from technological developments, but that there are also real risks,' said Marie Shroff.

'People's information can be lost or hacked; organisations collect huge amounts of our confidential information and then fail to protect it; individuals can breach other's privacy by highly offensive internet postings. The law needs to be flexible and strong enough to be able to deal with these kinds of problems', Marie Shroff said.

Some Law Commission proposals to help protect individual New Zealanders are:

Privacy Breach Notification

The Law Commission has recognised that occasionally things do go wrong and personal data is lost or hacked into. At the moment, people are not necessarily told, and so are put at risk of identity theft or other harms.

'The proposal is that people must be told when there is a serious data breach that affects them, and they need to take steps to protect themselves, like cancelling a credit card. The Law Commission has recommended a risk-based approach, to avoid notification overload. I think they've got the balance about right,' said Marie Shroff.

Class Actions to Tackle Systemic Harm

Another change would see groups of people able to bring 'class actions' and privacy complaints. 'This recommendation reflects the reality of many privacy breaches nowadays. We see plenty of instances, such the Sony Playstation customer data breach recently, when one systemic problem affects thousands of people. We urgently need to have an efficient way of tackling these cases', said Marie Shroff.

Faster Dispute Resolution

The Law Commission has proposed major changes to privacy dispute resolution. A key feature would see the Privacy Commissioner determining access complaints (where a person seeks their own information), and being able to direct an agency to release the information. This can arise, for example, when you wish to change your doctor, lawyer or accountant and your information is withheld because there may be a dispute about your bill. The Commissioner would be able to take cases directly to the Human Rights Review Tribunal to hear all types of privacy complaints. 'Quicker, streamlined dispute resolution would bring real benefits to individuals,' said Marie Shroff.

Getting Problems Fixed Quickly

The Law Commission has put forward the low-cost, low-resource suggestion of a compliance notice to target those agencies that persistently flout the law. Some agencies may poorly protect, unwisely disclose or even on-sell individual information. 'This targeted tool would mean we could fix problems quickly and protect people's personal details from loss or misuse. Responsible businesses are already protecting information. But this will put everyone else on notice that serious information mishandling will have consequences,' Marie Shroff said.

Closing off Offensive Internet Postings

Loopholes that exist at the moment around the publication of highly offensive material online would be closed under one of the new proposals. People would in future be able to complain and potentially get offensive material taken down from the internet. 'We know of cases, for instance, where people have posted intimate photographs of former partners online, and as the law currently stand there is very little we can do about that', said Marie Shroff.

'Do-Not-Call' Register

Recommendations included a setting up a statutory 'Do-Not-Call' register, to stop unwanted tele-marketing calls. 'This is something that some New Zealanders find very intrusive and bothersome. The Law Commission's proposal puts some control back in their hands', Marie Shroff said.

Other Law Commission proposals to protect individual New Zealanders are:

• additional protections to be built into the law to cover victims of offences, their families, and people subject to serious harassment.

• regulating surveillance, interception and tracking through a new Surveillance Devices Act.

'Overall, the Law Commission has decided the Privacy Commissioner needs the right tools to do the job. It's really a case of using modern tools to fix modern problems', Marie Shroff noted.

'I welcome this final report in the Law Commission's 4-year, 4-stage review of privacy and congratulate the Law Commission on their thoughtful approach and innovative recommendations', said Marie Shroff.

ENDS

For more information contact: Annabel Fordham: 021 509 735.
Copies of all the Law Commission's reports on privacy are available at: www.lawcom.govt.nz