Review of the Law of Privacy

The Commission's Issues Paper, Public Registers - Review of the Law of Privacy: Stage 2 (IP3) is the consultation part of Stage 2 of the Law Commission’s review of privacy.

The Commission's Report, Public Registers: Review of the Law of Privacy stage 2 (R101) identifies well over one hundred public registers in New Zealand, including rates databases and dog registers, land registers transport registers, the electoral rolls, births, deaths and marriages registers. Regulating the balance between open access to the registers and protection of personal information varies greatly. The Commission recommends that a dedicated team should review all public registers against a template set out in the report. Recommendations for resulting legislative changes should then be introduced by way of a single Omnibus Bill. However, the Commission’s recommendation for a public register review will not be considered by the Government until the Commission’s reference on the Privacy Act 1993 is completed.

The Commission's Issues Paper, Invasion of Privacy: Penalties and Remedies (IP14) looks at a range of issues in relation to the Privacy Act 1993, including the scope and approach of the Act; the role of the Privacy Commissioner; complaints and enforcement processes; sharing of personal information between government agencies; the implications of technological developments; and direct marketing.

The Commission's Issues Paper, Review of the Privacy Act 1993 (IP17) looks at a range of issues in relation to the Privacy Act 1993, including the scope and approach of the Act; the role of the Privacy Commissioner; complaints and enforcement processes; sharing of personal information between government agencies; the implications of technological developments; and direct marketing. The issues paper makes some proposals for reform on which it seeks submissions, and also asks some open-ended questions

The Commission's Report, Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 (R123), which calls for new powers for the Privacy Commissioner, is the fourth in the Commission’s four-stage review of New Zealand’s privacy laws.

The report focuses on the Privacy Act 1993.  Overall, the Commission believes the main principles of the Act remain sound.  Rather than setting strict rules, the Act is based on privacy principles that can be applied flexibly to suit an agency’s particular circumstances. The Commission supports this principles-based approach, which also allows the Act to remain relevant as technology changes.

The Commission thinks the Act could be improved in a number of areas.  Among the key recommendations of the report are that:

• the Privacy Commissioner’s powers should be augmented by a  new power to issue compliance notices, and, where there is a good reason for it, to require an audit of an agency’s information-handling practices;
• the complaints process under the Act should be streamlined in a number of respects, including giving the Privacy Commissioner the power to make binding decisions on complaints about people’s right to access their own personal information;
• agencies should be required to notify people when personal information held by an agency is lost or otherwise compromised (for example, through computer hacking), if the breach is sufficiently serious;
• there should be a new framework in the Act to allow the sharing of personal information between government agencies where it is in the public interest to do so, but with appropriate safeguards; and
• some exceptions to the privacy principles should be modified; for example, to clarify that people can pass on information to an appropriate person where someone’s health is seriously at risk, or report suspected offending to the police.