From the Office of the Privacy Commissioner of New Zealand:
Privacy law reform is urgently needed to prevent New Zealand falling further behind international standards, says Privacy Commissioner John Edwards in his Briefing to the Incoming Minister of Justice released today.
Mr Edwards says most existing privacy laws around the world have been reformed in the last three years or are currently being reviewed and updated.
Internationally, the most influential is the European Union (EU) General Data Protection Regulation (GDPR) that comes into force in May 2018 and affects Europe and many of New Zealand’s trading partners. The GDPR standards lift the baseline internationally in response to the challenges to consumers and data protection in the global digital economy.
In 2011, the New Zealand Law Commission’s comprehensive review of privacy made numerous recommendations for changes to the Privacy Act. These proposed changes were to enable the law to better keep pace with the rapid changes over the past 20 years to information and communications technology. The Government at the time accepted the majority of those recommendations.
Mr Edwards noted a new Privacy Bill was currently being drafted. His office has been closely engaged with officials throughout this process. The key changes in the draft legislation included:
- modernising the Privacy Act;
- empowering the Privacy Commissioner to issue a compliance notice in the event of a breach of the Act;
- empowering the Privacy Commissioner to issue a determination when a person has requested access to personal information under principle 6 and has been refused; and
- the introduction of mandatory reporting of serious data breaches, to bring New Zealand into line with international best practice.
In a subsequent review of the operation of the Privacy Act in 2016, the Privacy Commissioner provided a report to the previous Minister of Justice, recommending additional reforms, including the power to fine non-compliant agencies.
Mr Edwards says New Zealand has a competitive trade advantage because the EU has formally recognised that our privacy law meets current EU standards. This EU adequacy status allows the unrestricted transfer of European data for processing. “The current risk for New Zealand is that our Privacy Act has fallen behind international standards and the case for reforming it is clear and very evident.”
The Privacy Commissioner’s Briefing to the Incoming Minister of Justice is available here.