Privacy Commissioner (New Zealand)

Privacy Commissioner
Te Mana Matapono Matatapu
Agency overview
Formed 1993
Agency executive
  • John Edwards, Privacy Commissioner
Key document
Website www.privacy.org.nz

The Office of the New Zealand Privacy Commissioner was established to administer the Privacy Act 1993.[1] The Privacy Commissioner is entrusted to protect personal information of New Zealanders in accordance with the Privacy Act.

The Privacy Commissioner oversees personal information held by agencies in both the public and private sectors.[2] This is achieved through monitoring compliance with the twelve Information Privacy Principles and four Public Register Privacy Principles established under the Privacy Act.[3] Amid his varied responsibilities, the Commissioner administers a complaint system and issues Codes of Practice or rules for particular industries, contexts and sectors.[4] Most cases involve investigation, conciliation and settlement.[5] Serious breaches are referred to the Human Rights Review Tribunal.[6] The Commissioner inherently considers international obligations and worldwide developments in privacy protection.

The New Zealand Law Commission have made a number of recommendations to alter the functions, roles and powers of the Commissioner.[7]

History

The current Privacy Commissioner John Edwards

The now repealed Privacy Commissioner Act 1991 established the role of the Privacy Commissioner. The Commissioner had a principal role in the development of the Privacy Bill 1993, which passed into law as the Privacy Act 1993 and established the revised Office of the Privacy Commissioner.[8]

Past privacy commissioners

The previous Privacy Commissioner Marie Shroff

The Office of Privacy Commissioner has been held by:[9]

Privacy Act 1993

The Privacy Act 1993 is primarily concerned with information privacy; other aspects of privacy are protected by the common law right to privacy in New Zealand. The Act controls the collection, use, disclosure, storage and granting of access to personal information by agencies.[10] Personal information covers any information about an identifiable natural person.[11]

The Privacy Act was enacted in an era of heightened national awareness for human rights, and sits alongside the New Zealand Bill of Rights Act 1990 and the Human Rights Act 1993. The Privacy Act similarly addressed international concerns,[12] acknowledging privacy obligations under the Universal Declaration of Human Rights,[13] and the International Covenant on Civil and Political Rights.[14]

The Privacy Act extended protection to “any person or body of persons whether corporate and unincorporate,” in both the public and private sectors.[15] Inclusion of the private sector was considered revolutionary. The Commissioner thus oversees government departments, companies, religious organisations, and schools.[16] Some limited exemptions to the Privacy Act exist: the sovereign, the House of Representatives, courts and tribunals acting in judicial capacity, news medium activities, and individuals holding personal information for private use.[17]

The Information Privacy Principles (IPPs), monitored by the Commissioner, are based on guidelines established by the Organisation for Economic Co-operation and Development (OECD) in 1980.[18] The IPPs cover:[19]

In ANZ National Bank Ltd v Tower Insurance, the High Court held the privacy principles require that personal information can only collected be for “a lawful purpose and is necessary for that purpose.”[20] The principles do not outline their practical application, giving the Commissioner flexibility to deal with varying fact situations as they arise.[21]

The four Public Register Privacy Principles (PRPPs) cover any “register, roll, list or other document” held by governmental or quasi-governmental agencies under Schedule 2 of the Privacy Act, to which the public has statutory rights of access.[22] The PRPPs restrict the use of information compulsorily supplied from the public register.

In exceptional circumstances, when the Privacy Commissioner is satisfied the public interest outweighs privacy protection, agencies can be authorised to use personal information in a manner that would usually breach the IPPs or other provisions under the Act.[23]

Roles, functions and powers

The Office of the Privacy Commissioner is an Independent Crown Entity, funded by the state but acting independently of government or Ministerial control.[24] In addition to monitoring compliance with the IPPs and PRPPs, the Commissioner’s roles are extensively outlined in Section 13 of the Privacy Act. The central focus is to better protect the privacy of individuals, and includes:[25]

Functions listed elsewhere in the Act include consultation with the Ombudsman, Health and Disability Commissioner and the Inspector General of Intelligence and Security, and publishing personal information directories.[26] The Commissioner is conferred functions in several other enactments, which can be categorised as:[27]

The Commissioner must deliver an annual report on his roles, powers and functions.[28] Examples from the 2012/2013 report include contributions to the GCSB Amendment Act 2013, Privacy Amendment Act 2013 and the Social Security (Benefit Categories and Work Focus) Amendment Act 2013, nationwide workshops for government agencies addressing major data breaches, primary school resources, and media releases on topics including cloud computing and identity.[29] Media releases in 2014 provided an advisory note to agencies on the Heartbleed virus,[30] and a report criticising Veda Advantage’s charge rate for urgent information requests.[31]

Complaints and decisions

The Privacy Commissioner can investigate potential breaches of the IPPs, PRPPs, or other Privacy Act provisions, on his or her own initiative or on receipt of a complaint.[32] The onus is on the complainant to establish that an agency’s action both breached a privacy principle and caused harm.[33] Harm can include financial loss, adverse effect on rights or interests, or a significant injury to feelings. Breaches of principles 6 and 7, the refusal to grant access to or allow correction of information, need not establish harm as these situations are considered interferences per se.[34] The Commissioner can decide to take no action based on issues of time, triviality, bad faith, or if another course of action is more appropriate.

Should the Commissioner decide to pursue a complaint, his role is both investigatory and conciliatory. With this mediation rather than litigation focus, the Commissioner can call “compulsory mediation conferences,"and seek a resolution agreement and assurance of non-recurrence.[35] The Office aims to settle 30 percent of cases annually.[36] Both parties to a complaint must be informed of the commencement of proceedings and the result of an investigation. The Commissioner has no power to force compensation payments from an agency, dismiss an employee or prosecute anyone.[37]

In the 2011/2012 year, the Commissioner received 1,142 complaints, 1,026 of which were closed.[38] In the 2012/2013 year there were substantially fewer, 824, complaints.[39] Of the 896 cases closed in 2012/2013, 36 percent were settled.[40] Outcomes mostly included information being released or partly released, followed by the giving of assurances, an apology, a change of policy, correction of information, and monetary payment. The majority of complaints involved a breach of the IPPs, ahead of the Health Information Privacy Code.[41] The actions of government agencies, including education providers and local authorities, trigger most complaints, followed by health sector agencies.

Where settlement is unobtainable or an agency repeatedly contravenes prior assurances, the Commissioner may refer the complaint to the Director of Human Rights Proceedings.[42] The Director has the discretion to determine whether the Human Rights Review Tribunal should institute proceedings.[43] Aggrieved individuals may also self-refer proceedings before this body.If satisfied of privacy interference, the Tribunal may issue a declaration, grant orders restraining repeated interference or requiring specific acts be performed, award compensatory damages up to $200,000 NZD, or give another appropriate remedy.[44] Where the powers of the Tribunal are exceeded, remedial instructions may be referred to the High Court or extended remedial powers conferred on the Tribunal by written agreement between the parties.[45] Case notes and Tribunal decisions are published on the Commissioner’s website.

The Commissioner does not operate a system of binding precedent in the outcomes of his decisions, instead considering each case independently.[46] The IPPs, except principle 6, and the PRPPs are not enforceable in a law court.[47] The Privacy Act however does not preclude complainants from taking court action for a breach of the common law right to privacy where the Commissioner has dealt with a statutory complaint on the same issue.[48]

Codes of Practice

As the IPPs are generally worded, the Commissioner may issue more specific Codes of Practice for different “industries, agencies activities or types of personal information.”[49] The codes modify the application of the Privacy Act, including less or more stringent rules than contained in the privacy principles, as is appropriate. Extensive advertisement, consultation and invitation for submissions are stipulations. Codes must be approved as delegated legislation by the House of Representatives.[50] Thereafter the codes become enforceable under the Act and the same complaints process applies. Further remedies may be available for breaches of legislation related to a particular industry. The Privacy Commissioner commends the codes as a flexible means of regulation, more readily capable of amendment or revocation than legislative provisions.[51] Current Codes of Practice include the Health Information Privacy Code, Telecommunications Information Privacy Code and the Credit Reporting Privacy Code. In 2013 the Civil Defence National Emergencies (Information Sharing) Code was created.[52]

International

New Zealand’s Privacy Commissioner participates internationally to promote global co-ordination in privacy protection. Such forums include the International Conference of Data Protection Commissioners,[53] APEC’s Cross Border Privacy Arrangement,[54] and the Global Privacy Enforcement Network.[55] The Commissioner’s Annual Report 2013 emphasised the need for cross-border protection given the accessibility of private information online.[56]

In December 2012, New Zealand gained international approval for its privacy protection from the European Commission. The Commission stated that the Privacy Act and common law “cover all the basic principles necessary for an adequate level of protection for natural persons, and also provide for exemptions and limitations in order to safeguard important public interests."[57] The invaluable role of the Commissioner, commended for the position’s independence and adequate powers to protect individual privacy, was also noted.[58]

Looking ahead

The Privacy Commissioner has an important role as a “privacy watchdog” in an information-rich society of ever-changing technologies.[59] The Office of the Privacy Commissioner is anticipating reforms to New Zealand’s 20-year-old privacy legislation, as recently occurred Australia with changes to their privacy law. According to the Privacy Commission, reforms to privacy law would take account of developments in “technology, people, processes, and governance and assurance measures.”[60] A number of changes have been recommended both by former Commissioners and the New Zealand Law Commission.

In the first five-yearly review, Necessary and Desirable, Commissioner Bruce Slane set out 154 recommendations to reform the Privacy Act 1993.[61]

The Law Commission’s Review on Privacy proposed several substantive alterations to the roles, powers and functions of the Commissioner. These include:

To date, these recommendations have not resulted in significant legislative reform to the Commissioner’s role.

References

  1. ↑ Privacy Act 1993, s 12 in Steven Penk and Rosemary Tobin Privacy Law in New Zealand at 54.
  2. ↑ Privacy Act 1993, s 2(1)(a) in Steven Penk and Rosemary Tobin Privacy Law in New Zealand at 58.
  3. ↑ Privacy Act 1993, s 13(1)(b) and (e) in New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 at [5.3].
  4. ↑ Privacy Act 1993, ss 13(1AA)(d) and s46(1) in New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 at [5.4].
  5. ↑ Steven Penk and Rosemary Tobin Privacy Law in New Zealand at 51.
  6. ↑ Privacy Act 1993, s 77 in New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 at [5.4].
  7. ↑ New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 (R123, 2011) Part 1, Chapter 5.
  8. ↑ Privacy Act 1993, Long Title and s 12 in Steven Penk and Rosemary Tobin Privacy Law in New Zealand at 54.
  9. ↑ Office of the Privacy Commissioner About Us: Introduction. Retrieved 2 May 2014.
  10. ↑ Office of the Privacy Commissioner Privacy Act & Codes: Introduction. Retrieved 2 May 2014.
  11. ↑ Steven Penk and Rosemary Tobin Privacy Law in New Zealand at 59.
  12. ↑ Ursula Cheer and John Burrows Media Law in New Zealand at 374.
  13. ↑ Universal Declaration of Human Rights 1949, Article 12.
  14. ↑ International Covenant on Civil and Political Rights 1976, Article 17.
  15. ↑ Privacy Act 1993, s2(1)(a) in Steven Penk and Rosemary Tobin Privacy Law in New Zealand at 58.
  16. ↑ Office of the Privacy Commissioner Privacy Act & Codes: Introduction. Retrieved 2 May 2014.
  17. ↑ APEC Cooperation Arrangement for Cross-Border Privacy Enforcement Summary Statement of Privacy Enforcement Authority enforcement practices, policies and activities at 1.
  18. ↑ OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, Part II: Guidelines.
  19. ↑ Office of the Privacy Commissioner Privacy Acts & Codes: A Thumbnail Sketch of the Privacy Principles. Retrieved 2 May 2014.
  20. ↑ ANZ National Bank Ltd v Tower Insurance (2009) 15 ANZ Ins Cas 61-816 at [171].
  21. ↑ Ursula Cheer and John Burrows Media Law in New Zealand at 375.
  22. ↑ Steven Penk and Rosemary Tobin Privacy Law in New Zealand at 67 – 68.
  23. ↑ Office of the Privacy Commissioner Privacy Act & Codes: Introduction. Retrieved 2 May 2014.
  24. ↑ Office of the Privacy Commissioner About Us: Introduction. Retrieved 2 May 2014.
  25. ↑ Office of the Privacy Commissioner Statement of Intent 2012 – 2015 (2012) at 4 – 5; Steven Penk and Rosemary Tobin Privacy Law in New Zealand at 63.
  26. ↑ Privacy Act 1993 ss 21, 36 and 117 – 177B in New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 at [5.3].
  27. ↑ New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 (R123, 2011) at [5.6].
  28. ↑ Privacy Act 1993, s 14. The importance of which was stated by the Court of Appeal in Harder v Proceedings Commissioner (2000) 6 HRNZ 173; [2000] 3 NZLR 80 at [23].
  29. ↑ Privacy Commissioner's Annual Report 2013 – A Year of Rapid Change at 19 – 20 and 37.
  30. ↑ Office of the Privacy Commissioner Heartbleed Advisory Note (10 April 2014). Retrieved 2 May 2014.
  31. ↑ Office of the Privacy Commissioner Report into Veda Advantage's Charge for Urgent Requests for Personal Information (24 March 2014). Retrieved 2 May 2014.
  32. ↑ Privacy Act 1993, ss 61 and 69(2) in Steven Penk and Rosemary Tobin Privacy Law in New Zealand at 63.
  33. ↑ Privacy Act 1993, s 66(1) in New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 at [6.3].
  34. ↑ Privacy Act 1993, s 66(2) in New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 at [6.3].
  35. ↑ Ursula Cheer and John Burrows Media Law in New Zealand at 375.
  36. ↑ Privacy Commissioner's Annual Report 2013 – A Year of Rapid Change at 23.
  37. ↑ Office of the Privacy Commissioner Your Privacy: How to Complain. Retrieved 2 May 2014.
  38. ↑ Privacy Commissioner's Annual Report 2013 – A Year of Rapid Change at 23.
  39. ↑ Privacy Commissioner's Annual Report 2013 – A Year of Rapid Change at 23.
  40. ↑ Privacy Commissioner's Annual Report 2013 – A Year of Rapid Change at 23.
  41. ↑ Privacy Commissioner's Annual Report 2013 – A Year of Rapid Change at 24.
  42. ↑ Privacy Act 1993, s 77(2) in New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 at [6.7].
  43. ↑ Privacy Act 1993, ss 77(3) and 82 in New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 at [6.9].
  44. ↑ Privacy Act 1993, ss 85(1) and 88(1); Human Rights Act 1993, s 92Q; District Courts Act 1947, s 29 in New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 at [6.16].
  45. ↑ Human Rights Act 1993, ss 92R – W.
  46. ↑ Steven Penk and Rosemary Tobin Privacy Law in New Zealand at 77.
  47. ↑ Privacy Act 1993, ss 11(2) and 62 in New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 at [6.2].
  48. ↑ A v Hunt (Contempt) [2006] NZAR 577 at [62].
  49. ↑ Office of the Privacy Commissioner Privacy Act & Codes" Codes of Practice. Retrieved 2 May 2014.
  50. ↑ Privacy Act 1993, s 50 in New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 at [5.56].
  51. ↑ Office of the Privacy Commissioner Privacy Act & Codes" Codes of Practice. Retrieved 2 May 2014.
  52. ↑ Privacy Commissioner's Annual Report 2013 – A Year of Rapid Change at 38.
  53. ↑ 35th International Conference of Data Protection and Privacy Commissioners Privacy: A Compass in Turbulent World.
  54. ↑ APEC Cooperation Arrangement for Cross-Border Privacy Enforcement Summary Statement of Privacy Enforcement Authority enforcement practices, policies and activities at 1.
  55. ↑ Office of the Privacy Commissioner About Us: International. Retrieved 2 May 2014.
  56. ↑ Privacy Commissioner's Annual Report 2013 – A Year of Rapid Change at 17.
  57. ↑ Privacy Commissioner's Annual Report 2013 – A Year of Rapid Change at 18; European Commission Implementation Decision C(2012)9557 (19 December 2012) at [10].
  58. ↑ European Commission Implementation Decision C(2012)9557 (19 December 2012) at [10].
  59. ↑ Privacy Commissioner's Annual Report 2013 – A Year of Rapid Change at 109.
  60. ↑ Office of the Privacy Commissioner Private Word (Issue 88, April 2014). Retrieved 2 May 2014.
  61. ↑ First Periodic Review of the Operation of the Privacy Act 1993 Report: Necessary and Desirable (15 May 2008).
  62. ↑ New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 (R123, 2011) at R 47 and R 51.
  63. ↑ New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 (R123, 2011) at [5.13].
  64. ↑ New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 (R123, 2011) at R 49.
  65. ↑ New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 (R123, 2011) at R 50.
  66. ↑ New Zealand Law Commission Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4 (R123, 2011) at R 52 and R 53.
This article is issued from Wikipedia - version of the 7/11/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.