Sitting date: 3 Apr 2025

PRIVACY AMENDMENT BILL

Third Reading

Hon NICOLE McKEE (Associate Minister of Justice) on behalf of the Minister of Justice: I present a legislative statement on the Privacy Amendment Bill.

DEPUTY SPEAKER: That legislative statement is published under the authority of the House and can be found on the Parliament website.

Hon NICOLE McKEE: I move, That the Privacy Amendment Bill be now read a third time.

The purpose of the Privacy Act is to provide a framework for the protection of an individual's right to privacy and to give effect to internationally recognised privacy obligations and standards with regard to personal information. This bill will uphold that purpose. Its main objective is to improve transparency for individuals about the collection of their personal information and better enable people to exercise their privacy rights. It achieves this by introducing a new obligation on agencies who collect personal information indirectly by third party.

This change is reflected in Part 1 of the bill, which amends the Privacy Act 2020 to introduce a new information privacy principle: 3A. Agencies must now take reasonable steps to ensure that an individual is aware of the indirect collection of their personal information, as well as the purpose for which that information has been collected, the intended recipients of that information, and their rights under the Privacy Act information privacy principles. In making these changes, the bill updates New Zealand's privacy laws to be in line with international best practice. Many countries, including Australia and the United Kingdom, already require notification where information is collected indirectly.

I want to draw the House's attention to the origin story of this bill. Since 2012, New Zealand has held European Union "adequacy" status—one of only 15 jurisdictions to do so. This is an assessment from the European Union that New Zealand's privacy framework affords comparable protections to its own, and is a vote of confidence in our law. Holding EU adequacy means Kiwi businesses looking to work with their counterparts in the European Union are able to share information without more onerous contractual requirements. It provides what one submitter on this bill called "a mini free-trade agreement" for the cross-border flow of personal information.

In its first review of our adequacy status, the European Union highlighted a transparency gap in our Privacy Act where personal information is collected indirectly. This bill represents the missing piece of the puzzle that is needed for us to maintain our prized "adequacy" status. As I've already mentioned, the bill will improve transparency about who is collecting our personal information, and that is important. Knowing which agencies hold information can empower people to exercise their privacy rights.

The bill also makes a number of technical amendments to address some minor issues that have arisen since the principal Act came into force. These small fixes will improve the operation of the Act and make it more workable for agencies.

Some time has passed since the bill was originally introduced in 2023 and I want to acknowledge the many people who have been involved in the process, including legal and privacy professionals, former and current members of this House, and the Office of the Privacy Commissioner.

I'd like to thank again the members of the Justice Committee for its work in considering this bill. The committee received 55 submissions on the bill, including a significant contribution from galleries, libraries, archives, and the museum sector. The major change to the bill at select committee was the addition of an exception for archiving in public interest, and I know Minister Goldsmith was pleased to see how the committee incorporated the submissions from this sector into its report.

As acknowledged at second reading, the new requirement in the bill will mean that some agencies may need to make additional effort to comply with the Act. There are several design features of the new information privacy principle which aim to reduce unnecessary compliance burden while upholding the privacy of individuals.

At second reading, Government shared with the House its intention to submit an Amendment Paper to maintain a six-month implementation period for the new information privacy principle to help agencies prepare to comply. It has since been decided to extend this period to a full year. A 12-month implementation period will allow agencies more time to get up to speed on what compliance with the new principle looks like for them. I'd like to thank the House for agreeing to this Amendment Paper during the committee of the whole House last week.

Finally, I want to acknowledge the Office of the Privacy Commissioner, which is developing guidance for agencies on applying the new privacy principle. The Office of the Privacy Commissioner is carrying out targeted engagement to understand what issues matter most to agencies when thinking about compliance with the new principle. More information about this can be found on its website.

In conclusion, it is important that New Zealand maintains our commitment to strong privacy protections, both for individuals and for the businesses that benefit from our privacy framework being aligned with international data protection standards. This bill supports us to achieve that, and I commend this bill to the House.

DEPUTY SPEAKER: This debate is interrupted and set down for resumption next sitting day. The House stands adjourned until 2 p.m. on Tuesday, 8 April 2025.

Debate interrupted.

The House adjourned at 6 p.m.

© Scoop Media