Evaluating the Privacy Act

Rt Hon Sir Geoffrey Palmer

President

Law Commission

Address to the Privacy Forum

Hotel Intercontinental, Wellington

27 August 2008

Introduction

The Law Commission has a four part review of privacy in its Work Programme:

Project 1 – Overview of privacy values, changes arising from technology, international trends and the implications for NZ.

Project 2 – The law relating to public registers in light of privacy considerations and emerging technology.

Project 3 – Adequacy of New Zealand’s civil and criminal law to deal with invasions of privacy.

Project 4 – Possible changes to Privacy Act 1993.

Parts 1 and 2 have been completed and the Reports published. Part 3 is being discussed by Professor John Burrows QC at this conference today. Part 4 concerns the Privacy Act 1993. A lot has occurred in the life of the Privacy Act but it has never before received an overall external review. The Law Commission aims to fill that gap.

Our task has been helped by the close co-operation we have enjoyed with the Australian Law Reform Commission. Just this month the Australian Commission produced its final report “For Your Information: Australian Privacy Law and Practice”. This represents the culmination of a 28-month inquiry into the extent to which the Privacy Act 1988, enacted by the Commonwealth Parliament, has continued to provide an effective framework for the protection of privacy in Australia. The quality of the analysis in the report is high and New Zealand will benefit from it.

The report was a mammoth undertaking. It has three volumes containing 74 chapters and 295 recommendations. The New Zealand Law Commission has had continuing discussions with its Australian counterpart. We have found their work very helpful in supplementing and aiding our research efforts. We shall be drawing on this massive report in the Issues Paper on the Privacy Act that we expect to issue next year.

It is important to remember, however, that there are features of the Australian landscape which are not present in New Zealand. The Australians have some problems that New Zealand lacks. In particular, Australia is a federation. While the Commonwealth has a privacy statute, so do many of the States. One of the great calls in the Australian report is for consistency across the various Australian jurisdictions. Fortunately we have one Parliament and one Privacy Act.

But, there may be benefit in consistency between us and Australia in this field of law. Important business is conducted on both sides of the Tasman. There are aspects of our privacy law that need to harmonise with Australian approaches in order to minimise the compliance costs of businesses. This is particularly the case, we think, in areas such as banking.

Furthermore, as the long title to the New Zealand Privacy Act makes clear, there are important transborder dimensions to the application of privacy legislation. The Privacy (Cross Border Information) Amendment Bill now before the House is a useful addition to our Act about which the Law Commission’s view was sought and we supported the Bill.

But New Zealand has its own political culture and its own ways of approaching regulation compared with Australia and the rest of the world. It is to our own Act that I now turn.

The Privacy Act

The Privacy Act 1993 was bold legislation in its time. It exhibited a somewhat experimental character. It was controversial when introduced but in the end its passage achieved unanimous support in the House. It would be good if any successor statute could receive the same degree of acceptance. The Law Commission will certainly aim to make recommendations that are broadly acceptable.

The objects of the Privacy Act are wide-ranging. The long title is worth full quotation.

“An Act to promote and protect individual privacy in general accordance with the Recommendation of the Council of the Organisation for Economic Co-operation and Development Concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data, and, in particular,—

(a) To establish certain principles with respect to—

(i) The collection, use, and disclosure, by public and private sector agencies, of information relating to individuals; and

(ii) Access by each individual to information relating to that individual and held by public and private sector agencies; and

(b) To provide for the appointment of a Privacy Commissioner to investigate complaints about interferences with individual privacy; and

(c) To provide for matters incidental thereto.”

One issue immediately arises from the long title. Is this a measure to protect the privacy of information or is it wider than that? There are provisions in the Act that allow people to approach the Commissioner on a wider range of privacy issues than those concerning information held about individuals by both private and public sector agencies. One matter the Law Commission will raise in the Issues Paper is whether the statute should in fact be called a Data Protection Act, or Personal Information Protection Act, which may better describe its purpose than the word “privacy”. Other names could also be considered.

As Part 1 of the Law Commission’s study on this subject “Privacy – Concepts and Issues – Review of the Law of Privacy Stage 1” makes clear, privacy is an elusive idea. Indeed, it is a protean concept. It is a good idea when dealing with such notions to make it as clear as possible in advance how they are being considered. It our view that the heart of the Privacy Act revolves around issues concerning the collection and use of personal information. It seems clear at this juncture that legal protection against wrongful collection and misuse of data are necessary.

The giant strides made by digital technology have undoubtedly increased exponentially the scope of such collections of data, both within the Government and the private sector. More powerful computers have allowed more information to be processed and in a shorter time. This has had some very beneficial results in business, medicine, science and other fields. Similarly, the internet is facilitating the free-flow of information and creating new spaces for dialogue and participation.

But there are risks in these technologies. It would be foolish to underestimate them. New risks from current technologies may also emerge in the future as a result of what is known as “function creep”. Material is gathered for a purpose, then people find it convenient to use it for another purpose. Furthermore, technology is advancing. New uses for existing technologies are being explored. And all of this may have unforeseen consequences. It is important for all societies, New Zealand included, to understand they should control the uses of these technologies and not become the mindless subjects of them.

The Privacy Act was a major initiative aimed at giving substantial protection to information of a private character. It does set limits on the type of information that can be collected, the reasons for collection, the form of collection and the use of the information. The Act sets out principles relating to the collection, storage, security, accuracy, use and disclosure of personal information. The application of the Act is to information held by both public and private sector agencies.

The news media and their news activities are exempted from the Act’s main principles. And most of the Act’s privacy principles are not enforceable in a court when they are infringed, although a complaint can be made to the Privacy Commissioner. In some cases the matter may be taken to the Human Rights Review Tribunal.

Information Privacy Principles

The heart of the Act lies in the 12 Information Privacy Principles contained in section 6. These are:

Principle 1 – Purpose of collection of personal information

Principle 2 – Source of personal information

Principle 3 – Collection of information from subject

Principle 4 – Manner of collection of personal information

Principle 5 – Storage and security of personal information

Principle 6 – Access to personal information

Principle 7 – Correction of personal information

Principle 8 – Accuracy etc of personal information to be checked before use

Principle 9 – Agency not to keep personal information for longer than necessary

Principle 10 – Limits on use of personal information

Principle 11 – Limits on disclosure of personal information

Principle 12 – Unique identifiers.

These Principles and their application mean that the Privacy Act is not a rules-based Act. It is an open-textured statute that renders up its meaning only after the Principles have been applied and weighed to each individual set of facts. This open-textured nature of the statute makes it unpredictable and uncertain to an extent. A rules-based approach may not exhibit such features.

The Law Commission’s preliminary view, however, is that the open-textured nature of the statute is essential for its practical operation. A rules based approach would be impossible. We do not think such a statute could be successfully designed or implemented. And despite its open textured nature the Privacy Act is of rather a light-handed character when it comes to regulation. The Act is not overly prescriptive. It is outcomes focussed. Agencies can develop their own way of achieving compliance, one that fits their needs. This means compliance costs are lower than they are in some jurisdictions, particularly those in Europe.

So unless anyone can suggest anything better, the Law Commission is inclined to retain the Privacy Principles approach. But there are issues, nevertheless, below this broad architectonic point. How could the Principles be improved? Should there be other Principles that are not included? Could some of the Principles be combined? There is repetition; perhaps they could be compressed. Perhaps some additional Privacy Principles are needed? The Australian Law Reform Commission report devotes much detailed attention to the content of the Principles there and this work will be helpful to the New Zealand analysis.

There may be specific areas, however, where a rules-based approach is apposite. As the Australian report observes, the Principles “may” need to be supplemented with more specific rules (promulgated in regulation or other legislative instruments), in order to accommodate the particular needs and circumstances of different industries.

Codes of Practice

Another issue of some importance relates to codes of practice. Codes of practice can have the effect of altering the Act. They are dealt with in Part 6 of the Act. A code of practice may modify the application of one or any more of the Information Privacy Principles by prescribing standards that are more stringent or less stringent than the standards that are prescribed by the Principles. They can also exempt any action from any Principle either unconditionally or subject to such conditions as are prescribed in the code.

There are a number of other important legal features of these codes. Codes can perform a very useful function in a Privacy Act. Under the Act, a Commissioner may issue codes of practice. And the Act lays down a procedure for issuing codes of practice in terms of giving notice and receiving submissions, and it sets out a number of due process requirements.

The Law Commission’s tentative view is that codes are useful. This power should continue. But codes should not be made only on the approval of the Privacy Commissioner. The government of the day through Cabinet should be able to stop such a provision as it can with other species of delegated legislation. It is anomalous for a public official to be able to make the law in this way. There are constitutional objections to an unelected official making law. While a code of practice is subject to the Regulations Disallowance Act, it is the Commission’s tentative view that codes of practice should also be subject to the approval of Cabinet in the same way that any statutory regulation now is.

Functions

The functions of the Privacy Commissioner, set out in section 13, cover three pages of the statute book. At first glance these seem excessive and too wide-ranging. They also offer a range of activities that might be beyond the primary purpose of the statute. For example, take section 13(1)(m):

“To enquire generally into any matter, including any enactment or law, or any practice, or procedure, whether governmental or non-governmental, or any technical development, if it appears to the Commissioner that the privacy of the individual has been, or may be, infringed thereby.”

This seems unduly wide. The Privacy Commissioner has watchdog functions in relation to privacy generally. She is not limited to information privacy. This appears to be a role that was inherited from the Human Rights Commission. The broad issue is whether this function should continue. If it does, should it be carried out by the Privacy Commissioner or someone else? Is it a function that is needed?

Complaints

Another interesting feature of the current Privacy Act is the complaints process. Contrary to what a lot of the public probably think, the Privacy Commissioner does not have power to make decisions on complaints. She has jurisdiction to receive complaints and an important role in the process of conciliation and mediation of those complaints. But in the event that a determination is required it is necessary to go to the Human Rights Review Tribunal. The Tribunal has wide powers, more like those of a court than a Tribunal. The person who takes the case there is not the Commissioner but the Director of Human Rights Proceedings. A lawyer can decide whether to take the case or not. If he or she decides not to, then the complainants have to go to the Tribunal themselves.

There are some good features of this process. The efforts of mediation and conciliation at the beginning are wholly admirable. But the process at the end seems to be unnecessarily complex and cumbersome.

One question we are considering is whether it may be preferable to have the Privacy Commissioner make a determination if, after a period of conciliation, no resolution is reached. Then in the event that there was disagreement with that ruling, there could be an appeal to the Tribunal. Or perhaps the appeal should be to a court given the enormously wide jurisdiction the Tribunal has.

The powers of the Tribunal include granting the following remedies:

• A declaration that the action of the defendant is an interference with the privacy of an individual.
•
• An order restraining a defendant from continuing or repeating the interference or from engaging in or causing or permitting others to engage in conduct of the same kind, as that constituting the interference or conduct of a similar kind specified in the order.
•
• An order that the defendant perform any act specified in the order with a view to remedying the interference or addressing the loss or damage suffered by the aggrieved individual as a result of the interference.
•
• Damages for pecuniary loss suffered as the result of, and expenses reasonably incurred by the aggrieved individual for the purpose of, the transaction or activity out of which the interference arose; loss of any benefit whether or not of a monetary kind which the aggrieved individual might reasonably have been expected to obtain for the interference; humiliation, loss of dignity and injury to feelings of the aggrieved individual.
•
The award of damages is usually regarded as a judicial function carried out by the court. There are sound legal reasons for this. The damages under the Privacy Act are limited to $200,000, the same as the civil jurisdiction as the District Court. One may well take the view that awarding damages on this scale should be carried out by a court rather than a Tribunal. This is an issue with which the Law Commission will be getting to grips.

The Law Commission is aware that the human rights complaints are dealt with in the same manner as those to the Privacy Commissioner. But it appears that more work is now emanating from the Privacy Act for the Tribunal than under the Human Rights Act. And while we do not have any reference to deal with the dispute settlement process in relation to the human rights scheme, we will be taking a very close interest in what the submissions say about this related privacy issue.

Breach notifications

One issue of some importance is whether the Act should include a mandatory data breach notification requirement. This may involve quite large business costs to small to medium-sized businesses and it could also lead to relatively small breaches being blown out of proportion. But it is an issue that needs to be considered given the daily reports about the consequences of information that fall into the wrong hands.

Necessary and desirable

Section 26 of the Act provides:

(1) As soon as practicable after the expiry of the period of 3 years beginning on the commencement of this section, and then at intervals of not more than 5 years, the Commissioner shall—

(a) Review the operation of this Act since—

(i) The date of the commencement of this section (in the case of the first review carried out under this paragraph); or

(ii) The date of the last review carried out under this paragraph (in the case of every subsequent review); and

(b) Consider whether any amendments to this Act are necessary or desirable; and

(c) Report the Commissioner's findings to the responsible Minister.

(2) As soon as practicable after receiving a report from the Commissioner under subsection (1)(c) of this section, the responsible Minister shall lay a copy of that report before the House of Representatives.

Over the years the Privacy Commissioner has produced a great deal of material in the form of reports on changes that could be made in the statute. Many of these are detailed, many of them are thought by the Commissioner to be necessary, but others of them are thought only to be desirable. They have not been implemented by Parliament so far. The Law Commission will review these recommendations in the course of its work.

While this sort of provision may have been necessary when the statute began, it seems to the Law Commission wrong in principle that the Commissioner should be in charge of reviewing her own statute. We think this power should be removed. But all these views are tentative and we must await submissions on the Issues Paper when it is published.

Conclusion

I have summarised the issues that are emerging in the course of preparation of the Law Commission’s Issues Paper on the Privacy Act. The Commission is of the view that the statute has worked better than many people expected when it was passed. The degree of re-engineering that it requires seems to be limited. The central policy problem with which it deals is more pervasive now than it was when the statute was enacted. It is unthinkable that the Act could be repealed and no substitute made for it. Thus, it becomes a question of what detailed adjustments are required. We will be interested to see whether submitters agree with this view.

Ends

© Scoop Media