The Privacy Bill - Sept 2018

This update covers:

• A summary of the bill proposed to replace the Privacy Act 1993;
• Changes to MBIE’s employment mediation services; and
• The Holidays (Bereavement Leave for Miscarriage) Amendment Bill.

Privacy Bill

The Privacy Bill (the Bill), which would repeal and replace the Privacy Act 1993 (the Act) was introduced into Parliament in March this year, by the Minister of Justice, Andrew Little. The Bill passed its first reading on 22 April with bipartisan support and is currently before select committee. The select committee report (from the Justice Committee) is due on 22 November 2018.

The Bill arises out of the Law Commission’s 2011 review of the Act and implements some of the recommendations. It is the culmination of significant work by the Office of the Privacy Commissioner and the Law Commission.

The Bill’s key purpose is to promote people’s confidence that their personal information is secure and will be treated properly. This is particularly relevant given the Act the Bill is replacing came into force in 1993, just two years after the internet was made available to the public.

The Bill aims to encourage organisations to proactively identify risks and prevent incidents which could cause harm.

Key changes

The key changes the Bill introduces are:

• stronger powers for the Privacy Commissioner;
• mandatory reporting of privacy breaches;
• strengthening ‘cross-border data flow protections’;
• new offences; and
• increased fines.

Stronger powers for the Privacy Commissioner

The Bill increases the powers of the Privacy Commissioner in a number of ways.

The Commissioner will be able to issue compliance notices that require an organisation to do something or stop doing something to comply with privacy law. Previously these powers were limited to the Human Rights Review Tribunal (the HRRT). The HRRT will enforce compliance orders and hear appeals.

The Bill will allow the Commissioner to make binding decisions relating to access to information. For example, if an agency refuses to release information to an individual, then the individual can complain directly to the Privacy Commissioner, who can direct the agency to release the information. Currently these powers rest with the HRRT. The HRRT will hear appeals.

The Privacy Commissioner’s existing investigation powers will be strengthened, allowing the Commissioner to shorten the timeframes for an organisation to comply.

Mandatory reporting of privacy breaches

Privacy breaches, being unauthorised or accidental access to or disclosure of personal information, which pose a risk of harm to individuals must be reported to the Privacy Commissioner and affected individuals. Harm is defined as loss, detriment, damage, injury, significant humiliation, significant loss of dignity, significant injury to feelings, or an adverse effect on the rights, benefits, privileges, obligations or interests of the individual.

Strengthening cross-border data flow protections

The Bill states agencies within New Zealand must take reasonable steps to ensure personal information disclosed overseas will be subject to acceptable privacy standards. It will generally only be permissible to disclose information to an overseas person if:

• the individual concerned consents to the disclosure overseas;
• the overseas person is in a country with comparable privacy laws to NZ (as listed in regulations); and
• the agency believes the overseas person is required to protect the information in a way comparable to the protections in NZ privacy law.

New offences and increased fines

The Bill creates new offences, with potential fines of up to $10,000. These offences include:

misleading an agency in a way that affects someone else’s information (e.g. impersonating an individual); and

destroying documents containing personal information when a request has been made for it.

Employers will be liable for the actions and omissions of their employees, even if the actions were done without the employer’s knowledge or approval. It will be a defence in proceedings if the employer can show it took reasonably practicable steps to prevent the employee taking the action (or taking any similar action).

GDPR

In May 2018 the General Data Protection Regulation (GDPR) came into force in the European Union.

The GPDR applies to all companies processing ‘personal data’ of people residing in the EU. The GDPR places significant limits on how companies collect and use personal data. People in the EU can request a company hand over data it has collected about them and can order the company to destroy the data. Companies wishing to access and store data must get clear consent from individuals (i.e. no lengthy terms, conditions and legalese).

The NZ Bill does not go as far as the GDPR to strengthen individual privacy. In NZ an individual can access their personal information, but there is also no ‘right to be forgotten’ — to have personal information deleted. The maximum fine under the Bill currently is $10,000. This is drastically smaller than the 4% of annual global turnover or €20,000,000 (whichever is greater) under the GDPR.

Privacy Commissioner

The Privacy Commissioner, John Edwards, has said he is looking for the Bill to give New Zealand ‘meaningful enforcement powers, such as an ability to seek fines for serious non-compliance.’

However, the Privacy Commissioner has also criticised the Bill as not going far enough. He has stated:

• Privacy is a fundamental human right.
• The Bill is lacking compared to the European Union’s privacy laws (though he has not suggested going as far as the GDPR).
• The ‘right to be forgotten’ needs to be introduced, requiring the deletion of personal information, if requested.
• Fines of up to $1,000,000 are required.

The Privacy Commissioner has made significant submissions on the Bill to Select Committee. It will be interesting to see how many of these recommendations are adopted. However, it has been noted some of the Privacy Commissioner’s suggestions go beyond the minor changes usually implemented at Select Committee stage.

You can track the progress of the Bill here.

The Holidays (Bereavement Leave for Miscarriage) Amendment Bill

The Holidays (Bereavement Leave for Miscarriage) Amendment Bill (the Bill) was recently introduced to Parliament.

The Bill proposes to amend the Holidays Act 2003 to make it clear the unplanned death of a foetus constitutes grounds for paid bereavement leave for the mother and her partner or spouse. Under the Bill the duration of bereavement leave in these circumstances will be three days.

Ginny Andersen, the MP who introduced the Bill has stated ‘one pregnancy out of four can end in a miscarriage so it affects a lot of women and their partners. It’s important that women and their families have time to grieve and deal with not only the physical but the emotional strain of going through miscarriage.’

Currently the law is somewhat ambiguous on the issue, with employers being able to decide whether or not a miscarriage constitutes grounds for bereavement leave.

The Bill’s explanatory note states this ‘ambiguity may lead to disputes between employees and employers regarding entitlement to bereavement leave. In many instances, employees are forced to use sick or annual holiday leave.’

The Bill is likely to receive support through its first reading, given the Government’s confidence and supply agreement. Minor changes may be made after it progresses through Select Committee.

Changes to MBIE’s Mediation Services

Mediation pilot project

The Ministry of Business, Innovation and Employment (MBIE) has commenced two pilot projects aimed at improving the scheduling of mediations.

Standby List

This pilot will be trialled by MBIE’s Auckland and Christchurch teams. It will target applicants who are able to attend mediation at short notice, when other mediations are cancelled.

Parties will be asked to indicate if they are interested in going on the standby list. Those who indicate they are interested will be offered an earlier date, if one arises, which both parties can attend.

Active follow-up

This pilot will be trialled in the Hamilton and Wellington teams.

MBIE will actively follow up parties where it feels the matter may settle prior to mediation, or one of the parties may not appear fully committed to attend the mediation.

If a party indicates a mediation date is not required, MBIE will be able to offer the earlier date to others.

Budget 2018

Mediation Services is set to receive extra funding after the Government’s budget announcement that frontline employment services administered by MBIE would receive new operating funding of $4.3 million to address costs pressures.

It is hoped this extra funding combined with the pilot projects will improve the efficiency of Mediation Services meaning parties can access its services sooner.