Privacy Week, promoted by the Office of the Privacy Commissioner, is a way for the fundamental importance of privacy to be brought back to the forefront of everyone’s minds and the theme this year was Privacy: The Foundation of Trust. Last week, acting Privacy Commissioner Liz MacPherson said the aim this year was to remind people to think about who has access to their information, and for agencies to honour both their legal obligations and the trust people place in them. 

Trust is a hugely important asset for any business to have. In privacy law, complying with regulatory requirements will ensure that those you do business with have a high level of confidence and trust in your ability to look after one of their most prized possessions - their personal data. Getting your privacy processes right means you not only meet your legal obligations, but your customers can take you seriously as a reputable person or organisation to do business with, worthy of entrusting with their personal information. 

Data privacy, who cares? 

This is a significant ask given the findings of the latest report issued by the Office of the Privacy Commissioner. The level of concern about individual privacy and protection of personal information has fallen to levels not seen since 2001. Less than half of those surveyed said they were concerned about privacy, compared to over half in 2020. 

Despite these seemingly downward trends, a closer look reveals that the focus has shifted from concern generally, to a more heightened awareness of what organisations are doing with the personal information they collect. Two thirds of New Zealanders said they would be likely to change service providers if their current provider had poor privacy practice, while just under half say they would avoid doing something on the internet due to concerns that their online activity is being tracked. The leading privacy issues causing the most concern were businesses sharing personal information without permission and the security of personal information on the internet. These findings show that a public privacy breach would have major reputational impacts for businesses, in terms of the levels of trust and confidence that their brand holds with consumers. 

Protecting the jewel in the privacy crown - personal information

It will always be in the best interest of businesses and organisations to protect the personal information that they collect. A common misconception is that privacy breaches occur when information is leaked to the public arena, or external to the agency that holds the information. This is not always the case, as privacy breaches can also (and frequently do) occur within organisations where people who shouldn’t have access to the information share or use the information inappropriately. 

It is key for companies to have proper safeguards in place in the form of regularly updated privacy and data retention policies as part of their risk management ‘toolbox’, as taking such preventative action could save companies from any future reputational fallout. 

Security of personal information on the internet remains a hot button issue. Alongside being one of the main areas of concern for consumers generally, our team has observed a growing trend of organisations who have been seriously impacted by cybersecurity incidents leading to unintended privacy breaches. According to CERT statistics, malware and credentials harvesting accounted for about 77 per cent of the reported cybersecurity incidents in New Zealand over the last three months. For organisations, it is a matter of not ‘if’ they will experience a cyber-attack, but ‘when’. 

Some real-life examples of cyber-attacks that could cause serious reputational issues:

• A ransomware attack leading to the data of individuals being published on the dark web, as well as being sent to various New Zealand media outlets.
• The hacking of public facing websites, leading to inappropriate messages being displayed to customers and other visitors to the site.
• A third party service provider suffering a data breach which leads to the release of your customer’s information inadvertently. 

For many organisations who have suffered a public privacy breach, taking preventative measures could have served them well in responding to the consequences. Businesses who are well prepared and have a strategy in place for responding swiftly to cyber-attacks will find that they are in a better position, not only to meet their regulatory requirements, but also to manage the damage done to their brand and jumpstart the process of winning back their customers’ trust. How organisations respond to such incidents is crucial in the public eye, and businesses should be prepared for an unavoidable worst-case scenario to happen. 

If it’s out of date, let it go

Another common practice amongst businesses, which could lead to an unwelcome light being shone upon them, is holding onto of data for much longer than necessary. Often consumers will discover an organisation has their personal information only in the event of a breach. Businesses holding onto old data not only creates an unnecessary risk for the wider public but also increases the likelihood of a greater reputational fallout in the event of a privacy breach. 

Talk to the experts. Our privacy law specialists are on hand to assist, and have extensive experience in dealing with the privacy matters of organisations. We have experience in reviewing and updating existing policies, drafting new ones to fit your organisation’s needs, and assisting in the event of a privacy breach. Contact Campbell Featherstone, Hayden Wilson or Hayley Miller to discuss.