If we think of privacy as the ‘right to be let alone’, then in the Digital Age – where organisations have the ability to access, use and exploit our personal information more than ever before – that right is more important than it has ever been. Exercising the right to be let alone, and respecting a consumer’s choice to do so, requires both the consumer and the organisations with whom their information is entrusted to be savvy and smart online.

Coincidentally, when launching this year’s Privacy Week, the Privacy Commissioner, Michael Webster, stated that ‘there has never been a better time to run a week of privacy education events about being savvy and smart online’. Needless to say, we agree.

As New Zealand Privacy Week draws to a close, we think it is an opportune time to reflect on the key theme of the week – Privacy Rights in the Digital Age – and what that theme means to New Zealand organisations.

Click to continue: The importance of transparency

New Zealand privacy law is fairly permissive when it comes to the manner in which an organisation can use the personal information that it has collected. By and large, so long as the collection is fair, the organisation has fairly broad rights to use the information for purposes consistent with those for which the information was collected.

What are those purposes? Often you’ll find an organisation will let you know in their privacy policy (indeed, the organisation has to let you know what they are). But does anyone actually read every privacy policy put in front of them? Some people have tried – and failed – to devote the time necessary to ingest the millions of words put in front of them explaining how their personal information will be used. A 2008 study suggested that Americans would need 244 hours per year to read and consent to all the privacy policies put in front of them.

So what can organisations do? Obfuscate and confuse? Or aim higher – and endeavour to humanise their privacy policies, so that individuals can have confidence that their personal information will be treated with the respect that information deserves? Our view is that in a Digital Age, where jaded consumers are losing faith and confidence in their ability to be ‘let alone’ online, privacy disclosures need to be more accessible and user-friendly than ever – placing the individual at the centre of an organisation’s privacy practices.

What’s yours is mine and what’s mine is yours: Data access rights in a digital world

We often grapple with the idea that personal information can be ‘owned’ by someone (our view is that it can’t, but it’s not a ditch we are willing to die in). What is much clearer is that an individual will almost always have the right to access the personal information that an organisation holds about them. In that sense, the personal information ‘belongs’ to the individual as much as it does to the organisation who holds and controls it.

In an age where more and more information is collected about individuals, it can be increasingly difficult to collate that information and make it available to individuals who seek to exercise their rights of access. Information has value, and if a consumer data right ever takes off, it will become even more important for some organisations to ensure that the personal information they hold is readily accessible and portable. 

We think that organisations who anticipate that individuals will want to exercise their rights, and establish systems and processes (even self-service) to allow them to do so, will find themselves ahead of the game – if they aren’t there already. In an age where smart and efficient design is justifiably lauded, organisations who design their systems and processes to make the exercise of data access rights ‘frictionless’ will not only present themselves as being privacy-first, but will likely save themselves significant time and money in the long-run.

I am what I am – Biometrics

The idea of technology that relies on biometric information – the biological and behavioural details that make us who we are – has been with us since the earliest stages of the ‘Digital Age’. Concepts like retinal scans and iris recognition – once considered the sole preserve of ambitious sci-fi – are becoming more and more commonplace.

Biometric information is personal information and is therefore regulated by privacy laws, including (in New Zealand) the Privacy Act 2020. However, concerns have been raised as to whether the law goes far enough – especially concerning the collection, use, and disclosure of Māori biometric information, and the use of facial recognition technology in the context of law enforcement.

While the use of biometrics provides major benefits such as convenience, efficiency, and security, it comes with significant risks relating to surveillance and profiling, lack of transparency and control, accuracy, bias and discrimination. Those risks aren’t new: the sci-fi movies of yesteryear were in some cases eerily prescient in predicting some of the sorts of things that could go wrong if biometric information was misused or fell into the wrong hands. 

As with any project that relies on the collection and use of personal information, a project that seeks to rely on biometrics is one that requires careful consideration and diligence before it gets underway: lest the organisation finds itself facing a dystopian future of the type previously only seen on silver screens.

Does ChatGPT dream of electric sheep? Privacy concerns of using AI

An AI getting all the buzz right now is ChatGPT. As our colleagues at Dentons Washington DC have helpfully discussed, ChatGPT is a form of ‘generative AI’ which means it provides more novel content rather than regurgitating information that it is fed. While the AI does not ‘think for itself’, it is able to ‘learn’ over time based on the information it is provided by users and is designed to replicate human conversation and interaction. 

Leaving aside the threat of an army of replicants coming for a job near you, the privacy concern that arises from using AI such as ChatGPT relates to the data it collects and retains from users. ChatGPT’s privacy policy contemplates that it may collect personal information that is included in input, file uploads, or feedback provided to services (user content). In simple terms, it may collect data from conversations with ChatGPT when ChatGPT is asked to proofread a document (or from the document itself), or turn a brief into a contract which contains personal or confidential information, without censoring it first. It may also retain this information and use it to improve the ChatGPT service and conduct research, making the information vulnerable, and the use ChatGPT, a potential cybersecurity risk to your business. 

ChatGPT (and machine-learning/AI more generally) provides both opportunities and risks for users. Improvements in efficiency need to be balanced not only against risks of inaccuracy and existential threats, but also against what their use means for the privacy of the individuals to whom the information relates.

Data breach watch: Which type of company are you?

According to Robert S Mueller, III, former Director of the FBI, ‘[t]here are only two types of companies: Those that have been hacked and those that will be hacked’.

As we predicted at the start of this year, the wave of successful cyber-attacks in 2022 has only grown in 2023. Hackers are active; they continue to outsmart antivirus software, firewalls, and employee training. In a world where almost all business is conducted online, no one is immune, and all organisations need to be savvy and smart about how they go about their business in a digital world.

That said, no matter how savvy and smart a business may be, the serious and actual threat of a data breach may be inevitable.

All is not lost: organisations have control over their response. However, the Office of the Privacy Commissioner warns that there is no place for a ‘she’ll be right attitude’. Assuming that you are one of the two types of companies contemplated by Mr Mueller, you need to plan for the inevitable to mitigate the risk to you as an organisation of a breach occurring, and the likely fallout if one were to occur.

Importantly, remember that people must be at the centre of your response: where their right to be let alone has been infringed and they think (rightly or wrongly) that you are to blame, you are going to need to focus on rebuilding their trust – and your reputation – by ‘putting it right’.

Our experts are on hand to assist

Dentons in New Zealand is experienced in assisting with matters encompassing the full spectrum of privacy law. Contact Hayden Wilson, Campbell Featherstone, or Hayley Miller to find out more. 

This article was written with the assistance of Melissa Tahere, a law graduate in the Wellington technology and innovation team.