The Privacy Commissioner briefed the incoming Minister of Justice, Paul Goldsmith in December, foreshadowing what may be to come in the realm of privacy law in New Zealand. 

Briefings to incoming Ministers are formal documents that government agencies provide to new ministers after a general election or a change in minister. BIMs provide an introduction about the agency’s portfolio and summarise key policy areas and policy issues. They are not intended to be a detailed analysis of the status quo or all of the issues, but they are useful to understand the relevant agency’s approach to policy, enforcement, and give a sense of legislative or regulatory changes that may be on the horizon. 

Need for Change in Privacy Legislation

The Privacy Commissioner underscored the low levels of compliance by agencies and the necessity for modernising the Privacy Act 2020 to address this. The Commissioner attributes the significant increases in privacy breaches in the past years (79% increase in privacy complaints and 59% rise in serious privacy breaches) to agencies not taking the steps necessary to safeguard personal information within the current legislative framework, especially in the face of emerging technologies like AI, automated decision making, sensitive personal information, and children's privacy.

The Commissioner focused on 5 policy issues that prompt for legislative reform:

• Modernisation: The Commissioner notes that the Privacy Act, although it has 2020 in its name, is based on old policy that dates back to 2013, and is not capable of addressing the privacy needs of this age, particularly those related to AI, biometrics, and children’s privacy. According to the Commissioner, the Privacy Act, which used to be world-leading back in 1993, is now behind the times in terms of global privacy regulatory trends, especially considering that like-minded countries are making (have made) significant privacy reforms, such as Australia, Canada, and the UK. The Commissioner also warns that the Government should be wary of taking New Zealand’s GDPR adequacy status for granted, and it might go away if legislation falls behind. The Commissioner advocates for a coordinated government strategy, including the establishment of a Digital Regulators Forum, to ensure a comprehensive and effective review and enhancement of the Privacy Act, particularly in regulating AI.
• Penalties: It’s no secret that the Privacy Act’s penalty regime is well behind its peers around the world. Past commissioners have been insisting on increased penalties and sharper regulatory teeth, and unsurprisingly, the current Commissioner recommends introducing financial penalties for significant non-compliance to enforce stricter adherence to privacy standards.
• Sensitive Personal Information - Commissioner's Concerns on Biometrics: The Commissioner points out that the Privacy Act does not specifically categorise ‘sensitive personal information’, a notable gap in the context of the increasing use of biometric technologies, particularly compared to gold-standard legislation like the GDPR. The Commissioner highlights the unique privacy risks associated with biometrics, such as facial recognition, due to their immutable nature and often covert collection. 
• Children's Privacy - Commissioner's Focus in the Digital Landscape: The Commissioner has raised concerns regarding the limited protection the Privacy Act offers for children's privacy. Indeed, the Privacy Act does not contain any specific requirements when dealing with children’s personal information, other than an implied increased threshold for compliance considering children’s level of vulnerability. Consequently, the Privacy Act has a significant gap in addressing the privacy needs of children considering the growing digital engagement of children and young people, especially in social media and online education. This is another area where the Privacy Act is behind international developments, such as the UK's Age Appropriate Design Code, which is a useful illustration of the need for specific regulations to safeguard children's privacy. The Commissioner has initiated a project to evaluate whether the current regulatory framework adequately supports children's privacy rights and whether there is a need for new or expanded regulatory measures.

What can we expect

The briefing provides a useful guide on the trajectory of the changes we can expect which may include: 

• Automated decision making regulations: The Commissioner highlighted that the Privacy Act does not contain adequate protection against privacy risks created by automated decision-making tools which are increasingly being used to streamline processes and enhance productivity. To ensure fairness and equity for New Zealanders, we may see our policy makers following Australia’s lead as the Australian Government has recently accepted that individuals should have the right to request meaningful information about how substantially automated decisions with legal or similarly significant effect are made, to incorporate measures to address the risks associated with automated decision making. 
• Increased penalties: Due to the low level of compliance with the Privacy Act, the Commissioner recommended introducing a civil penalty regime for major non-compliance. The current absence of meaningful financial penalties does not encourage agencies to prioritise privacy as they would with financial reporting standards or health and safety obligations. Despite the recommendation, Minister Goldsmith recently advised that there are no current plans to amend the offences and penalties in the Privacy Act but that it may be a future consideration. 
• Increased scope of sensitive personal information: In addition to the incoming draft biometrics Code of Practice, the Commissioner emphasised the need for a definition of sensitive personal information to be able to protect information of a sensitive nature. We could potentially see the introduction of a requirement for strict informed consent to the collection, use or disclosure of sensitive information if there is progress in defining ‘sensitive personal information’. 
• Enhanced protections of children’s privacy: As discussed in our previous article, the current project evaluating the current regulatory framework for children’s privacy which is intended to highlight the unique challenges faced by children and young people in a digital world, will lead to policy recommendations which will be delivered sometime this year. We expect the proposed recommendations to be aligned with the UK and California’s respective Age Appropriate Design Codes. 
• Broadening of notification requirements: The Ministry of Justice and the Commissioner have been working on a bill to broaden the notification requirements of the Privacy Act with the proposed introduction of Information Privacy Principle 3A (as discussed previously) so that individuals will be notified when their personal information is collected indirectly through a third party serving to address an issue relating to the equivalence issue of New Zealand’s privacy framework with the European Union and we will be keeping an eye out for progress on this bill as it will further see New Zealand becoming more aligned with its global counterparts. 
• AI Act: In the wake of the European Union passing the AI Act, the first of its kind, it would be unusual to not see similar legislative movements around the world and it is likely that these legislative changes are on the minds of New Zealand policy makers. We have previously discussed the potential changes in AI regulation in New Zealand and anticipate discussion and movement in this space. 

The Commissioner’s briefing provides a useful summary of the privacy landscape in New Zealand highlighting areas where improvement is needed to align with global trends and standards. While there has been progress such as the introduction of the new Information Privacy Principle 3A, there is still work to be done.  While the current government will be looking to reduce red tape and compliance costs for businesses, it will be difficult to ignore the changing dynamic of privacy risk, particularly the introduction of new technology and the benefits of maintaining EU adequacy. The challenge will be to strike an appropriate balance between legislating (and encouraging regulation) in a way that is fit for purpose and also incentivises the right behaviours on the one hand, and on the other hand, using a less intrusive, lighter touch approach. 

If you have any questions, you can talk directly with the experts. Our privacy law specialists are available and have extensive experience in dealing with the privacy matters of organisations. Feel free to get in touch with Hayley Miller, Campbell Featherstone, or Güneş Haksever to discuss. 

This article was written by Güneş Haksever, a senior associate, and Janette Zhong, a solicitor, in our commercial, technology and privacy team.