Privacy Commissioner Michael Webster has named and shamed an aged care provider for a two-year delay in notifying a notifiable privacy breach. 

Despite the provider subsequently taking steps to improve their privacy practices, the Commissioner has publicised this case and the name of the provider as an ‘example’ to other businesses, and to highlight the importance of complying with the Privacy Act’s breach notification requirements.

This is a timely reminder of the importance of prompt engagement with the Commissioner in the event of a privacy breach. Delayed notification – or no notification at all – may result in unwanted negative publicity in addition to exposure under the Privacy Act. While we haven’t seen this ‘name and shame’ approach taken on many occasions, businesses should take note that this is a part of the Commissioner’s regulatory toolbox, and it seems he is willing to use it. 

The Commissioner has already taken the view that the penalties for breaches of the Privacy Act non-compliance are not in step with overseas laws and the impacts of non-compliance. As privacy becomes more and more important in the wake of high-profile data breaches, and an increasingly strict regulatory landscape outside New Zealand, we wouldn’t be surprised to see the Commissioner taking a more active approach to enforcement and utilising the full range of powers he currently has.

Refresher on your legal obligations

A privacy breach includes any unauthorised or accidental access to, or disclosure, alteration, loss, or destruction of, personal information, or any action that temporarily or permanently prevents you from accessing personal information. A privacy breach is notifiable if you believe it has caused serious harm to an affected individual or is likely to do so.

Part 6 of the Privacy Act 2020 prescribes the steps that must be taken by a business (or other captured ‘agency’) if a notifiable privacy breach occurs. For detailed information about these obligations, read our article ‘There’s plenty of phish in the sea: How to plan for and respond to a data breach’.

In short, businesses and other agencies that hold personal information (as well as all personnel who deal with this information) should be aware of the following:

• The definition of ‘privacy breach’ is broad: A breach can take the form of a malicious actor breaching your systems and stealing a substantial amount of data, or a one-off accidental disclosure of information to the wrong recipient, or anything in between. While the ‘malicious actor’ breach tends to make the news more frequently, don’t take that as a sign that other data incidents aren’t captured by the Privacy Act.
• Notification is essential: If a breach is notifiable, it should be notified to the Office of the Privacy Commissioner (OPC) as soon as practicable. The Commissioner’s guidance is that this should be within 72 hours after becoming aware of the breach, and we recommend following that guidance unless there is a reason why it isn’t ‘practicable’ to do so.
• Notification is an ongoing process: The Privacy Act mandates the information that must be provided in a notification to the OPC. However, the Act also permits an agency to provide the required information incrementally, in order to comply with the requirement to notify as soon as practicable. This is on the basis that any information that becomes available to you is notified as soon as practicable. If you don’t have all of the key information within 72 hours, but you are reasonably sure that a notifiable breach has occurred, you should notify the OPC with whatever information you do have, and in our experience the OPC will generally be accepting of you supplementing this initial notification as further details come to hand. There is no penalty for providing incremental notification where information is genuinely not known, but there will be a penalty for not notifying at all.
• Affected individuals must also be notified: This must occur as soon as practicable, to all affected individuals, unless one of the exemptions in the Privacy Act applies. Notification can be direct or via a public notice if direct notification is not possible.
• Failure to notify is unlawful: If proper notifications are not made, you could be on the hook for a NZ$10,000 fine for failure to notify a notifiable privacy breach. There is no express penalty for suffering a privacy breach. If a complaint is escalated in relation to your failure to notify, then proceedings could also be brought before the Human Rights Review Tribunal (which has the jurisdiction to award damages in respect of an interference with privacy of up to NZ$350,000).

An important takeaway is that there is no automatic penalty for suffering a privacy breach. Notifying a privacy breach will not in itself attract a penalty, unless a separate non-compliance with the Privacy Act has also occurred. Privacy breaches, and breaches of the Privacy Act, are two distinct concepts. If the circumstances surrounding a privacy breach separately amount to a breach of your obligations under the Privacy Act, then that breach of obligations might be separately investigated. However, in most cases your immediate legal risk in relation to a privacy breach will be the risk of non-notification.

Privacy Commissioner’s publication powers

Under the Privacy Act, the Commissioner may publish the identity of any agency that has notified them of a notifiable privacy breach without that agency’s consent, if the Commissioner is satisfied that it is in the public interest to do so.

Similarly, the Commissioner may publish the identity of any agency that has received a compliance notice under the Act, as well as details of the non-compliance that is the subject of the notice.The Commissioner typically takes a cooperative approach to Privacy Act enforcement, and we’re still seeing most case notes being published on an anonymous basis. However, if a matter that has been escalated to the Commissioner has resulted in the Commissioner issuing a compliance notice or involves a failure to comply with privacy breach notification requirements, there is a theoretical risk of being ‘named and shamed.’

This risk may be a very real one if the offending agency has demonstrated an active disregard of its Privacy Act obligations and/or the non-compliance relates to an issue the Commissioner has undertaken to provide further education on. Notifiable privacy breaches are a hot topic and key risk area for businesses in the current cybersecurity climate, and we expect to see the Commissioner continuing to be active in this space.

The value of a commercial strategy

The Commissioner’s recent actions have highlighted the importance of not underestimating the non-legal impacts of a privacy breach. If a breach involves customer/patient/user information, you might also be at risk of reputational (and therefore financial) harm once that breach becomes public knowledge – and in many cases it will, despite your best efforts to contain it.

The risk of reputational and financial harm may be even higher if you don’t take control of the narrative before someone else does. Proactively engaging with affected individuals or the wider public at an early stage, before they have had the chance to hear about the breach from someone else, may give you an opportunity to provide an accurate, measured version of events and de-escalate concerns about potential harm. This will typically be an easier process to manage than defensively responding to allegations that may have been sensationalised by the media or panicked individuals.

Delayed or ‘reactive’ engagement with affected individuals might also provide further grounds for reputational damage. How an organisation responds to a breach can be just as contentious as the breach itself, if not more. Demonstrating transparency and cooperativeness at an early stage can go a long way for rebuilding trust in your organisation and retaining crucial commercial relationships.

Key takeaways

Businesses should treat the Commissioner’s recent actions as a reminder of the benefits of taking a proactive approach to privacy breach notification. No business wants to be publicly singled out as non-compliant, nor should any business be opening itself up to avoidable reputational harm, especially if the privacy breach itself has otherwise been resolved.

Notification is essential, both as a legal requirement but also as a risk mitigation tool. The risks of not notifying will in many cases be greater than the risks of notifying – admitting that a breach has occurred isn’t necessarily an admission that you are in breach of the Privacy Act, but non-notification will be a breach of the Act. The process of notifying the Commissioner and affected individuals can be managed in a way that minimises the risk of further privacy complaints being escalated, or at least minimises your potential liability in relation to a future complaint.

Privacy breaches are unfortunately becoming an all-too-common reality for New Zealand businesses, public sector agencies and other organisations. Preparing a privacy breach response plan ahead of time, so you’re ready to swing into action if needed, will make it considerably easier to deal with the fallout if a breach does occur.

Ultimately, the best way to minimise privacy compliance risk is to build privacy-enhancing measures into your organisation to avoid the likelihood of a breach occurring in the first place. No business can entirely prevent the occurrence of privacy breaches, but good data management practices, technical security measures, and organisational policies and education will help prevent the more avoidable breaches (as well as being measures required by the Privacy Act in the first instance). Embedding privacy awareness into all levels of an organisation, from the boardroom to the ‘shop floor,’ is critical.

Talk to the experts

For advice on all things privacy, data and cybersecurity, contact Hayley Miller, Campbell Featherstone, or Hayden Wilson. Our experts can assist you with planning for and responding to a privacy breach, including assistance with the Privacy Act’s notification process, and can also advise on the proactive measures you can take to build a privacy-compliant culture within your organisation.

This article was written by Ashleigh Ooi, Senior Associate, in our Commercial, Technology and Privacy team.