The Office of the Privacy Commissioner (New Zealand) administers the Privacy Act 2020. The Privacy Commissioner is entrusted to protect personal information of New Zealanders in accordance with the Privacy Act. Current Privacy Commissioner, Michael Webster, began his role in July 2022.
The Privacy Commissioner oversees personal information held by agencies in both the public and private sectors. This is achieved through monitoring compliance with the 13 Information Privacy Principles. Amid his varied responsibilities, the Commissioner administers a complaint system and issues Codes of Practice or rules for particular industries, contexts and sectors. Most cases involve investigation, conciliation and settlement. Serious breaches are referred to the Human Rights Review Tribunal. The Commissioner inherently considers international obligations and worldwide developments in privacy protection.
History
The now repealed Privacy Commissioner Act 1991 established the role of the Privacy Commissioner. The Commissioner had a principal role in the development of the Privacy Bill 1993, which passed into law as the Privacy Act 1993 and established the revised Office of the Privacy Commissioner.
In March 2018, the Privacy Bill was introduced to Parliament. The Bill was passed by New Zealand Parliament in June 2020 and the Privacy Act 2020 came into law on 1 December 2020. The Privacy Act 2020 significantly updates the 1993 Act. Many of the changes are based on recommendations from the New Zealand Law Commission's 2011 review of New Zealand's privacy laws.
List of privacy commissioners
The Office of Privacy Commissioner has been held by: Sir Bruce Slane, KNZM CBE (1993–2003) Dame Marie Shroff, DNZM CVO (2003 – February 2014) John Edwards (17 February 2014 – 31 December 2021) Michael Webster (since 5 July 2022)
Privacy Act 2020
The Privacy Act 2020 is primarily concerned with information privacy; other aspects of privacy are protected by the common law right to privacy in New Zealand. The Act controls the collection, use, disclosure, storage and granting of access to personal information by agencies. Personal information covers any information about an identifiable natural person.
The key changes in the Privacy Act 2020 include:
new criminal offences
introduction of compliance orders
binding access determinations
controls on the disclosure of information overseas
mandatory notification of harmful privacy breaches
the law now explicitly applies to overseas-based entities that carry on business in New Zealand.
The Privacy Act was originally enacted in 1993 in an era of heightened national awareness for human rights, and sits alongside the New Zealand Bill of Rights Act 1990 and the Human Rights Act 1993. The Privacy Act similarly addressed international concerns, acknowledging privacy obligations under the Universal Declaration of Human Rights, and the International Covenant on Civil and Political Rights.
The Privacy Act extended protection to "any person or body of persons whether corporate and unincorporate," in both the public and private sectors. Inclusion of the private sector was considered revolutionary. The Commissioner thus oversees government departments, companies, religious organisations, and schools. Some limited exemptions to the Privacy Act exist: the sovereign, the House of Representatives, courts and tribunals acting in judicial capacity, news media activities, and individuals holding personal information for private use.
The Information Privacy Principles (IPPs), monitored by the Commissioner, are based on guidelines established by the Organisation for Economic Co-operation and Development (OECD) in 1980. The IPPs cover: Collection of personal information (principles 1 – 4); Storage and security of personal information (principle 5); Requests for access to and correction of personal information (principles 6 – 7); Accuracy of personal information (principle 8); Retention of personal information (principle 9); Use and disclosure of personal information (principles 10 – 11); Cross border disclosures (principle 12); and Using unique identifiers (principle 13).
In ANZ National Bank Ltd v Tower Insurance, the High Court held the privacy principles require that personal information can only collected be for "a lawful purpose and is necessary for that purpose." The principles do not outline their practical application, giving the Commissioner flexibility to deal with varying fact situations as they arise.