NZLC REPORT 123 E31(123) NovemberJune 2011, 2010, Wellington, Wellington, New New Zealand Zealand | | REPORT REPORT 123 119 REVIEW OF THE PRIVACY ACT 1993 REVIEW OF THE LAW OF PRIVACY STAGE 4 LAW COMMISSION E31 (123) June 2011, Wellington, New Zealand | REPORT 123 REVIEW OF THE PRIVACY ACT 1993 REVIEW OF THE LAW OF PRIVACY STAGE 4 The Law Commission is an independent, publicly funded, central advisory body established by statute to undertake the systematic review, reform and development of the law of New Zealand. Its purpose is to help achieve law that is just, principled, and accessible, and that reflects the heritage and aspirations of the peoples of New Zealand. The Commissioners are: Honourable Sir Grant Hammond KNZM – President Dr Warren Young – Deputy President Emeritus Professor John Burrows QC George Tanner QC Professor Geoff McLay The General Manager of the Law Commission is Brigid Corcoran The office of the Law Commission is at Level 19, HP Tower, 171 Featherston Street, Wellington Postal address: PO Box 2590, Wellington 6140, New Zealand Document Exchange Number: sp 23534 Telephone: (04) 473-3453, Facsimile: (04) 471-0959 Email: [email protected] Internet: www.lawcom.govt.nz National Library of New Zealand Cataloguing-in-Publication Data New Zealand. Law Commission. Review of the Privacy Act 1993 : review of the law of privacy, stage 4. (Law Commission report ; 123) ISBN 978-1-877569-14-2 (pbk.)—ISBN 978-1-877569-23-4 (internet) 1. New Zealand. Privacy Act 1993. 2. Privacy, Right of—New Zealand. I. Title. II. Series: New Zealand. Law Commission. Report ; no. 123 342.930858—dc 22 ISSN 0113-2334 (Print) ISSN 1177-6196 (Online) This paper may be cited as NZLC R123 This report is also available on the Internet at the Law Commission’s website: www.lawcom.govt.nz ii Law Commission Report The Hon Simon Power Minister Responsible for the Law Commission Parliament Buildings WELLINGTON 30 June 2011 Dear Minister, NZLC R123 – REVIEW OF THE PRIVACY ACT 1993: REVIEW OF THE LAW OF PRIVACY STAGE 4 I am pleased to submit to you Law Commission Report 123, Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4, which we submit under section 16 of the Law Commission Act 1985. Yours sincerely Hon Sir Grant Hammond KNZM President Review of the Privacy Act 1993 – Review of the law of privacy stage 4 iii FOREWORD The Law Commission has been reviewing the law of privacy. The project was a very large one, and the Commission approached it in four stages. The first stage resulted in a study paper, Privacy: Concepts and Issues; the second in a report, Public Registers; and the third in a report, Privacy: Penalties and Remedies. The present report concludes stage 4. It is a review of the Privacy Act 1993, the Act which deals with the collection, security and use of people’s personal information, and sets up the office of Privacy Commissioner. The government has postponed action on stages 2 and 3 until the completion of this fourth stage, so that the proposed reforms can be seen as a package. The review of the Privacy Act, the subject of this report, is timely. The Act is now 18 years old. In this modern age, technology, and its ability to gather, store and disseminate information about people, has advanced beyond anything imaginable in 1993. Much personal information is held by large agencies in both the public and private sectors. It can be sent to agencies overseas. It is very important to people that their personal information is properly protected, and that the law is flexible enough to be able to move with the times and provide that protection. On the other hand, we must also accept that privacy is not an absolute value. It must be balanced against other important values: health and safety, law enforcement and national security, for example. The challenge is to get the balance right between protecting privacy and allowing disclosure of information to appropriate people when that is necessary. This report investigates how far the Act’s principles need to be amended. It also tackles some important policy questions, such as whether the Privacy Commissioner needs more powers; whether the complaints process, particularly in progressing claims to the Human Rights Review Tribunal, could be streamlined; whether agencies which lose people’s information should have to tell them; and what the obligations should be of agencies which send personal information overseas. These questions are important, not only for the citizens whose personal information is in question, but also for the agencies which deal with it. In reaching its conclusions the Commission consulted with, and received submissions from, many persons and organisations. It records its thanks to all those who participated, and acknowledges in particular the assistance it has received from the Office of the Privacy Commissioner and the Ministry of Justice. The Commissioners who worked on the privacy project were Sir Geoffrey Palmer and John Burrows. The legal and policy advisers who were involved in stage 4 were Ewan Lincoln, Joanna Hayward, Sara Jackson, Steven Melrose and Geoff Lawn. Legal and policy advisers who worked on other stages of the privacy review were Mark Hickford, Susan Hall, Rachel Hayward and Janet November. Hon Sir Grant Hammond KNZM President iv Law Commission Report Review of the Privacy Act 1993 Review of the law of privacy stage 4 CONTENTS Foreword .........................................................................................................................................iv Glossary ............................................................................................................................................8 Summary ........................................................................................................................................11 Introduction .......................................................................................................................11 The Act’s main provisions ................................................................................................11 Enforcement .......................................................................................................................14 Miscellaneous .....................................................................................................................17 Information sharing and matching ...................................................................................20 Summary of recommendations .....................................................................................................22 Chapter 2 ............................................................................................................................22 Chapter 3 ............................................................................................................................23 Chapter 4 ............................................................................................................................25 Chapter 5 ............................................................................................................................26 Chapter 6 ............................................................................................................................26 Chapter 7 ............................................................................................................................28 Chapter 8 ............................................................................................................................29 Chapter 9 ............................................................................................................................30 Chapter 10 ..........................................................................................................................31 Chapter 11 ..........................................................................................................................31 Chapter 12 ..........................................................................................................................32 Appendix 2 .........................................................................................................................33 Information sharing proposals in appendix 1 ..................................................................34 Recommendations from other reports ..............................................................................35 Stage 2: Public Registers................................................................................................................35 Stage 3: Invasion of Privacy .........................................................................................................35 Review of the Privacy Act 1993 – Review of the law of privacy stage 4 1 Contents CHAPTER 1 Introduction ...................................................................................................................................36 The Law Commission’s Review of Privacy ......................................................................36 Other relevant work ..........................................................................................................37 Privacy Commissioner statutory reviews of the Privacy Act ...............................................37 Work within government on privacy law reform ...................................................................37 Australian reviews .........................................................................................................................38