Law Commission privacy report a step forward
Media Release – 2 August 2011
(This release is also available at http://tinyurl.com/3eftqkq
InternetNZ (Internet New Zealand Inc) has welcomed the Law Commission’s report on its review of the Privacy Act.
InternetNZ Chief Executive Vikram Kumar says “The Law Commission has done a fantastic and thorough job in addressing an
area that’s of increasing concern to many New Zealanders. The Internet provides us with a great platform for innovation.
Yet its very nature challenges societal norms like privacy that are itself evolving. The Law Commission’s report is
therefore very welcome”.
“We particularly commend the report continuing to back a principles-based approach, supplemented by issue-specific Codes
as necessary. This has stood the test of time and rapidly changing technologies. A principles-based privacy law
continues to be the best way to tackle the opportunities and challenges of living in an Internet-enabled world.
“Given the size of the report, we still have to take a good look. So far it seems the report has addressed every issue
we raised with the Law Commission. The biggest one is making it mandatory for people to be notified if their personal
information has been lost, stolen, or inappropriately accessed. It’s a way to let people know what’s occurred and what
steps they can take. By making notification contingent upon seriousness of breaches, rather than a blanket requirement,
it addresses the downside of too many notifications leading to ‘notification fatigue’.
“We have called for this several times, most recently in May via our blog (see http://bit.ly/l2c8f7
). Mandatory notifications impose an external cost that will lead to greater attention and investment in keeping
people’s personal information more secure.
“Two other welcome recommendations are making New Zealand organisations more clearly accountable when sending personal
information overseas, and narrowing the ‘domestic affairs’ exemption. The former will make organisations pay more
attention when using overseas online services, including many forms of cloud computing. The ‘domestic affairs’ change
means that people will have a way to stop publication of offensive or harmful material online by family members in messy
“The one area we are cautious about is the right to anonymity and pseudonymity. It’s a logical extension of what’s
already required by Principle 1. We strongly support the concept that people should only be required to give up the
minimum personal information required to achieve a specific outcome.
“However, the challenge will be in practical implementation given the huge amount of information exchanged in every
online interaction. Often it is the combination of invisible, discrete data that leads to making true anonymity and
pseudonymity very difficult online. Requiring websites and online services to implement this right may be hard and, done
wrong, could cause unnecessary inconvenience to both service providers and their customers. Combine this with the
proposed ‘Do Not Call’ register and we get close to a ‘Do Not Track’ requirement.”
“One area that seems to be missing from the report is on the ‘right to be forgotten’. Given the current interest on this
topic by the European Union, it would have been great to get the Law Commission’s views.”
InternetNZ will continue to engage with the recommended changes as they progress through the law making process.