Law Commission privacy report a step forward

InternetNZ (Internet New Zealand Inc) has welcomed the Law Commission’s report on its review of the Privacy Act.

InternetNZ Chief Executive Vikram Kumar says “The Law Commission has done a fantastic and thorough job in addressing an area that’s of increasing concern to many New Zealanders.

The Internet provides us with a great platform for innovation. Yet its very nature challenges societal norms like privacy that are itself evolving. The Law Commission’s report is therefore very welcome”.

“We particularly commend the report continuing to back a principles-based approach, supplemented by issue-specific Codes as necessary. This has stood the test of time and rapidly changing technologies. A principles-based privacy law continues to be the best way to tackle the opportunities and challenges of living in an Internet-enabled world.

“Given the size of the report, we still have to take a good look. So far it seems the report has addressed every issue we raised with the Law Commission. The biggest one is making it mandatory for people to be notified if their personal information has been lost, stolen, or inappropriately accessed. It’s a way to let people know what’s occurred and what steps they can take. By making notification contingent upon seriousness of breaches, rather than a blanket requirement, it addresses the downside of too many notifications leading to ‘notification fatigue’.

“We have called for this several times, most recently in May via our blog (see http://bit.ly/l2c8f7). Mandatory notifications impose an external cost that will lead to greater attention and investment in keeping people’s personal information more secure.

“Two other welcome recommendations are making New Zealand organisations more clearly accountable when sending personal information overseas, and narrowing the ‘domestic affairs’ exemption. The former will make organisations pay more attention when using overseas online services, including many forms of cloud computing. The ‘domestic affairs’ change means that people will have a way to stop publication of offensive or harmful material online by family members in messy situations.

“The one area we are cautious about is the right to anonymity and pseudonymity. It’s a logical extension of what’s already required by Principle 1. We strongly support the concept that people should only be required to give up the minimum personal information required to achieve a specific outcome.

“However, the challenge will be in practical implementation given the huge amount of information exchanged in every online interaction. Often it is the combination of invisible, discrete data that leads to making true anonymity and pseudonymity very difficult online. Requiring websites and online services to implement this right may be hard and, done wrong, could cause unnecessary inconvenience to both service providers and their customers. Combine this with the proposed ‘Do Not Call’ register and we get close to a ‘Do Not Track’ requirement.”

“One area that seems to be missing from the report is on the ‘right to be forgotten’. Given the current interest on this topic by the European Union, it would have been great to get the Law Commission’s views.”

InternetNZ will continue to engage with the recommended changes as they progress through the law making process.