1.3 Data Privacy Guidelines and Principles Essential to the right to privacy is the right to protection of personal data. The Organisation for Economic Co-operation and Development (OECD), European Union (EU) and Asia-Pacific Economic Forum (APEC) have developed guidelines and regulations on this issue which influence domestic privacy laws in New Zealand. OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data The OECD Guidelines were developed by OECD Member countries in 1980 and were revised in 2013.33 The Guidelines were formed to help harmonise national privacy legislation and, while upholding human rights, at the same time prevent interruptions in international flows of data. The Guidelines set out eight core principles that apply to the processing of personal data. They form the basis of the information privacy principles in New Zealand’s Privacy Act 1993 and consist of the follow key principles: • Collection Limitation Principle: Personal data should only be collected lawfully and fairly and where appropriate with knowledge and consent of the individual concerned.34 • Purpose Specification Principle: The purposes for which personal data are collected should be specified at the time of or before data collection. Subsequent use of such data is limited to the purpose of collection or a compatible purpose and that these should be specified whenever there is a change of purpose.35 • Use Limitation Principle: Restricts the disclosure of personal information for reasons other than the specified purpose except with the individual’s consent or by legal authority.36 developments and practices with respect to personal data; individuals should be able to request data about themselves and receive reasons for denial of such requests; and that data controllers should be accountable for complying with the principles.37 European Union Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data The Council of Europe Convention was the first binding international instrument to protect individuals against abuses resulting from the collection and processing of personal data and to regulate the trans-border flow of personal data.38 Many of the principles reflect those of the OECD Guidelines. Countries from outside Europe can sign up to the Convention, but only Uruguay has done so to date. General Data Protection Regulation (GDPR) The EU also has its own internal law regarding data protection. On 8 April 2016, the EU adopted the GDPR which takes effect on 25 May 2018.39 The GDPR applies to the public sector, EU-based entities and non-EU based entities processing data of individuals within the EU. As noted by New Zealand’s Privacy Commissioner, the GDPR’s “standards lift the baseline internationally in response to challenges to consumers and data protection in today’s global digital economy.”40 Some of the key aspects of the GDPR are set out below:41 • Increased territorial scope: Applies to all companies (data controllers or processors) whose processing activities relate to offering goods or services or monitoring behaviour Other principles in the Guidelines include: • personal data should be protected by reasonable security safeguards; governments should be open about policy 33 New Zealand has been an OECD Member since 1973. http://www. oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.htm 34 OECD Guidelines, Article 7 35 Ibid. Article 9 36 Ibid. Article 10 37 Ibid. Articles 10-14 38 https://www.coe.int/en/web/conventions/full-list/-/conventions/ rms/0900001680078b37. 39 GDPR will replace the current EU Directive and will be directly applicable on all Member States without the need for implementing national legislation. See Regulation at http://data.consilium.europa.eu/doc/document/ST-5419-2016-INIT/en/pdf. 40 Privacy Commissioner, Office of the Privacy Commissioner Briefing for the Incoming Minister of Justice: Hon Andrew Little, October 2017, para 2.1 https://privacy.org.nz/assets/Uploads/Briefing-for-Incoming-Minister-October-2017.pdf 41 See https://www.eugdpr.org/key-changes.html. 12