2.3 Privacy Act 1993 The Privacy Act 1993 regulates the collection, use and disclosure of information about individuals. At the core of the Act are the 12 information privacy principles (IPPs) that guide the way that government agencies and businesses (referred to in the legislation as Agents) handle personal information, including in relation to the collection, storage, security, access, accuracy, retention, and disclosure of personal information.67 The Act itself does not provide for, or affirm, a free-standing right to privacy. However, the information privacy principles are fundamentally congruent with the right to privacy and provide presumptive rights for a person to access their personal information and have their personal information protected from unauthorised use or disclosure to third parties. The information privacy principles are designed as operational safeguards and thus are subject to exceptions in certain circumstances (for example where nonconsented disclosure of personal information may be required to avert a likelihood of serious harm). Compliance with the Privacy Act is overseen by the Privacy Commissioner, who may investigate and instigate proceedings against agencies that may be in breach. In addition, the Privacy Commissioner may produce sector-specific codes of practice, such as the Health Information Privacy Code and the Telecommunications Information Privacy Code, that derive from the foundational information privacy principles in the Act. Among other things, the Privacy Act regulates information matching practices between specified public-sector agencies and information sharing practices among agencies that would otherwise breach one or more of the information privacy principles. Agencies that wish to share personal information in such a manner are required by the Privacy Act to enter into Approved Information Sharing Agreements. On 20 March 2018, a new Privacy Bill was 67 Part 2 of the Privacy Act 1993, http://www.legislation.govt.nz/act/ public/1993/0028/latest/DLM296639.html introduced into Parliament to repeal and replace the existing Privacy Act 1993. The new Bill follows the 2011 Law Commission Review of the Privacy Act which contained 136 recommendations for change,68 as well as calls by the Privacy Commissioner to modernise the Act.69 The new Bill proposes modernising the Privacy Act in response to the way technology has revolutionized the handling of personal data, while retaining the 12 IPPs. The IPPs largely remain the same under the Bill, with the exception of IPP 11 on disclosure of information and IPP 4 on the manner of collection of personal information. IPP 11 strengthens the requirements relating to the disclosure of information to an overseas person. Among the new requirements are that the disclosing agency must not disclose the personal information unless the agency believes on reasonable grounds that the overseas person is required to protect the information in a way that, overall, provides comparable safeguards to those in the Act.70 IPP 4 is amended to require an agency to consider the age of an individual when deciding whether the means of collection of personal information is fair and not unreasonably intrusive.71 Importantly, the purpose statement of the Bill has been strengthened to contain a clearer focus on protecting and promoting privacy. It directly incorporates an “individual’s right to privacy of personal information” and recognises “privacy obligations and standards in relation to the privacy of personal information, including … the International Covenant for Civil and Political Rights.” The most significant reforms to the law are the increased accountability mechanisms supporting the early identification of systematic privacy risks. These changes include: • Mandatory reporting of data breaches: One of the major changes under the Bill is the introduction of a mandatory requirement 68 See http://www.lawcom.govt.nz/sites/default/files/projectAvailableFormats/NZLC%20R123.pdf 69 See https://privacy.org.nz/assets/Uploads/Briefing-for-Incoming-Minister-October-2017.pdf 70 Privacy Bill, Clause 19, http://www.legislation.govt.nz/bill/government/2018/0034/latest/whole.html#LMS23342 71 Ibid. 18