New Zealand privacy law review

The New Zealand Law Commission this week completed its review of privacy law with the publication of 'Review of the Privacy Act 1993: Review of the Law of Privacy Stage 4' , the fourth and final report on the reference.  Significant recommendations for government action on matters we have been dithering about include augmentation of the Privacy Commissioner’s powers, improvements in the complaints process and mandatory notification when personal information is lost or otherwise compromised (for example, through computer hacking), where the breach is sufficiently serious.

On other topical issues on this side of the ditch, I take it from the absence of any reference that political parties are not exempt from the NZ Privacy Act. The commission also recommended continuation of the media exemption. (As did the Australian Law Reform Commission in a little discussed recommendation in its 2008 report, while calling for action to ensure privacy protections are adequate and that media organisations do more than give lip service to principles designed to achieve this.) The NZ commission reported:

4.26 We said in the issues paper that this exclusion is justified. The free flow of information through the media is vital to the life of a free and democratic society, and is supported by the protection of freedom of expression in the New Zealand Bill of Rights Act 1990. It is difficult to see how the media could perform this role effectively if it were subject to the Privacy Act’s principles. Those principles are ill-aligned to the media function. For example they provide that an agency must collect personal information about an individual directly from the individual; it must allow the individual access to the information it holds about him or her; and it must not disclose the personal information it holds to anyone else. “Personal information” is defined simply as “information about an identifiable individual”; and while all the principles are subject to exceptions, those exceptions are limited and specific. Not only could the media not operate effectively in such a context: they could barely operate at all. This, however, is not to say that the media do not need to respect privacy. Of course they do. They are subject to the tort of invasion of privacy if they publish private facts in an objectionable way. They are also governed by their own regulators – the Broadcasting Standards Authority and the Press Council – which apply their own privacy principles specially tailored to the media. It is important that specialist regulators regulate the media. Privacy is only one of the standards those regulators enforce: others are good taste, fairness, and balance, standards which sometimes overlap with privacy. It would be quite artificial to pluck privacy alone away from the media regulators and give it to the Privacy Commissioner. 4.27 The Privacy Act is not alone among New Zealand statutes in granting the media or journalists an exemption from its provisions, and similar exemptions are also found in overseas privacy laws. 4.28 No submitters disagreed with our view that the news media exclusion should remain in the Act. OPC agreed that it should remain for the time being, although it said that the matter should continue to be re-examined from time to time. We think there should be no change to the general principle that the news media, in relation to their news activities, should not be subject to the privacy principles.

The Commission is undertaking a separate reference reviewing the regulation of the news media in the internet age. While the issue is relevant to that inquiry, the commission decided that the definition of “news medium” for the purposes of the Privacy Act exemption should be limited to media that are subject to a code of ethics that deals expressly with privacy, and to a complaints procedure administered by an appropriate body [4.25-4.41].