Little AndrewPRIVACY BILLSecond ReadingHon ANDREW LITTLE (Minister of Justice): I move That the Privacy Bill be now read a second time. The Privacy Bill will repeal and replace the Privacy Act 1993. This much-needed reform will modernise our privacy laws to give people confidence that their personal information is secure and will be treated properly in an increasingly digital and data-rich society. I first want to thank the Justice Committee for its diligent consideration of the bill and those members of the public who made submissions. The committee received 162 submissions. The submitters engaged comprehensively with the bill and have contributed greatly to its development. Almost all submitters supported the bill's direction but some had concerns about certain clauses and questioned how the bill's provisions will operate in practice. I am pleased to see that the committee has taken these considerations on board and made several valuable changes to the bill.I want to highlight some of the key changes that the committee has made in response to the submissions that it received. The committee has recommended clarifying who the bill applies to and when overseas agencies will be captured. This is important now that New Zealanders routinely submit their personal information directly to online retailers and other businesses based overseas. The committee has recommended a new provision making it clear that the Privacy Bill will apply to overseas agencies that carry on business in New Zealand. These are agencies that may not have a place of business in New Zealand but they do systematically and deliberately take opportunities to engage in trade here. If an agency does business in New Zealand we need to be able to issue meaningful corrections to them if we think they're not in compliance with our expectations. To ensure it doesn't overreach the bill will only apply to actions taken and information collected by the overseas agency in the course of carrying on its business in New Zealand. This change provides certainty about the extent to which the bill applies in a range of situations involving overseas persons agencies and information. Another change concerns mandatory notification of privacy breaches. As introduced the bill provided that agencies must notify the Privacy Commissioner and affected individuals of privacy breaches if the breach has caused harm or there is a risk it will do so. Many submitters thought that this threshold was too low and would result in a large number of relatively innocuous privacy breaches being mandatorily notified. Submitters worried that this would desensitise people to genuinely harmful privacy breaches and overload the Privacy Commissioner with low-value work. In response the committee has recommended raising the threshold for what constitutes a notifiable privacy breach. Agencies will now be required to notify the Privacy Commissioner and affected individuals of privacy breaches where it is reasonable to believe the breach has caused or is likely to cause serious harm. This change better aligns the bill with overseas jurisdictions who have comparably high notification thresholds. The committee has also recommended updating the news media's exemption in the bill. The purpose of excluding the media is to enable them to perform their role of supporting the free flow of information to the public. It supports their right to protect their sources which the common law at least recognises and accepts.The committee has recommended clarifying the definition of news activity" to encompass non-traditional journalistic works such as books and blogs but only provided that the author of those works is subject to an appropriate regulatory body. This is to ensure that news media have the freedom to publish news in different formats including on the internet. The committee also recommended that Television New Zealand and Radio New Zealand be brought within the media exemption so that they can operate on an equal footing with other news media.One of the strengths of our privacy regime is the adaptable and flexible nature of our principles-based approach to information privacy regulation. Importantly the committee has recommended a new information privacy principle which increases the total number of privacy principles from 12 to 13. The new information privacy principle 12 sets out the requirements for the disclosure of personal information outside New Zealand which were contained within information privacy principle 11 in the bill as introduced. A New Zealand agency may disclose personal information to an overseas agency if that agency is required to protect the information in a way comparable to New Zealand.There are a number of ways to satisfy this new requirement. The overseas agency may be in a country that is included in a white list of countries to be prescribed in regulation or such safeguards as can be imposed by contract. A person may also authorise their information to be disclosed overseas but the committee has made it clear in response to submissions that the individual must only authorise disclosure after being informed that the overseas jurisdiction may not have comparable safeguards. The new requirement seeks to enable the free flow of data and give people confidence that safeguards will continue to apply to their information when it is shared overseas unless they authorise otherwise.The committee has also recommended a change to information privacy principle 1 to discourage agencies collecting personal identifiers by default without considering whether it is necessary to do so. A further change to information privacy principle 4 seeks to protect young people who may be more willing than adults to disclose their information online and who may not be aware of why an agency wants their information. The committee has recommended that agencies take into account the vulnerability of children and young people when collecting personal information from them. I'll be interested to hear members' views on the committee's recommended changes to those information privacy principles.Equally interesting is what has not been included in the Privacy Bill. As I've said the bill contains important changes which will bring New Zealand law into better alignment with overseas developments but many submitters wanted the bill to go further. In May last year the European Union's new General Data Protection Regulation was introduced. That law contained new rights such as a right to data portability a right to be forgotten and requirements for algorithmic transparency. Many people including our Privacy Commissioner submitted that similar rights should be added into this bill. However the Justice Committee did not recommend those additions nor did it recommend substantial fines for individuals and organisations who seriously breach their obligations under the Privacy Act. I'm aware that the Privacy Commissioner has been a strong proponent of civil penalties which the European and Australian regimes have.These are important areas of privacy law which would represent substantive changes to the bill and our current policy framework. They require careful consideration policy development and consultation and need to be considered within the wider regulatory scheme to avoid unintended consequences. Adding such reforms into this bill would significantly delay the enactment of the important reforms it already contains and frankly are needed now. Instead these issues can be considered as part of any future work on privacy reform.I do not anticipate that this future work would form another large review of privacy law which was carried out last by the Law Commission but rather I anticipate a need for ongoing review and incremental reform given the rate of technological change and continual evolution of international privacy standards. The changes recommended by the committee will help strengthen and improve the Privacy Bill and better address the challenges of the digital age. On that basis I commend the bill to the House."