McKee NicolePRIVACY AMENDMENT BILLFirst ReadingHon NICOLE McKEE (Minister for Courts): on behalf of the Minister of Justice: I present a legislative statement on the Privacy Amendment Bill.ASSISTANT SPEAKER (Teanau Tuiono): That legislative statement is published under the authority of the House and can be found on the Parliament website.Hon NICOLE McKEE: I move That the Privacy Amendment Bill be now read a first time. I nominate the Justice Committee to consider the bill.The purpose of this bill is to improve transparency for individuals about the collection of their personal information. The sharing of personal information is an essential part of doing business both worldwide and in New Zealand. It is also important for enabling the delivery of joined-up public services. A range of entities need to be able to collect personal information in order to provide a wide range of goods and services to their customers and users. Protecting personal information is crucial to enabling this.As New Zealand's digital economy grows businesses and public organisations will seek to innovate and increase productivity through digital technologies greater use of data digital trade and the exporting of services. This will lead to a corresponding increase in the flow of personal information between agencies both domestically and internationally.The Privacy Act has 13 information privacy principles (IPPs) that govern how businesses and organisations should collect handle and use personal information. Together these principles ensure that New Zealanders know when their information is being collected that their personal information is used and shared appropriately that personal information is kept safe and secure and that New Zealanders can get access to their information.At present under information privacy principle 3 there is a requirement for public or private agencies to notify an individual of a range of matters when they directly collect their personal information. However there is no requirement for public or private agencies to notify individuals when personal information has been collected about them from a source other than the individuals themselves. This means that individuals are notified when their personal information is collected directly from them but not when their personal information is subsequently collected by another agency. This means there is a risk that individuals may not know all of the agencies which hold their personal information. This is an impediment to them fully exercising their privacy rights under the Act.We have an opportunity to strengthen the principle of transparency in the Privacy Act 2020 by ensuring that individuals are notified when their personal information is being shared between agencies.The first part of the bill will introduce a new information privacy principle 3A relating to the indirect collection of personal information. It is closely based on the existing information privacy principle 3 which deals with the direct collection of personal information. Under the proposed IPP 3A the agency which indirectly receives an individual's personal information will be required to notify that individual of a range of matters including the purpose for which the information has been collected the name and address of the agency that has collected the information and is holding the information and the individual's rights of access to the correction of any of that information. Agencies would be required to take reasonable steps to comply with the notification obligation as soon as practical after indirectly collecting the personal information. This requirement is however subject to several practical exceptions to ensure the efficient administration of certain public functions ensure individuals are not overwhelmed with notifications and to protect against other unintended consequences. The bill also makes several technical amendments to address some minor issues that have arisen since the principal Act came into force. The select committee will provide an opportunity to improve on the bill and consider any additional changes as these arise.The changes proposed in this bill will enable New Zealanders to exercise their fundamental rights under the Privacy Act supporting them to make better-informed privacy choices with respect to all the agencies that collect their personal information; to hold agencies to account for their privacy practices; and to efficiently exercise their right to access and correct that personal information.In addition to enhancing the privacy rights of individuals who benefit from the protection of the Privacy Act having a robust privacy regime puts New Zealand in a stronger position when entering into trade negotiations and reduces barriers to trade. On 15 January this year the European Union reconfirmed New Zealand's adequacy decision a signifier which represents that New Zealand's privacy laws are sufficiently equivalent with EU general data protection regulation. EU adequacy is an important recognition of our efforts to protect individual privacy and facilitate the cross-border flow of information between New Zealand and the European Union without placing more onerous requirements on Kiwi businesses.The changes in the Privacy Amendment Bill will help to further align New Zealand's law with both EU regulation and international best practice. This will strengthen our reputation for being a country with a strong commitment to protecting privacy.The protection of New Zealand's privacy rights is fundamentally important in our increasingly data-driven economy. Successive New Zealand Governments have taken steps to maintain a robust flexible principles-based legislative framework to uphold these rights. The Privacy Amendment Bill receiving its first reading today continues with this commitment. I encourage members of the public to have their say on the bill and the new protections that it introduces when the committee calls for submissions. I commend this bill to the House.