Curran Clare: Privacy (Cross-border Information) Amendment Bill — Procedure Second Reading Third Reading 
Curran Clare: Privacy (Cross-border Information) Amendment Bill — Procedure Second Reading Third Reading 
[Volume:666;Page:13665] 
CLARE CURRAN (Labour—Dunedin South) 
: 
 I would like to speak in the second reading debate of the Privacy (Cross-border Information) Amendment Bill and I make particular mention of the work done on this bill by my colleague the Hon Lianne Dalziel as Minister of Commerce and Associate Minister of Justice in the previous Labour Government. I also commend the Green Party today for supporting this bill. I think that shows true maturity and it is good to see cross-parliamentary support on this issue. 
The bill was introduced by the Hon Lianne Dalziel in the previous Labour Government in July 2008 and had its first reading on 1 April last year. As members have heard it was reported back to the House in September last year but it has taken long to get to this point which my colleague Charles Chauvel spoke about with some regret. The bill addresses a number of problems with the Privacy Act which I will spell out quickly. But along with the launch of the Law Commission’s review of privacy an action by the previous Labour Government this bill was part of Labour’s efforts to update and strengthen privacy law in New Zealand which is very important and significant. Ultimately this is a Labour bill; therefore of course we support it. 
Members have heard about the two flaws that this bill essentially attempts to correct. The first concerns the increasing flow of people and information across borders and the privacy issues that surround that. The first amendment is in relation to the Privacy Act 1993 and introduces new provisions that deal with the cross-border transfer of personal data. To complement those changes the bill includes new provisions that facilitate the cross-border enforcement of privacy laws. That means that the legislation will reduce the likelihood of New Zealand being used as an intermediary for the avoidance of other States’ privacy laws. The Privacy Act as it stands does not allow foreign nationals resident overseas to make information privacy requests and further nothing in the Act prevents data received overseas from being transferred outside New Zealand to a jurisdiction that does not have adequate privacy protection. That means that New Zealand is unable to provide the assurance requested by our overseas trade partners that we can fully protect their privacy and their customers’ privacy. We have had that issue quite well canvassed. 
As we have heard the Law Commission is undertaking a review of privacy values technology change and international trends and their implication for New Zealand law. In February this year a report was issued titled  
Invasion of Privacy: Penalties and Remedies 
 which complements the bill that is before us today. The commission found that New Zealand’s privacy laws—in particular those relating to surveillance—are patchy. I will talk a little about those laws and then provide the House with a case study that shows the importance of businesses keeping their information secure. The commission recommended in that report to enact legislation on surveillance devices in order to make New Zealand’s privacy laws more consistent and make it an offence to secretly film or track people. When speaking to the release of the report  
Invasion of Privacy: Penalties and Remedies 
 Sir Geoffrey Palmer the president of the Law Commission said that our laws on that are currently very patchy. He said that technology is moving so fast and we need to ensure that our privacy is properly protected which is a given. As he pointed out it is an offence to record a private conversation and get unauthorised access to someone’s computer but it is not an offence to secretly film someone or use a device to track someone. 
The Law Commission’s report recommended some law changes to fill those gaps. It recommended that it should be an offence to trespass on someone’s property to install a surveillance device to film inside someone’s dwelling without that person’s consent and to install or to use a tracking device to track someone without that person’s consent. As Sir Geoffrey said the police need to get a warrant to do most of those things and it seems bizarre that the law does not prohibit other people doing them here. He noted that several Australian states now have similar laws. That report is very interesting. 
In terms of information and the issue of transferring data across borders and the importance of business keeping information secure—and my colleague in the Maori Party has mentioned issues around credit cards and identity theft and those sorts of things—I refer to this particular case study of DoubleClick a US online advertising company. In 2000 it found out the hard way what happens when a company gets its privacy practices wrong. DoubleClick decided it would match the personal information of people it had anonymously profiled online with identifying personal information collected offline by Abacus Data an aggregator of mail-order buyer information that DoubleClick had bought. Not surprisingly that caused a backlash among web users and people who had bought items through mail-order catalogues which drew the attention of the US Federal Trade Commission. That led to lawsuits and saw the dramatic drop in DoubleClick’s share price from US$135 a share to around the mid-thirty dollars within 6 months. A year later the company dropped plans to merge the data settled all of its lawsuits agreeing to pay $1.8 million in legal costs. It agreed to purge its databases and conduct an online privacy education campaign. When the company was sold in 2005 the share price was $8.50 a share. It had gone from $135 a share to $8.50 a share. There was no suggestion that the mishandling of privacy was the only reason for the dramatic fall in share price but it was certainly a factor. I think that was the point that my colleague Charles Chauvel made—the importance of business being able to function effectively in this environment is very important. 
In summary the Justice and Electoral Committee’s main concern on this bill related to the OECD guidelines. Due to the way that the guidelines were incorporated into the bill any changes by the OECD to the guidelines would have been automatically incorporated into legislation which would result in changes to the statutory framework of the Privacy Act without examination by Parliament. So the committee recommended that the basic principles of national application be set out in a schedule and that the Governor-General be given the power to make regulations to amend that new schedule to reflect changes made to those guidelines. Those amendments to the new schedule will be subject to the Regulations (Disallowance) Act 1989 so will be scrutinised by Parliament. 
The committee also recommended that it be made explicit in the bill that when determining whether to prohibit a transfer of personal information the Privacy Commissioner may use the investigative powers in the Privacy Act just as the commissioner can when conducting an inquiry under the Act. That would allow the commissioner to hear information from any person that he or she considered necessary. The committee received and considered two submissions from interested groups and individuals and heard one as well as received advice from the Ministry of Justice. So for those reasons and on the recommendation of the Justice and Electoral Committee again acknowledging the work done by my colleague the Hon Lianne Dalziel and the bill being brought into Parliament by Labour originally Labour will be supporting this bill to the stage of the third reading debate.