Upston Louise: Privacy (Cross-border Information) Amendment Bill — First Reading 
Upston Louise: Privacy (Cross-border Information) Amendment Bill — First Reading 
[Volume:653;Page:2349] 
LOUISE UPSTON (National—Taupo) 
: 
 I rise in support of the Privacy (Cross-border Information) Amendment Bill. It is important in an increasingly global economy that New Zealand is able to compete without burdens or barriers. This bill improves data collection and the security of information. 
If we think back to 1993 when the Privacy Act was first passed and if we compare the technology that was used in 1993 with what we use now we see that it is vastly different. I want the House to reflect for a moment on the sorts of ways that we used to collect information. It may have been on paper cards or it may have been in notebooks. It definitely was nothing like what we have the capability to do today. So it is really important that we review the legislation and make sure it keeps pace with the speed of technology and that it is relevant and puts in place the appropriate security nets. 
I was going to talk about some points of interest that have been made by Opposition members tonight but in reality of the points I have heard there is really not too much in dispute. So I will move on instead. I support the comments made by my colleagues Simon Power and Chester Borrows and made so well by Jonathan Young. The aim of the Privacy (Cross-border Information) Amendment Bill is to amend the Privacy Act 1993 in order to reduce the likelihood of New Zealand’s being used as an intermediary for the avoidance of other countries’ privacy laws. 
I will reinforce the points that have been made this evening so that we are all clear about what this bill would achieve. Firstly it will remove the current restrictions on who may make an information privacy request. It will enable public sector agencies to charge for making personal information available to overseas foreign nationals. It will provide for the referral of cross-border complaints to the appropriate privacy enforcement authority. It will also establish a mechanism for controlling the transfer of information outside of New Zealand where the information has been routed through New Zealand to circumvent the privacy laws of the country from where the information originated. At present the Privacy Act does not allow foreign nationals resident overseas to make information privacy requests and does nothing to control the transfer of information outside of New Zealand in cases where information has been routed through New Zealand to circumvent the privacy laws. This bill addresses both of those deficits in the Privacy Act. 
I will give members a couple of examples to make this amendment bill a bit more relevant. I will start with clause 5 which repeals section 34 of the Privacy Act of 1993. I was fortunate in 1994 and 1995 to work with the then Privacy Commissioner Bruce Slane. The former Privacy Commissioner made the following comment during an address to the 13th annual Industrial Relations Conference meeting: “First section 34 of the Privacy Act restricts making information privacy requests (requests for access to personal information) to New Zealand citizens and permanent residents wherever they are and to other individuals who are in New Zealand. So a European who has formerly lived and worked in New Zealand has no right of access to information held about him here unless he is in New Zealand when he makes his request.” Bruce Slane recommended that the standing requirements in section 34 be abolished and that is what we are doing today. The bill will also enable any individual to make an information privacy request. That means individuals do not have to be New Zealand permanent residents or citizens or here in New Zealand at the time the request is made. 
I will look at another example which was raised in 
 NZ Marketing Magazine 
 by a business owner who queried how the privacy laws work. The owner stated that he had a database that included a customer’s personal information which is what most New Zealand businesses hold. However the owner had affiliations with offshore companies and he wanted to know whether he needed to change the way he handled the customer’s personal information. This bill seeks to reduce the likelihood of New Zealand being used as an intermediary for avoiding privacy laws in the United States—an important thing indeed. 
Under this bill the Privacy Commissioner will have authority to prohibit the transfer of personal information from New Zealand to another State if he or she is satisfied on reasonable grounds on three points. First the information has been or will be received in New Zealand from another State and is likely to be transferred to a third party where it will not be subject to a law providing comparable safeguards to the Act. Second the transfer of the information may circumvent the privacy or data-protection laws of the State from which it has been or will be received. Third the transfer would be likely to lead to a contravention of the basic principles of national application set out in part 2 of the OECD guidelines. Prohibition of the transfer of the information is effected by the commissioner when he or she uses a transfer prohibition notice to the agency proposing to transfer the personal information. If someone failed to comply with a notice that person would be liable and could be fined up to $10000. It is important to note that the bill enables any individual to make an information privacy request. As I stated before individuals do not have to be New Zealand permanent residents or citizens or here at the time that the request is made. 
The collection use storage and disclosure of personal information can happen unnoticed across borders and at phenomenal speeds. If we think for a moment about the significant advancements of technology data collection data sharing and data transfer we realise it is vital that the legislation keeps up. With our legislative process it is doubtful that our legislation will keep up at the same speed as technology advances as that advance happens on a daily basis. But this amendment bill takes us a good way down the track in terms of protecting that information. 
The amendments are intended to assure our international business partners that their customers’ personal information will be protected when dealing with businesses in New Zealand. We need to make sure that New Zealand is seen and recognised as a safe productive and competitive place to do business. The amendments are designed to ensure that personal data originating overseas and sent to New Zealand is subject to New Zealand’s privacy protection. The transfer prohibition notice mechanism will ensure that foreign personal data cannot be sent via New Zealand to jurisdictions without adequate privacy protection. The amendments will enable New Zealanders and New Zealand companies to assure their important trade partners that the New Zealand law will ensure their privacy is protected. The amendments dealing with cross-border data transfers aim to substantially reduce the likelihood of New Zealand being used as an intermediary for the avoidance of the privacy laws of other countries. 
I am delighted to support the first reading of the Privacy (Cross-border Information) Amendment Bill which is sponsored by our very capable and hard-working commerce Minister Simon Power. I commend this bill to the House.