Little AndrewPRIVACY BILLFirst ReadingHon ANDREW LITTLE (Minister of Justice): I move That the Privacy Bill be now read a first time. I nominate the Justice Committee to consider the bill.The purpose of this bill—Hon Christopher Finlayson: Well done on moving the motion.Hon ANDREW LITTLE: I'd be tempted to sit down now but I know Mr Finlayson will have much to contribute to this very important debate since this bill goes back to its initial preparation in 2012 which was only six years ago.The purpose of the bill is to promote and protect people's privacy—that's self-evident—and to give them confidence that their personal information is properly protected. The Privacy Act the current one was enacted 25 years ago. Since then information technology has revolutionised how we deal with personal information. We are collecting storing and disclosing more personal information than ever before using social media e-commerce interconnected devices cloud storage and other new technologies—all familiar to Mr Finlayson.Nowadays personal information can be easily distributed around the world and large quantities of data are readily stored retrieved and disclosed. This creates new challenges for protecting personal information. A regime that is focused on early identification and prevention of privacy risks rather than after-the-fact remedies is required. In 2011 the Law Commission called for the Privacy Act to be repealed and replaced with a modernised law. This Privacy Bill largely achieves that purpose. It will strengthen privacy protections and better address the challenges of the digital age. It also modernises the language of the Act to make it more accessible.As the Law Commission suggested the Privacy Bill retains the existing Act's 12 information privacy principles—or IPPs as they are apparently known. The IPPs apply to public- and private-sector agencies. They provide a framework for handling personal information at all points of its life cycle from collection to destruction. They provide important protections such as a right for people to access and correct personal information about themselves and a requirement for agencies to collect personal information from the person concerned directly. Agencies also must ensure there are reasonable safeguards against loss misuse or disclosure of personal information and they must not use or disclose personal information for purposes other than for which it was collected. The Privacy Bill introduces new mechanisms to promote early intervention and risk management by agencies rather than relying on people making complaints after a privacy breach has already happened. The bill's reforms will also enhance the role of the Privacy Commissioner. One of the key reforms in the Privacy Bill is a new requirement for agencies to report privacy breaches. A privacy breach is any unauthorised access to or disclosure loss or destruction of personal information. It can also include a ransomware attack. Privacy breaches that pose a risk of harm to people must be notified to affected individuals and to the Privacy Commissioner. There are some exceptions to the requirement to notify people about privacy breaches such as when this would prejudice New Zealand's security prejudice the maintenance of law or endanger someone's safety. Privacy breaches can affect people significantly. It's important people are aware of what has happened to their personal information so they can take steps to prevent any harm. Requiring agencies to notify affected people and the Privacy Commissioner of privacy breaches brings New Zealand law into the digital era and aligns it with overseas best practice. The Privacy Bill also gives the Privacy Commissioner new powers. It allows the commissioner to issue compliance notices which will require an agency to do something or stop doing something in accordance with the bill. For example if an agency frequently experiences notifiable privacy breaches without taking any steps to change their practice the commissioner will be able to issue a compliance notice to require them to act. This power will enable the commissioner to take more proactive steps to address privacy concerns. Currently compliance relies on an individual bringing a complaint rather than allowing the commissioner to address systemic privacy risks and repeated breaches. Issuing compliance notices will fill the gap in the current legislation. The Privacy Commissioner will also be given the power to make access directions requiring agencies to provide people with access to personal information held about them. Currently the commissioner can only mediate and make recommendations regarding access. This will streamline the existing complaints resolution process so that people can access their personal information quickly. In the digital age personal information can be easily distributed around the world. We are all aware of the adage—and I paraphrase it now—that lies in: social media can be halfway around the world while truth is still strapping its shoes on. To strengthen privacy protections New Zealand agencies will now be accountable for ensuring that acceptable safeguards will apply to personal information that is sent overseas. Cross-border disclosures of personal information can generally be made if the information is subject to comparable privacy protections overseas as apply in New Zealand or the person concerned consents to the disclosure. The bill also clarifies an agency's obligations when they send the personal information offshore for storage or processing. It provides that personal information is still treated as being held by a New Zealand agency when it is held by another agency for storage or processing. This is the case even if that other agency is outside New Zealand or holds the information offshore. The bill enhances the Privacy Commissioner's existing investigation powers by allowing him or her to limit the time frame for an agency to comply with a requirement to provide information and by increasing the penalty for non-compliance. Furthermore it would be an offence to mislead an agency and to destroy documents containing personal information where a request has been made for it. The maximum penalty is a fine of up to $10000. Over the last few years international privacy frameworks have been updated to reflect developments. The OECD privacy guidelines which our Privacy Act gives effect to were updated in 2013 to include new accountability mechanisms such as requiring data breach notifications. The European Union has also passed a new general data protection regulation—or the GDPR—which includes similar new privacy protections. The GDPR comes into force in May this year. New Zealand is one of the few countries in the world to have obtained adequacy status with the EU's privacy law. This means that EU countries can provide personal information to New Zealand for processing without needing to provide extra privacy safeguards. The reforms in the Privacy Bill will better align New Zealand's law with the GDPR and the OECD privacy guidelines. This will assist New Zealand's case for maintaining its adequacy status. In an increasingly digital and data-rich society the measures in place to protect people's privacy interests are vitally important. By maintaining the flexible principles-based framework of the current Act and making key reforms the Privacy Bill will ensure that our privacy law is up to date accessible and has the right safeguards to protect people's privacy in the digital age. The bill is not perfect and even though it had been languishing around for the best part of five or six years and more work could have been done on it I felt that it was important to bring the bill to the House now so that there will be plenty of opportunity to change and to improve it. The select committee process is very important and I urge all New Zealanders with an interest in privacy as an issue to come forward and to have their say on the bill and let's make this a more perfect piece of legislation to cover this very vital and important area. The new privacy protections that it provides are important and it will be important for the bill to have maximum scrutiny not just from members of this House but from all citizens as it works its way through. On that note I commend this bill to the House.