SpeechRAYMOND HUO (Labour): Thank you Madam Assistant Speaker.By the time we reported this bill back to the House it was in its 45th edition—45th edition. Big thumbs up to the—Kieran McAnulty: That's amazing.RAYMOND HUO: —it is amazing—Parliamentary Counsel Office. We received advice from the Ministry of Justice the Office of the Clerk and Crown Law. I thank our officials and advisers particularly the submitters.We received and considered 162 submissions from interested groups and individuals. We heard oral evidence from 48 submitters at hearings in Wellington and in Auckland. I think anyone who was involved in this important legislative process must have a sense of achievement. Having said that behind each and every such statement there must be a caveat.The Privacy Bill repeals and replaces the Privacy Act 1993 as recommended by the Law Commission following its comprehensive review of the legislation in 2011. The Act has been in operation for more than 25 years and the recommendations themselves were seven years old or so when the Justice Committee considered this bill. We need to appreciate and face the reality that much has changed since the Law Commission issued its report and the recommendations.Secondly we must appreciate and face the reality that the renewal of our privacy law takes place against a background of increasing invasions of our privacy growing public concerns and rising international standards as well as an unprecedented advance of new technologies in exploiting and storing our personal data. The laws in any jurisdiction are struggling to keep up but we're doing fine. We're doing better than our Australian counterparts.To some extent I should say we are lucky especially for our businesses. New Zealand is one of the very few countries to which personal data of European citizens can be transferred as of right without any additional safeguards; simply because New Zealand has been accorded privacy law adequacy status by the European Commission. In terms of this bill as an Auckland-based barrister Mr Rick Shera observed we have an opportunity to do what we did in 1993 when New Zealand together with a number of other countries used an earlier OECD report to create a law that was fit for local purposes while adopting internationally consistent core principles. So our law was in step with the previous European law and let's keep it that way.The General Data Protection Regulation (GDPR) came into force on 25 May 2018. GDPR is a new EU privacy regulation and represents perhaps the most important change in data privacy regulation in a generation. One of the key changes in the GDPR is the expanded territorial scope. For example Facebook is a US company—we apply the GDPR to all companies that process the personal data of people residing in the European Union. The GDPR includes sweeping changes to how companies like Facebook collect and use personal data. Facebook and other high-tech companies have to take this seriously given the EU is threatening to impose penalties of €20 million or up to 4 percent of global annual revenue for violations. The long arm of GDPR will now reach many New Zealand businesses.There are some key features I'd like to highlight here. First of all the notification threshold: the bill as introduced provides that privacy breaches that have caused harm or pose a risk of harm to people must be notified to affected individuals as well as to the commissioner. The notification threshold attracted the largest number of submissions 85 out of 162. Most submitters including the commissioner are concerned that the bill will require all low-level privacy breaches to be reported even if they are unlikely to cause harm. They think this will lead to what they call notification fatigue and they are concerned that this may cause harm to New Zealand's international reputation if New Zealand appears to have proportionally higher notification for privacy breaches. Also the test of the risk element is a very low threshold for notification. It was lower than the recommendations and also lower than the test applied overseas. Business submitters are concerned that the threshold in this bill as introduced is out of step with comparable jurisdictions notably the EU and Australia.On a more practical point businesses operating across international jurisdictions are keen for the various notification thresholds to be as closely aligned as possible. We're persuaded by the submitters' concerns about the current harm threshold for notification and we recommend that the threshold for notification for privacy breaches be amended to require notifications of breaches where serious harm has resulted. However the new term serious harm" will not be defined under the bill—should not be linked to the current definition of harm in the bill under clause 75(2)(b). Secondly Part 5 of the bill would enable the commissioner rather than the Human Rights Review Tribunal to make directions on complaints about access to information. An appeal against the direction could however be made to the tribunal.Thirdly the issue concerning news media exemptions has attracted lots of attention. The Privacy Bill does not apply to news media carrying out their news activities. The purpose of the exemption is obvious. It is to ensure the news media can perform the role required of them in a democracy by supporting the free flow of information to the public.But there are three points that are worth noting. The first is the definition of "agency" in clause 6 which excludes news media carrying out their news activities. That's easy to understand. But what about books and blogs? We recommend widening the definition of "news activity" in clause 6 to refer to publishing news and observation on news and current affairs including a definition of "publish" to make it clearer that it includes publishing on the internet. This means that publication in books or on the internet can now come under the news activity exemption.There are generally two criteria for such exemptions. The first is independent standards of conduct including privacy standards the second is complaints procedure and the third one is with regard to Radio New Zealand and Television New Zealand. Under the bill as introduced Radio New Zealand and TVNZ were treated differently from their media counterparts because information privacy principle (IPP) 6 and IPP 7 would apply to them in respect of news activities. But I'm very pleased to report that amendments have been made. Radio New Zealand and TVNZ are now brought within the media exemption. Thank you Madam Speaker.Bill read a second time."