Twyford PhilPRIVACY BILLThird ReadingHon PHIL TWYFORD (Minister for Economic Development) on behalf of the Minister of Justice: I move That the Privacy Bill be now read a third time.The purpose of this bill is to promote and protect people's privacy and give them confidence that their personal information is properly safeguarded. Privacy can mean different things to different people but I think we can all agree that privacy law and data protection are vital particularly now when information in the hands of agencies and corporates has the power to affect the lives of individuals globally. It's imperative that our law relating to privacy is fit for purpose.New Zealand privacy law has been well served for 27 years by the 1993 Privacy Act. Applying to almost every person business or organisation in New Zealand the Act's privacy principles guide how personal information can be collected used stored and disclosed. However information technology has revolutionised how we deal with personal information. We're collecting storing and disclosing more personal information than ever before. This bill updates the Privacy Act to modernise its language and strengthen privacy protections to better address the challenges of our data-rich society. The bill retains the existing principles-based approach to privacy regulation which is the strength of our privacy regime while further strengthening it in a number of respects. I will highlight a few of these.The Privacy Bill introduces new mechanisms to promote early intervention and risk management by agencies rather than relying on people making complaints after a breach has occurred. The bill's reforms will also enhance the role of the Privacy Commissioner. One of the key reforms in the bill is the new requirement for agencies to report privacy breaches that pose a risk of serious harm to people. A privacy breach is any unauthorised or accidental access to or disclosure alteration loss or destruction of personal information. Privacy breaches can affect people significantly. It's important that people are aware of what's happened to their personal information so that they're able to take steps to prevent or mitigate any harm. Requiring agencies to notify affected people and the Privacy Commissioner of privacy breaches brings our privacy law up to date and aligns it with overseas best practice.This bill also gives the Privacy Commissioner new powers. It allows the commissioner to issue compliance notices which will require an agency to do something or to stop doing something in accordance with the bill. This power will enable agencies and the commissioner to take more proactive steps to address privacy concerns. Currently compliance relies on an individual bringing a complaint rather than placing accountability on the agency to address privacy concerns and issuing compliance notices will fill this gap in the law. The Privacy Commissioner will also be given the power to make access directions requiring agencies to provide people with access to personal information that they hold. Currently the commissioner can only mediate and make recommendations regarding access; so this will streamline the existing complaints resolution process so that people can access their personal information quickly.The bill provides certainty about the extent to which it applies in a range of situations involving overseas persons agencies and information. This is important now that New Zealanders routinely submit their personal information directly to online retailers and other businesses based overseas. To strengthen protections New Zealand agencies will now be accountable for ensuring that acceptable safeguards will apply to information that is sent overseas. Cross-border disclosures will generally only be allowed if the information is subject to comparable privacy protections overseas as apply in New Zealand or the person concerned consents to the disclosure. The bill also clarifies an agency's obligations when they send personal information offshore for storage or processing. It provides that personal information is still treated as being held by a New Zealand agency when it's held by another agency for storage or processing even if that other agency is outside New Zealand or stores the information offshore.I'm aware of concerns that the bill's reforms do not go far enough. In 2018 the European Union's new General Data Protection Regulation was introduced. That law contains new rights such as a right to data portability a right to be forgotten and requirements for algorithmic transparency. Many people including the Privacy Commissioner submitted that similar rights should be added into this bill. However the Justice Committee did not recommend those additions nor did it recommend substantial fines for individuals and organisations who seriously breach their obligations under the Privacy Act. These are important areas of privacy law which would represent substantive changes to the bill and our current policy framework. They require careful consideration policy development and consultation and they need to be considered within the wider regulatory scheme in order to avoid unintended consequences. Adding such reforms into this bill would significantly delay the enactment of the important reforms it already contains. Instead these issues can be considered as part of any future work on privacy reform.At this point I want to acknowledge the road that we've taken to get to this stage of the parliamentary process and all of those who've contributed to this bill's passage. In particular I want to thank the members of the Justice Committee for its work on this technical piece of legislation and to those who submitted. The submissions that were made informed the committee's refinements of the bill which assists the bill in achieving its aims of enhancing protections for personal information. It's satisfying to get to this final stage. I commend this bill to the House.