Privacy Bill

1. Do the proposed amendments create, amend, or remove:

(a)   offences or penalties (including infringement offences or penalties and civil pecuniary penalties)?

YES

(b)   the jurisdiction of a court or tribunal (including rights to judicial review or rights of appeal)?

NO

The Supplementary Order Paper (SOP) will amend clause 122 of the Privacy Bill, which makes it an offence to, without reasonable excuse, fail to notify the Privacy Commissioner of a notifiable privacy breach. The penalty is a fine not exceeding $10,000.

The SOP will amend the offence by:

-       clarifying that anything relating to a notifiable privacy breach that is known by persons in their capacity as employees or members of an agency is to be treated as being known by the agency;

-       clarifying that employees and members cannot be personally liable under clause 211;

-       clarifying that the general defence in clause 211(2) does not apply to the liability of employers for failing to notify a privacy breach; and

-       clarifying that the general defence in clauses 211(1)(b) and 211(1)(c) does not apply to a principal agency’s or agency’s failure to notify a privacy breach.

1.1. Was the Ministry of Justice consulted about these provisions?

YES

The Ministry of Justice has led the policy development of the Bill. The amendments made to the offence provisions were checked and approved by the offences and penalties vetters by the standard process by which all offences and penalties are vetted. This process includes consideration of consistency with existing criminal offences.  

2. Do the proposed amendments create, amend, or remove any provisions relating to the collection storage, access to, correction of, use or disclosure of personal information?

YES

The SOP makes amendments to the Privacy Bill, which will repeal and replace the Privacy Act 1993, which regulates the collection, use and disclosure of information about individuals.

The amendments in the SOP will refine the Privacy Bill, and do not change significant policy issues.

2.1. Was the Privacy Commissioner consulted about these provisions?

YES

The Ministry of Justice worked closely with the Office of the Privacy Commissioner during the development of the SOP.

3. Do the proposed amendments contain any provisions that could result in the compulsory acquisition of private property?

NO

4. Do the proposed amendments create or amend a power to impose a fee, levy or charge in the nature of a tax?

NO

5. Do the proposed amendments affect rights, freedoms, or impose obligations, retrospectively?

NO

6. Do the proposed amendments:

(a)   create or amend a strict or absolute liability offence?

YES

(b)   reverse or modify the usual burden of proof for any offence or civil pecuniary penalty proceeding?

NO

As discussed above in question 1, the SOP will amend the offence in clause 122. Clause 122 makes it an offence to, without reasonable excuse, fail to notify the Privacy Commissioner of a “notifiable privacy breach”. A “notifiable privacy breach” is defined in clause 117 as a breach that is reasonable to believe has cause serious harm to an affected individual or is likely to do so.    

The intention of the strict liability offence is to incentivise agencies to notify the Privacy Commissioner of notifiable privacy breaches and improve their systems. The obligation to notify “as soon as practicable” only arises when an agency becomes aware that a notifiable privacy breach has occurred (clause 118).

Under clause 122(3), it will be a defence if an agency did not consider the privacy breach to be a notifiable privacy breach, but only if it was reasonable to do so in the circumstances.  

7. Do the proposed amendments create or amend a civil or criminal immunity for any person?

Yes

The amendments will clarify that only agencies can be criminally and civilly liable for a failure to notify a notifiable privacy breach. Employees and members of agencies cannot be criminally or civilly liable under Part 6 of the Act.

8. Do the proposed amendments create or amend a decision-making power to make a determination about a person’s rights, obligations, or interests protected or recognised by law, and that could have a significant impact on those rights, obligations, or interests?

NO

9. Do the proposed amendments create or amend a power to make delegated legislation that could amend an Act, define the meaning of a term in an Act, or grant an exemption from an Act or delegated legislation?

NO

10. Do the proposed amendments create or amend any other powers to make delegated legislation?

NO

11. Do the proposed amendments contain any provisions (other than those noted above) that are unusual or call for special comment?

NO