20 June, 2019
This article is the second instalment in a series of Clyde & Co publications analysing the evolution of New Zealand's privacy landscape. While our first commentary discussed the New Zealand Justice Committee's recommendation that a notifiable data breach scheme be implemented in New Zealand, this article: (1) gives a high level summary of recent privacy law developments in Australia and New Zealand, (2) outlines the framework for New Zealand's privacy laws and finally (3) tables a comparison of the two countries' regimes with the GDPR.
Recent antipodean privacy law developments
The implementation of the General Data Protection Regulation (GDPR) in early 2018 has catalysed privacy and data law reform south of the equator. As we discussed in our first article, New Zealand's new Privacy Bill updates the country's 90s vintage privacy legislation. Australia's notifiable data breaches scheme is now a little over a year old and further privacy changes are slated for July 1 with the introduction of the Consumer Data Right, an additional consumer right which is intended to provide individuals with greater control over their data when transferring their accounts between different banking, energy and telecommunications services providers. The Australian Privacy Act itself is not immune from further shake ups, with suggestions that financial penalties under the Privacy Act be significantly increased. The current maximum penalty under the Privacy Act of AUD 2.1 million is minimal in comparison with the €20 million capable of being imposed under the GDPR.
These Australian and New Zealand privacy changes are reflective of a global movement towards stricter privacy compliance frameworks, with regimes focussing on businesses securely storing personal information and promptly notifying regulators and affected individuals when a data breach occurs. The movement towards stricter compliance regimes globally and publicity surrounding recent data breaches means many more businesses now have a general understanding of their obligations with regards to customers' personal information.
New Zealand's privacy law framework
From its inception, the New Zealand Privacy Bill (the Bill) was designed to both modernise New Zealand's privacy legislation and ensure the country moved towards the implementation of a stricter privacy compliance regime, in line with global trends.
Top three updates to the Bill
- it retains the 12 Information Privacy Principles which form the core of current legislation;
- it introduces a new principle to provide additional protection for personal information disclosed to entities based outside New Zealand, such as when a New Zealand business provides customer data to email direct marketing businesses like Mail Chimp, currently headquartered in Atlanta, the United States; and
- it introduces a notifiable data breach scheme.
As mentioned, the New Zealand Privacy Bill increases privacy compliance requirements for New Zealand businesses and foreign entities doing business in New Zealand. Businesses currently operating in New Zealand or with plans to enter the market should have a holistic understanding of current laws and proposed changes. You should seek advice if your business holds particularly sensitive customer or client data such as health information, financial information or identification details or if your business holds a large volume of data generally.
A snapshot comparison of Australia, New Zealand and the European Union's privacy regimes
In light of the evolving New Zealand privacy environment, we have compiled the following table to assist you to understand the key differences between each jurisdiction. If you are unsure of how the Privacy Bill might affect your business, we recommend you seek advice.
The following table is drafted with the assumption that New Zealand's Parliament will incorporate the amendments proposed by the Justice Committee into the final version of the Bill.
| NEW ZEALAND PRIVACY BILL | AUSTRALIAN PRIVACY ACT | EUROPEAN UNION (EU) GDPR | |
|---|---|---|---|
| Who regulates these laws? | The Office of the Privacy Commissioner. | The Office of the Australian Information Commissioner. | The GDPR is supervised by individual European Union member states. |
| Who do these laws apply to? | Agencies, being any public or private sector organisation. An exception exists for news media while gathering and reporting news. |
APP entities, being agencies or an organisation with an annual turnover of more than AUD 3 million, or which fall under the Privacy Act because of the type of services provided, such as health services. |
Data controllers, being any agency or body which determines the purposes and means of processing data; and Data processors, which process data on behalf of the controller. |
| Do these laws apply outside the country or jurisdiction's borders? |
The Bill will apply to:
|
The Act applies to businesses:
That is, organisations which have an 'Australian link'. |
The GDPR applies to companies which:
|
| What rights do individuals have? |
The Bill includes an 'Individual participation principle', prescribing that individuals should have the right to:
|
Businesses must amend, destroy or de-identify personal information held about an individual either upon request by the individual or when the information is no longer required for the purpose it was originally collected for. |
In relation to their personal data, individuals based in the EU have the right to access their data, to have their data erased, ported to a third party, restrict the use of their data or to object to its use. |
| What amounts to a breach? |
|
|
Under the GDPR, a personal data breach means a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. |
| What data breaches must be reported? |
Notifiable privacy breaches must be reported. A notifiable privacy breach is one where it is reasonable to believe that the breach has caused serious harm to the affected individual(s), or it is likely to do so. Agencies must consider factors including:
|
Eligible data breaches must be reported, being breaches which are 'likely to result in serious harm' to an affected individual. Serious harm includes but is not limited to psychological, financial, reputational, emotional, or physical harm. |
The GDPR distinguishes between when a supervisory authority must be notified and when affected individuals must be notified. A supervising authority must be notified unless the personal data breach is unlikely to result in 'a risk to the rights and freedoms' of natural persons. Affected individuals must be notified where the breach is likely to result in a high risk to their rights and freedoms. |
| Reporting timeline | Agencies must notify the Privacy Commissioner as soon as practicableafter becoming aware that a notifiable privacy breach has occurred. | APP entities have 30 days to carry out a reasonable and expeditious assessment. Once an organisation determines that the breach is notifiable, the entity must notify the OAIC and individuals as soon as practicable. |
Businesses must notify supervising authorities without undue delay and where feasible within 72 hours. While there is no prescribed timeline for notifying individuals, the notification should be made without undue delay. |
| Maximum penalty | NZD 10,000. | AUD 2.1 million (this is currently under review). |
The higher of either:
|
How we can help?
Clyde & Co has the largest dedicated and rapidly expanding cyber incident response practice in Australia and New Zealand. Our experienced team have dealt with over 700 data breach and cyber related incidents in recent times, including a number of the largest and most complex incidents in Asia Pacific to date.
From pre-incident readiness, breach response, through to assistance with regulatory investigations and proceedings, as well as recoveries, we assist clients in Asia Pacific across the full cyber lifecycle.
Footnotes
1. Privacy Bill 2018 (NZ) s 3A(1)(a).
2. Ibid s 3A(1)(b).
