The February 2025 issue of Privacy News includes a reminder about giving feedback on the Biometrics Code, a piece about the Public Services Commission and Stats NZ reports, how to apply to speak in Privacy Week 2025, and new guidance for tenants and landlords on our website. You can also read about the EU Guidelines and task force on AI, and a note about privacy. org. nz being updated. Read the February 2025 issue.
Originally published on the New Zealand Herald 3 October 2024. One of the greatest risks to privacy in the workplace could be sitting next to you – or it could even be you. Employee browsing or the unauthorised access and misuse of personal information is one of the most common privacy breaches. I also believe its one of the least understood or reported on, as required by the Privacy Act. New Zealand is a small place and theres a good chance a familiar name will crop up in a database or on a file at work and it can prove very tempting to have a look. However, a sneaky peek isnt a harmless case of nosiness; its inappropriate and can be a breach of the principles underpinning the Privacy Act.
Privacy Commissioner John Edwards has welcomed the settlement reached between Nicky Hager and Westpac over the banks disclosure of Mr Hagers financial information to Police in 2014. Mr Edwards says there are important lessons to be learned from the case, particularly around the need for clear process when commercial organisations deal with Police requests for customer information. Police had sought Mr Hagers bank information from Westpac without seeking a production order or search warrant from a court. The bank responded by providing several months of his transaction information. Westpac has acknowledged it was wrong to give Mr Hagers bank information to Police without seeking further explanation.
The Privacy Act allows companies to disclose some information to Police and other law enforcement agencies where necessary to avoid a prejudice to the maintenance of the law.
The Independent Police Conduct Authority (IPCA) and Office of the Privacy Commissioner (OPC) released their Joint Inquiry into Police conduct when photographing members of the public (opens to PDF) on 8 September 2022. Report findings
The report found that a general lack of awareness amongst Police of their obligations under the Privacy Act led to officers routinely taking, using and retaining photographs when it is not lawful for them to do so. It also found that thousands of photographs of members of the public have been kept on the mobile phones of individual officers or, if transferred to the Police computer system, not destroyed after there is no longer a legitimate need for them. The Joint Inquiry was initiated in March 2021 after Wairarapa whnau complained that Police officers were photographing their rangatahi in circumstances they felt was unfair or unjustified.
Today’s release of two reports into the protection of personal information show agencies must be better at privacy, says Privacy Commissioner Michael Webster.
The Inquiry into how government agencies protected personal information for the 2023 Census and COVID-19 vaccination programme (the PSC Inquiry) and the Independent investigation and assurance review of allegations of misuse of 2023 Census information (the Stats NZ report), show the protection of personal information needs to be treated as a priority.
Several matters have now been referred to the Office of the Privacy Commissioner (these are detailed below).
Privacy Commissioner Michael Webster said he is carefully reviewing the referrals raised in the two reports. That work will be done in the context the Privacy Act and the need to ensure individuals’ rights to privacy is protected and respected.
“New Zealanders need to be confident that when they do activities, like filling in their Census form, or giving over information for medical services, that their information is collected, used, and shared as the law outlines it should be,” says Mr Webster.
“The Privacy Act is very clear that agencies collecting personal information need to keep it safe and treat it with care. This responsibility extends to the use of third-party service providers.
Agencies need to be confident that personal information is protected wherever and whatever organisation is handling it.”
The Office of the Privacy Commissioner has recently issued guidance to help agencies working with third-party providers understand their responsibilities.
Mr Webster said he was encouraged to see that work on a new information sharing standard is underway, supporting the information stewardship framework at the core of the Privacy Act.
“Its important people can trust that their information is treated with care. In our 2024 Privacy Survey the percentage of people who said they are “more concerned” about privacy issues over the last few years has increased to 55%, a 14% increase from two years ago. New Zealanders were clear in their response to these concerns:
80% want more control and choice over the collection and use of their personal information.
63% said protecting their personal information is a major concern in their lives.
around two-thirds of New Zealanders are concerned about businesses or government organisations sharing their personal information without telling them.
“Good privacy is an essential part of providing services and doing business in a digital economy. Today’s findings should be a reminder to government organisations that good privacy practices aren’t an optional extra but are fundamental to the work they do,” says the Commissioner.
A number of questions have now been referred to the Privacy Commissioner by the PSC Inquiry:
Whether systems and controls were appropriate for personal data following its transmission by Te Whatu Ora, the Ministry of Health and Stats NZ to service providers
Whether there were appropriate means in place for these public agencies to be confident that their service providers were meeting their contractual privacy requirements
Whether personal information was collected or used by Manurewa Marae for unauthorised purposes
Whether separation of personal data from Census data was maintained at Manurewa Marae, and whether privacy statements were adequate to inform people about the use of their information.
A further matter has been referred to the Privacy Commissioner by the Stats NZ report about the collection and management of personal information and confidential census data.
While the review of the referrals takes place, the Office will not be making any further comment.
2024 biennial survey on privacyMedia release: Digital revolution drives concerns for New Zealanders: UMR survey results.
APPA Privacy Awareness Week 2011 social media survey
View the English language survey results and the English language redacted comments of the survey from the Asia Pacific Privacy Authorities social media survey.
View the Spanish language survey results.
View the Chinese language survey results.
View the Korean language survey results.
International Disclosures and Overseas Information and Communication Technologies Survey
Results in this survey showed that a large number of respondents that send information overseas do not check the overseas organisations’ use and management of the information.
The issue of cloud computing’ clearly has major benefits for businesses and government agencies but it also carries some risks.
This survey has found that both the private and public sectors need guidance in this area. While most of the organisations have controls to protect the security of personal information in transit, some have no control over what happens once the information is sent overseas or don’t know if they have controls.
Media release.
View the full report.
May 2011.
Privacy survey 2010
Results in this report are based upon questions asked in the UMR Research nation-wide omnibus survey. This is a telephone survey of a nationally representative sample of 750 New Zealanders 18 years of age and over.
Fieldwork was conducted from 18th to 23rd March 2010 at UMR Research’s national interview facility in Auckland.
Privacy Commissioner John Edwards has welcomed the Governments plans to rethink the practice of collecting individual client level data from social service providers. The Government announced today that social service contracts will no longer require providers to disclose individual client level data until a new data protection and use policy is in place. This is in contrast to previous plans, which required service providers such as NGOs to provide information about individual clients in order to receive funding. This information included clients’ names, number of children and other social services they engaged with. Mr Edwards said I commend this pause in approach. Projects like this have the potential to do a lot of good by measuring and improving the efficacy of social services.
State houses at Arapuni Hydro Works from Archives NZ record number A1124
The guidance below is for tenants, landlords, and others in the rental accommodation sector to clarify what information may be requested at every stage of the rental process. We have also launched a new monitoring and compliance programme to ensure that rental agencies and landlords stay on the right side of the Privacy Act. Resources for Landlords
Resources for Tenants
Questions?
If you have enquiries about the Privacy Act and rentals please email our Compliance Team. We’ve also included questions for tenants and landlords in our Ask Us database.
The Privacy Amendment Bill is making its way through Parliament, and we know organisations are starting to think about how this will impact them. Weve put together key information on the Bill, which well update as it progresses. Guidance
One of the important changes in the Bill is adding Information Privacy Principle (IPP)3A. Well be developing guidance for organisations on the requirements of IPP3A, as well as reviewing OPCs Codes of Practice to determine whether any amendments are required. In the meantime digital. govt. nz has an overview of IPP3A planning for indirect notification requirements. When is this happening?
The Minister of Justice has indicated that the commencement date will be six months after the Act passes. Were aiming to have the guidance developed and published on our website to allow organisations plenty of time to implement the requirements of the new Act.
The first Privacy News of 2025 covers the release of the Biometrics Code and how to give feedback on this, a new case note about personal information being published to a website, and the introduction of OPC’s Mori reference panel. There is also a notice about new translations of our privacy brochures – we now offer them in Traditional and Simplified Chinese, and Vietnamese. Read the January 2025 issue.