Privacy & NZ Privacy Act
Digital Skills for the Workplace 2022
A quick tour of the privacy principles….
You need to know:
The NZ Privacy Act was updated in December 2020.
The Privacy Act 2020 has 13 privacy principles that govern how you should collect, handle and use personal information.
1.
You can only collect personal information if it is for a lawful purpose and the information is necessary for that purpose. You should not require identifying information if it is not necessary for your purpose.
2.
You should generally collect personal information directly from the person it is about. Because that won’t always be possible, you can collect it from other people in certain situations. For instance, if:
• the person concerned gives you permission
• collecting it in another way would not prejudice the person’s interests
• collecting the information from the person directly would undermine the purpose of collection
• you are getting it from a publicly available source
3.
When you collect personal information, you must take reasonable steps to make sure that the person knows:
• why it’s being collected
• who will receive it
• whether giving it is compulsory or voluntary
• what will happen if they don’t give you the information
Sometimes there may be good reasons for not letting a person know you are collecting their information – for example, if it would undermine the purpose of the collection, or if it’s just not possible to tell them.
4.
You may only collect personal information in ways that are lawful, fair and not unreasonably intrusive.
Take particular care when collecting personal information from children and young people.
5.
You must make sure that there are reasonable security safeguards in place to prevent loss, misuse or disclosure of personal information.
This includes limits on employee browsing of other people’s information.
People have a right to ask you for access to their personal information.
6.
People have a right to ask you for access to their personal information. In most cases you have to promptly give them their information. Sometimes you may have good reasons to refuse access.
For example, if releasing the information could:
• endanger someone’s safety
• create a significant likelihood of serious harassment
• prevent the detection or investigation of a crime
• breach someone else’s privacy
7.
A person has a right to ask an organisation or business to correct their information if they think it is wrong.
Even if you don’t agree that it needs correcting, you must take reasonable steps to attach a statement of correction to the information to show the person’s view.
8.
Before using or disclosing personal information, you must take reasonable steps to check it is accurate, complete, relevant, up to date and not misleading.
9.
You must not keep personal information for longer than is necessary.
10.
You can generally only use personal information for the purpose you collected it.
You may use it in ways that are directly related to the original purpose, or you may use it another way if the person gives you permission, or in other limited circumstances.
11.
You may only disclose personal information in limited circumstances. For example, if:
• disclosure is one of the purposes for which you got the information
• the person concerned authorised the disclosure
• the information will be used in an anonymous way
• disclosure is necessary to avoid endangering someone’s health or safety
• disclosure is necessary to avoid a prejudice to the maintenance of the law
12.
You can only send personal information to someone overseas if the information will be adequately protected. For example:
• the receiving person is subject to the New Zealand Privacy Act because they do business in New Zealand
• the information is going to a place with comparable privacy safeguards to New Zealand
• the receiving person has agreed to adequately protect the information – through model contract clauses, etc. If there aren’t adequate protections in place, you can only send personal information overseas if the individual concerned gives you express permission, unless the purpose is to uphold or enforce the law or to avoid endangering someone’s health or safety.
13.
A unique identifier is a number or code that identifies a person in your dealings with them, such as an IRD or driver’s licence number.
You can only assign your own unique identifier to individuals where it is necessary for operational functions.
Generally, you may not assign the same identifier as used by another organisation.
If you assign a unique identifier to people, you must make sure that the risk of misuse (such as identity theft) is minimised.
You need to know how Privacy Principles apply to your business and follow the Principles:
Follow The Rules
Online Tools to help you prepare, prevent and respond to a Privacy Breach:
Tips and Tools
Plan for a Breach
Under the Privacy Act 2020, if your organisation or business has a privacy breach that either has caused or is likely to cause anyone serious harm, you must notify the Privacy Commissioner and any affected people as soon as you are practically able.
https://www.privacy.org.nz/responsibilities/your-obligations/
https://www.privacy.org.nz/responsibilities/privacy-breaches/preventing-privacy-breaches/
https://www.privacy.org.nz/responsibilities/your-obligations/privacy-officers/
By the end of this section, your audience should be able to visualize:
Plan for a Breach
Respond to a Breach
https://www.privacy.org.nz/responsibilities/privacy-breaches/responding-to-privacy-breaches/
trying to get lost information back / disabling the breached system / cancelling or changing computer access codes / trying to fix any weaknesses in your organisation’s physical or electronic security.
https://www.privacy.org.nz/responsibilities/privacy-breaches/notify-us/evaluate
https://www.privacy.org.nz/responsibilities/privacy-breaches/notify-us/
NZ Privacy Resources
Free eLearning - Office of Privacy Commissioner
https://www.privacy.org.nz/tools/online-privacy-training-free/
Notify Us - Privacy Breach Online Reporting
https://www.privacy.org.nz/responsibilities/privacy-breaches/notify-us/
About Me - Request My Info Tool
https://www.privacy.org.nz/tools/aboutme-request-my-info-tool/
Priv-o-matic Privacy Statement Generator
https://www.privacy.org.nz/tools/privacy-statement-generator/
Sending Information Overseas (Principle 12)
https://www.privacy.org.nz/responsibilities/disclosing-personal-information-outside-new-zealand/
Build Contract Clauses
NZ Privacy Resources
Office of Privacy Commissioner Privacy is Precious Campaign 2020
https://www.privacy.org.nz/privacy-act-2020/campaign/
13 Principles (Dec 2020)
https://www.privacy.org.nz/publications/guidance-resources/pa2020-infosheets/
https://www.privacy.org.nz/your-rights/resources-for-individuals/
More Useful Links
Apps and Browsers
Duck Duck Go browser (no tracking)
Check privacy and security settings (device + apps + social) eg:
Security and Privacy settings for apps
https://www.keepitrealonline.govt.nz
Covid 19.
Privacy Policy for Contact Tracing
https://tracing.covid19.govt.nz/help/privacypolicy
MoH on Privacy and Security https://www.health.govt.nz/our-work/diseases-and-conditions/covid-19-novel-coronavirus/covid-19-resources-and-tools/nz-covid-tracer-app/privacy-and-security-nz-covid-tracerm
MoH PIA (Privacy Impact Assessment) (May 2021) https://www.health.govt.nz/system/files/documents/pages/pia-covid-tracer-app-release-may-2021-v1-3-final.pdf
Office of Privacy Commissioner Covid 19 Resources
https://www.privacy.org.nz/resources-2/privacy-and-covid-19/
Article Discussing Pros and Cons (Jan 2021)
https://www.stuff.co.nz/national/health/coronavirus/300205237/covid19-cybersecurity-experts-say-covid-tracer-apps-benefits-outweigh-risks
GDPR
Lawful basis and transparency
Data security
Accountability and governance
Privacy rights
Data protection by design and by default
Right to be Forgotten
International Privacy Resources
The International Association of Privacy Professionals
General Data Protection Regulation
OneTrust DataGuidance Solutions
https://www.dataguidance.com/notes/new-zealand-data-protection-overview
Action List
We hope you’ll use these resources to consider how Privacy Principles apply to your business and to plan for a breach and be prepared to respond.
Consider the Privacy of yourself and your whanau and take steps to protect this.
Privacy is Precious.
Thanks to Office of the Privacy Commissioner for the excellent public content on their website which is extensively quoted (for accuracy) in this presentation.
Good luck!