We have a Privacy Act fit for last century say academics

A lot needs to change to protect people’s privacy and enable individuals to act when their rights are breached, say the editors of the country’s most comprehensive book on privacy law in New Zealand.

Privacy law is in a precarious position, say the editors of Privacy Law in New Zealand (third edition) launched in May.

Co-editors Nikki Chamberlain and Stephen Penk say the country’s Privacy Act 2020 is outdated and lacks many of its global counterparts’ more prescriptive provisions, expansive individual rights, and regulatory tools.

Given the omissions in Privacy Act 2020 , and in light of global technological advances in the age of social media, Chamberlain says there is a real need to develop the law around misappropriation of personality to protect an individual’s right to identity privacy.

New Zealand judges, say Chamberlain and Penk, could adopt a misappropriation of likeness or personality tort, similar to what other countries, including the US, have instated, one that is specifically tailored to assist victims whose images, for example, have been used online without consent.

“There is no reason the common law cannot and indeed should not be utilised to protect an individual’s right in the use of their personality or image,” says Chamberlain.

Meanwhile, the editors note that the Act does not provide an adequate punitive fines regime, it does not provide the right to be forgotten and it does not specifically address algorithms, profiling or automated decision-making.

Chamberlain and Penk say this is in part due to the fact that the content of the amendments to the 2020 Act was largely modelled on recommendations by the New Zealand Law Commission in its 2011 review of the Privacy Act 1993 .

Since the passing of the current Act, the former Privacy Commissioner has lamented numerous times that New Zealand has been given a Privacy Act that is already several years out of date, Chamberlain, Penk and Daimhin Warner the Country Leader for the International Association of Privacy Professionals, say in Privacy Law in New Zealand’s final chapter.

“The concern is that our new Act does not adequately address the risks of the 21st century. Further, by falling behind global privacy regulatory approaches, New Zealand risks losing its coveted European Union adequacy status,” they write.

“This, and potential broader global perceptions that New Zealand may no longer be one of the safest places to process personal information, could put our place in the global data economy in some jeopardy.”

The Minister of Justice’s assurances of ongoing review and incremental reform of the Act will be critical to ensure New Zealand can maintain its respected position in the global data economy, says Warner.