Privacy rights in today’s environment

Parliament recently passed the Privacy Act 2020. This new Act will replace the current Privacy Act 1993 and will come into effect on 1 December 2020. The Privacy Commissioner has announced that the “new Privacy Act provides a modernised framework to better protect New Zealanders’ privacy rights in today’s environment”.

The key reforms in the Privacy Act 2020 include: • Mandatory notification of harmful privacy breaches to both the Privacy Commissioner and affected parties. • The introduction of compliance orders, which will enable the Privacy Commissioner to require compliance with the Privacy Act. Failure to comply with a compliance order could result in a fine of up to $10,000. • Access determinations, which will give the Privacy

Commissioner the power to demand release of information if any organisation or business refuses to make personal information available on request. • Controls on the disclosure of information overseas.

These will require that, before disclosing personal information overseas, New Zealand organisations or businesses will need to ensure the overseas entities have similar levels of privacy protection to those in New Zealand. • New criminal offences which will make it an offence to mislead an organisation or business in a way that affects someone’s personal information or to destroy

personal information if a request has been made for it. Maximum fines will be $10,000 per offence. • Requirement for compliance with the Privacy Act 2020 by international platforms. This will mean that if an international platform is carrying on business in New Zealand, with New Zealanders’ personal information, they will have to comply with the Privacy

Act regardless of where they, or their servers, are based. Breach of privacy claims can already (i.e. under the Privacy Act 1993) result in significantly high awards of damages if they are successfully taken to a hearing before the Human Rights Review Tribunal. Under the Privacy Act 2020, damages will be able to be awarded for: • Pecuniary loss suffered • Expenses reasonably incurred • Loss of any benefit, whether or not of a monetary kind • Humiliation, loss of dignity, and injury to the feelings of the aggrieved individual. We expect that breach of privacy claims will continue to be a risk for an employer or previous employer and with the strengthening of the new Privacy Act 2020, may even become a greater risk. A breach of privacy issue we commonly encounter is a previous employer talking to third parties or giving verbal references about an employee or former employee. You cannot do so unless you have been expressly permitted to do so by the employee concerned. This is the case even if you are phoned out of the blue by a prospective employer. If you have not been permitted to speak to that prospective employer, then you must decline to do so on the basis you do not have the employee’s permission.

Danny Jacobson and Trudy Marshall are Partners at Employment Lawyers Tauranga and they specialise exclusively in employment law. They operate our Employment Helpline for NZCB members: phone 07 928 0529 for 10 minutes free advice on any employment related issues. (The above is by its nature general, and is not intended to be a substitute for legal advice.)