Privacy (Cross-border Information) Amendment Bill

Hon PANSY WONG (Minister for Ethnic Affairs) Link to this

I move, That the Privacy (Cross-border Information) Amendment Bill be now read a second time. The Privacy Act is currently silent on the cross-border enforcement of privacy law. This bill remedies that, and enables us to assure our international trade partners that their customers’ personal information will be protected by New Zealand law. The bill enables the Privacy Commissioner to issue a notice prohibiting the transfer to a third country of personal information sent to New Zealand from overseas, if there is evidence of an attempt to circumvent the privacy laws of the source country. This legislation also allows foreign nationals who are resident overseas to make information privacy requests, although public sector agencies will be able to charge for making that information available. Finally, the bill establishes a mutual assistance framework that will enable the Privacy Commissioner to cooperate with overseas privacy enforcement authorities on the handling of complaints.

I thank the Justice and Electoral Committee for its careful consideration of the bill, and indicate the Government’s support for the amendments it recommended. The committee identified a gap that unintentionally limited the commissioner’s powers when undertaking an inquiry into cross-border sharing of personal information. To close this gap, the committee recommended aligning the powers of the Privacy Commissioner to conduct a cross-border inquiry with the powers she currently has to conduct an investigation into a complaint under the Privacy Act, under new section 114BA, to be inserted by clause 8.

The committee also recommended changes to new section 114B, which specifies a criterion that the Privacy Commissioner must consider when deciding whether to issue a transfer prohibition notice. The committee found that the first two subsections, which concern the protection of personal information received from overseas, overlapped, and it recommended removing subsection (1)(b). The committee also suggested that subsection (1)(c) was not sufficiently flexible, because it incorporated by reference the basic principles of national application set out in the OECD Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data. The committee recommended that those principles should be incorporated in a schedule, to ensure that any future changes to the principles were not automatically incorporated into the Privacy Act. A schedule that can be amended by Order in Council has been included. Other amendments to the bill involve clarifying provisions, or are of a technical or administrative nature.

The committee considered the Privacy Commissioner’s concerns about whether the current grounds for complaint, and the commissioner’s enforcement powers, needed to be extended. The committee also considered whether a specific provision was required relating to the sharing of information with overseas privacy enforcement authorities, but the Minister is satisfied that the existing provisions of the Privacy Act are sufficient to deal with the issue the commissioner raises.

This Government is committed to enhancing the international competitiveness of New Zealand - based businesses in cross-border commerce. We recognise that consumers too are affected by increasing globalisation and developments in e-commerce. I welcome the benefits that the bill offers to businesses and consumers alike, and I commend this bill to the House.

CHARLES CHAUVEL (Labour) Link to this

The bill that is under consideration in this session was introduced by the previous Labour Government, and, as a result, members on this side of the House intend to continue their support for the Privacy (Cross-border Information) Amendment Bill.

The bill will address two problems that currently exist in the Privacy Act. The current Act does not allow foreign nationals who are resident overseas to make information privacy requests for information that is held in New Zealand, and the Act does nothing to prevent data received from overseas being transferred out of New Zealand to another jurisdiction without there being adequate privacy protection. They are two obvious flaws, which have come about as a result of the increased flow of both people across borders and information across borders since the enactment of the original legislation. They are a perfect example of the sort of problem that arises over time that this Parliament needs to update and address so that the commercial and the human rights concerns that arise out of those flaws can be properly addressed. There is a real business benefit as well as a personal benefit from the closure of loopholes by this legislation. Once it is passed, we will be able to better demonstrate in international negotiations that information stored in New Zealand or in respect of persons and business with which New Zealand has a connection is secure. That has to be a good thing for New Zealand business.

The bill complements the Law Commission’s review of privacy laws. The commission has recommended enacting surveillance devices legislation, which would make New Zealand privacy laws more consistent, and make it an offence to secretly film or track people. There is work to do in that area, but we are starting at least to fulfil some of the recommendations of the commission by getting on with this legislation today.

It is important to see the legislation in the context of much of the law that this Parliament has dealt with in the past couple of days under urgency. This legislation is an important part of the continuation of the business-friendly programme that the previous Labour Government was enacting to ensure that there was not excessive red tape and that our laws were up to date, so that businesses and individuals could feel confident about that level of sophistication in our legal system. So it is good to see Parliament finally progress the international privacy legislation through its final stages.

The Justice and Electoral Committee’s main concern was apparent from its report related to the OECD guidelines concerning privacy. Those guidelines are of extreme importance to New Zealand, given our membership of the OECD. Due to the way that the guidelines had originally been incorporated into the bill, any changes by the OECD to the guidelines would have been automatically incorporated into the legislation—that is, changes made by a foreign organisation, an organisation comprising other countries as well, would have simply resulted in an automatic change to New Zealand law without any examination by this Parliament. The committee looked at that matter and took some advice from the Regulations Review Committee, as I recall. The committee in the end recommended that the basic principles of national application should be set out in a schedule to the Act, that the Governor-General be given the power to make regulations to amend the new schedule in the event that the OECD made new guidelines, and that any changes to the schedule as a result of that OECD activity would be subject to the Regulations (Disallowance) Act 1989, and thereby scrutinised by Parliament in the event that it was necessary. So there was a proper framework put in place on an incorporation by reference clause to ensure that parliamentary oversight of any amendments would be proper and in keeping with our constitutional traditions. It is good to see that the committee’s report is being incorporated as far as those recommendations are concerned in the bill.

The committee also recommended that it be made absolutely explicit in the legislation that when determining whether to prohibit any transfer of personal information, the Privacy Commissioner should use the investigative powers in the Privacy Act if he or she felt the need to, just as he or she can when conducting an inquiry under the Act. So, the commissioner will be able to hear information from any person that he or she considers necessary in the event that that seems the right thing to do. The select committee process has clearly improved the legislation. We have proper scrutiny by Parliament of any changes incorporated from the OECD, and we have an enhancement of the Privacy Commissioner’s authority consistent with her general jurisdiction.

Members on this side of the House support the legislation. It is good to see the rest of Lianne Dalziel’s programme as the former Minister of Commerce and the former Associate Minister of Justice being implemented by this House.

CHESTER BORROWS (National—Whanganui) Link to this

It is a shame that there was the odd barb in the previous speaker’s comments, because the Privacy (Cross-border Information) Amendment Bill is well supported across the House. It was kicked off under the previous Minister of Justice and completed under the current Minister. It is another sterling piece of work from the Justice and Electoral Committee, and I give my thanks, especially, to the Hon David Parker for the contributions he made. The bill seeks to deal with a number of hurdles to international access to privacy, as well as New Zealand’s ability to maintain sovereignty over the information that it discloses. A number of issues were raised and addressed during the select committee process.

Remedies have been provided to enable foreign nationals who are located overseas to access and correct personal information. The bill also authorises the Privacy Commissioner to refer a complaint to an overseas privacy enforcement agency, if the complaint is within the jurisdiction of that authority. It also enables the Privacy Commissioner to prohibit the transfer of personal information outside New Zealand in cases where that information has been routed through New Zealand to avoid the privacy laws of the originating country. The bill further provides for the transfer of personal information outside New Zealand, and for prohibitions on the transfer of personal information outside New Zealand. The commissioner’s powers to obtain information have been catered for within amendments that came out of the select committee process.

I commend the bill to the House.

KEITH LOCKE (Green) Link to this

The Green Party will support the Privacy (Cross-border Information) Amendment Bill. It is driven by the correct concern of the European Union to have private information on databases etc. protected when that data goes to or through other countries. It is great that the European Union is leading the world on this issue and pulling countries like New Zealand in behind. It is good that the Justice and Electoral Committee appended to its report the basic principles of national application set out in Part Two of the OECD guidelines, because they are very good principles. They state that there should be limits on the collection of personal data and that there should be a specific purpose for which data is collected, so that it is not just a broad-brush collection. The principles also include a use limitation principle, ensuring that data will be disclosed only for particular purposes and to the right people and the right authorities.

There is an openness principle, which states that systems should be open and transparent, and a security safeguards principle. The individual participation principle states that individuals should have the right to know whether they are on a database. In the New Zealand case, of course, they should be able to gain access to that information. If the information is wrong or dated, it should be erased or changed. The accountability principle states that the whole system should be accountable. They are very good principles and this bill will help implement them, particularly what previous speakers have mentioned about the prevention of information gathering that avoids European Union privacy laws by passing through New Zealand and on to a country where there are no proper privacy laws. The European Union has had an ongoing battle on this issue, particularly with the United States. That is very relevant to us, because we have very close connections to the United States, including the passing of private data between New Zealand and the United States.

One of the areas where the European Union has had a battle with the United States authorities is in relation to data about people who travel on airlines. For a few years the American authorities wanted every bit of information that an airline passenger might have used to purchase a ticket and board the aircraft, including the credit card numbers of anyone who bought their tickets by credit card. The European Union said that that was too great an intrusion into privacy, and there have been big debates on that matter in the European Parliament and at European Union negotiations. Last month they reached an agreement in terms of what data and what more limited amount of data would be passed on to the US authorities.

The other dimension where there has been a big argument is in relation to financial transaction information that passes through the SWIFT computer system. SWIFT is an international bank trading reconciliation system involving virtually every overseas transaction, including New Zealand banking transactions. New Zealand banks are among the 9,400 banks that are signed up to SWIFT. All that information passes through the SWIFT system, which is based in Europe with a mirror unit in the United States. The United States said to the European Union that when it had SWIFT on its territory it wanted access to every transaction in order to run it through its terrorist database. The United States said that for security reasons it wanted access to all the financial transaction information. After long negotiations the European Union and the United States reached an agreement. I am not sure of the details as I have not studied it to see whether it is a satisfactory agreement, but it allows the United States access to that information, with certain controls.

There will be a European Union representative stationed in the United States to monitor whether the privacy concerns of the European Union and all those principles that I outlined in the appendix in the report back from the Justice and Electoral Committee are properly upheld. I think it will be challenging, because the reality—and we found this in previous legislation that has passed through this House—is that when we talk about passing on, for example, customs information to the United States, the idea of passing it to a specific agency in the United States is that it is for use by that agency only. It is not to be passed on by that United States agency to some other United States agency, unless it is broken down a bit. This is especially the case with the establishment of Homeland Security, which incorporates a whole lot of agencies that are separate in New Zealand or separate in the European Union countries. It is very hard to prevent that data crossing all sorts of boundaries in the United States.

Secondly, there is the problem of the very loose nature of the United States databases and its very weak privacy laws. I do not think that has been solved yet in the United States. The terrorist database in the United States, as I understand it, has 800,000 names. Well, there are hardly that many dangerous terrorists running around. When people investigated that database, and there have been official investigations and tests to see how accurate that information is, they found that there is a huge error rate—up to one-third of the entries are wrong. There are problems with all sorts of people’s privacy being intruded that should not be and people finding it difficult to get on airlines. Cat Stevens, who was here recently on a singing tour, was excluded from the United States because he ended up on the American database, so he was hauled off the plane, etc. There are still big problems with that.

I think it is important that we are on our toes when working with the European Union to make sure that there are better privacy systems and data protection, particularly in the United States. It is also important for other countries around the world. We want to be a model in that respect. I think what the Privacy Commissioner has done in this area has been fantastic, too. In not only this bill but also other bills, the Privacy Commissioner has insisted on being involved in vetting the regulations worked out to make sure that privacy principles were upheld in earlier legislation relating to customs. It was the Privacy Commissioner who was very insistent that any data sent overseas should be for a particular purpose and for a particular agency, and not generally transferred. So with those few comments, I would like to like indicate that the Green Party will be supporting this bill. Thank you.

RAHUI KATENE (Māori Party—Te Tai Tonga) Link to this

It is a pleasure to stand and take a call on this, the second reading of the Privacy (Cross-border Information) Amendment Bill. While preparing for this speech, I read a staggering statistic in relation to this bill. According to the Privacy Rights Centre, up to 10 million Americans are victims of ID theft each year. It is mind-blowing to think of so many people being cheated of their unique identity and having their personal information stolen from under their eyes. I have to say that when our caucus was discussing this bill, my colleague Hone Harawira was rather amused to think that some young American punk could be running around using his name and trying to access his non-existent credit card. But it was less amusing when we pointed out to him that that fake Hone Harawira could be able to access his passport and take off anywhere in the world—say, Paris—and create problems over there.

So there is a problem, and it is good to know that one of the immediate advantages of this bill is that it will ensure a greater protection for personal information. The bill will also provide greater assurance to other countries that the privacy laws in this country can be relied upon to adequately protect personal data.

In many respects, this bill has been a long time coming. Since 1998 the European Commission has been urging the New Zealand Government to introduce two minor amendments to the Privacy Act, in order to meet the test of adequacy regarding the law about the privacy of personal information. That will be a benefit for both the protection of personal rights and New Zealand’s trading relationships. But for Māori there is an even more important reason why this bill deserves to be supported. It comes back to whakapapa, the unique genetic code that links us through our genealogy to our tūpuna. One of the things Māori will often say to one another is that when a Māori child is hit, the whakapapa of its tūpuna is being attacked. The point is that the unique genealogy that links descendants to those who have walked before them must be respected and regarded as sacred. So this bill helps to preserve the sacred association with our origins that we acknowledge. It will help to ensure that New Zealand law meets the expectations of our trading partners, and it will remove an anomaly so that people living overseas can access their personal information held here in New Zealand.

The Māori Party is happy to support this bill, and the advance it makes in keeping pace with standards of data protection across the world. More particularly, we support it because it enables our whakapapa to be cared for appropriately. Globalisation, the growth of the Internet, and rapidly declining communication costs have presented new challenges in respect of protecting the personal information of individuals. We hope that with these amendments there will be superior protection for New Zealanders engaged in international transactions. There will be better access for people to their individual information, while limits will be placed on the transfer of that information. We are pleased to provide our support for this bill.

SIMON BRIDGES (National—Tauranga) Link to this

At its broadest, the Privacy (Cross-border Information) Amendment Bill shows a Government that takes privacy seriously, and that takes international frameworks and cooperation very seriously. I agree with Charles Chauvel—in what was actually a pretty negative, petty speech, basically—that this bill is pro-business and does a good job there. But I really want to say this bill gives us an opportunity to talk a little, in the remaining time that we have, about privacy and the issues that we confront with regard to it.

I think that privacy is a fascinating area, and one that this Parliament will have to grapple with even more in years to come. It seems to me that in privacy issues there is always a balance to be struck between freedom of information and expression on the one hand, and legitimate privacy and dignity issues on the other hand. We see that countries all around the world are grappling with that. Traditionally freedom of information has come out on top, but I think that that is changing as we see technology grow, with Facebook and with all those sorts of things. Different countries certainly take different approaches. The Law Commission has put out—as it tends to—a very long and learned paper on privacy, I think in 2009. As Sir Geoffrey Palmer says in that paper, these are big issues, and they are hard. He said “There are difficulties about defining privacy and balancing it against other interests. Rapid advantages in technology also mean that the landscape is constantly changing. Because technology is making it easy to invade people’s privacy, the issues raised … are of importance to everyone.”

This is a very good bill. As I say, it shows that the Government takes privacy, international agreements, and business seriously. I doubt very much whether this will be the last time that we have to seriously debate and negotiate these sorts of issues, but it is good to stand in favour of legitimate privacy interests in my call to the House on this bill.

CLARE CURRAN (Labour—Dunedin South) Link to this

I would like to speak in the second reading debate of the Privacy (Cross-border Information) Amendment Bill, and I make particular mention of the work done on this bill by my colleague the Hon Lianne Dalziel, as Minister of Commerce and Associate Minister of Justice in the previous Labour Government. I also commend the Green Party today for supporting this bill. I think that shows true maturity, and it is good to see cross-parliamentary support on this issue.

The bill was introduced by the Hon Lianne Dalziel in the previous Labour Government in July 2008 and had its first reading on 1 April last year. As members have heard, it was reported back to the House in September last year, but it has taken long to get to this point, which my colleague Charles Chauvel spoke about with some regret. The bill addresses a number of problems with the Privacy Act, which I will spell out quickly. But along with the launch of the Law Commission’s review of privacy, an action by the previous Labour Government, this bill was part of Labour’s efforts to update and strengthen privacy law in New Zealand, which is very important and significant. Ultimately, this is a Labour bill; therefore, of course we support it.

Members have heard about the two flaws that this bill essentially attempts to correct. The first concerns the increasing flow of people and information across borders and the privacy issues that surround that. The first amendment is in relation to the Privacy Act 1993 and introduces new provisions that deal with the cross-border transfer of personal data. To complement those changes, the bill includes new provisions that facilitate the cross-border enforcement of privacy laws. That means that the legislation will reduce the likelihood of New Zealand being used as an intermediary for the avoidance of other States’ privacy laws. The Privacy Act as it stands does not allow foreign nationals resident overseas to make information privacy requests, and, further, nothing in the Act prevents data received overseas from being transferred outside New Zealand to a jurisdiction that does not have adequate privacy protection. That means that New Zealand is unable to provide the assurance requested by our overseas trade partners that we can fully protect their privacy and their customers’ privacy. We have had that issue quite well canvassed.

As we have heard, the Law Commission is undertaking a review of privacy values, technology change, and international trends and their implication for New Zealand law. In February this year a report was issued titled Invasion of Privacy: Penalties and Remedies, which complements the bill that is before us today. The commission found that New Zealand’s privacy laws—in particular, those relating to surveillance—are patchy. I will talk a little about those laws and then provide the House with a case study that shows the importance of businesses keeping their information secure. The commission recommended in that report to enact legislation on surveillance devices in order to make New Zealand’s privacy laws more consistent and make it an offence to secretly film or track people. When speaking to the release of the report, Invasion of Privacy: Penalties and Remedies, Sir Geoffrey Palmer, the president of the Law Commission, said that our laws on that are currently very patchy. He said that technology is moving so fast and we need to ensure that our privacy is properly protected, which is a given. As he pointed out, it is an offence to record a private conversation and get unauthorised access to someone’s computer but it is not an offence to secretly film someone or use a device to track someone.

The Law Commission’s report recommended some law changes to fill those gaps. It recommended that it should be an offence to trespass on someone’s property to install a surveillance device, to film inside someone’s dwelling without that person’s consent, and to install or to use a tracking device to track someone without that person’s consent. As Sir Geoffrey said, the police need to get a warrant to do most of those things, and it seems bizarre that the law does not prohibit other people doing them here. He noted that several Australian states now have similar laws. That report is very interesting.

In terms of information and the issue of transferring data across borders and the importance of business keeping information secure—and my colleague in the Māori Party has mentioned issues around credit cards and identity theft, and those sorts of things—I refer to this particular case study of DoubleClick, a US online advertising company. In 2000 it found out the hard way what happens when a company gets its privacy practices wrong. DoubleClick decided it would match the personal information of people it had anonymously profiled online with identifying personal information collected offline by Abacus Data, an aggregator of mail-order buyer information that DoubleClick had bought. Not surprisingly, that caused a backlash among web users and people who had bought items through mail-order catalogues, which drew the attention of the US Federal Trade Commission. That led to lawsuits, and saw the dramatic drop in DoubleClick’s share price from US$135 a share to around the mid-thirty dollars within 6 months. A year later the company dropped plans to merge the data, settled all of its lawsuits, agreeing to pay $1.8 million in legal costs. It agreed to purge its databases and conduct an online privacy education campaign. When the company was sold in 2005 the share price was $8.50 a share. It had gone from $135 a share to $8.50 a share. There was no suggestion that the mishandling of privacy was the only reason for the dramatic fall in share price, but it was certainly a factor. I think that was the point that my colleague Charles Chauvel made—the importance of business being able to function effectively in this environment is very important.

In summary, the Justice and Electoral Committee’s main concern on this bill related to the OECD guidelines. Due to the way that the guidelines were incorporated into the bill, any changes by the OECD to the guidelines would have been automatically incorporated into legislation, which would result in changes to the statutory framework of the Privacy Act without examination by Parliament. So the committee recommended that the basic principles of national application be set out in a schedule and that the Governor-General be given the power to make regulations to amend that new schedule to reflect changes made to those guidelines. Those amendments to the new schedule will be subject to the Regulations (Disallowance) Act 1989, so will be scrutinised by Parliament.

The committee also recommended that it be made explicit in the bill that when determining whether to prohibit a transfer of personal information, the Privacy Commissioner may use the investigative powers in the Privacy Act, just as the commissioner can when conducting an inquiry under the Act. That would allow the commissioner to hear information from any person that he or she considered necessary. The committee received and considered two submissions from interested groups and individuals and heard one, as well as received advice, from the Ministry of Justice. So for those reasons and on the recommendation of the Justice and Electoral Committee, again acknowledging the work done by my colleague the Hon Lianne Dalziel and the bill being brought into Parliament by Labour originally, Labour will be supporting this bill to the stage of the third reading debate.

KANWALJIT SINGH BAKSHI (National) Link to this

The Privacy (Cross-border Information) Amendment Bill is a step towards giving confidence to both national and international businesses that any personal information held in New Zealand will be protected. The bill amends the Privacy Act 1993. The intention of this bill is to prevent any information coming to New Zealand from being diverted unlawfully to any other part of the world. In today’s fast-moving world, where technology has made it possible for information to travel at phenomenal speed, this Government needs to assure businesses in New Zealand that any personal information between themselves and their international partners will be protected with the full force of the law.

The National Government recognised that in today’s competitive world we need tools and protection to guarantee to clients that their interests are protected when they are dealing with New Zealand businesses. These types of assurances can provide confidence to overseas clients dealing with New Zealand businesses. The amendments to the Privacy Act will increase competitive advantage for our trade between New Zealand and the European Union, in particular, and other trade partners.

The Privacy Commissioner and the Law Commission agreed to these amendments. The bill authorises the Privacy Commissioner to prohibit the transfer of personal information outside New Zealand where the information is being routed through New Zealand to avoid the privacy law of originating countries. Clauses in the bill authorise the Privacy Commissioner to prohibit the transfer of personal information from New Zealand to another State if the commissioner is satisfied on reasonable grounds that the information will not be subject to comparable safeguards to the Privacy Act, or and would circumvent the law of the State where the information originated. This bill seeks to enhance New Zealand’s opportunity as a trading nation.

It is good to be part of this National Government, which has recognised the need for this bill, which seeks to prevent the malicious acquisition of private information and the use of that information against those who would be identified. This bill ensures that New Zealand’s privacy law meets the expectations of our trading partners by assuring that their privacy will be protected. It will also enable people overseas who are not citizens of New Zealand to access their personal information, which was previously not possible. It is my pleasure to endorse this bill, which enhances the opportunities for New Zealand businesses.

CAROL BEAUMONT (Labour) Link to this

It is a pleasure to speak in favour of the Privacy (Cross-border Information) Amendment Bill in its second reading. This bill is obviously an amendment to the Privacy Act. It is primarily about the cross-border transfer of data and is aimed at preventing New Zealand from being used as an intermediary for the circumvention of other country’s privacy laws.

This bill was introduced by the Hon Lianne Dalziel in 2008. She has had a long interest in the issue of privacy rights. I looked at a previous speech from her in which she talked about the right to privacy as a basic human right. She was part of the Justice and Electoral Committee that, in 1993, dealt with the original Privacy Act. As well as introducing the bill, the previous Labour Government also launched the Law Commission’s review of privacy, which was part of updating privacy law in New Zealand in an effort to strengthen it.

It is important to note that the House is in urgency today. Although this is a good bill and it is one that we support, it hardly seems to be at the top of the list of important things that we need to be doing for New Zealanders at the moment. It is a little bit like the Motor Vehicle Sales Amendment Bill we were discussing this morning—good solid changes, ones we need to make, but hardly urgent. What is more urgent is looking after the interests of New Zealanders who are struggling at the moment, who are struggling to make ends meet, and who are facing ever-increasing costs, including those imposed by this Government through things like increases to GST.

That the first reading of this bill was in April last year is evidence that it is not really urgent. It has taken all of that time since then to come back here. The first reading was on 1 April 2009. It was referred to the Justice and Electoral Committee, and submissions were due on 14 May 2009. The select committee reported back on 30 September 2009, and here we are, nearly a year later, having the second reading. That does not show that this is a particularly urgent legislative change. While I am talking about the Justice and Electoral Committee, I noted with interest that there were only two submissions on this bill. I assume that that means it is relatively non-controversial. I thought that was quite interesting.

I absolutely accept that this bill is important in the current economic environment, and for a country like New Zealand, which is so internationally connected and so reliant on international trade, exporting, and dealing with many other countries. Under the Labour Government New Zealand was at the forefront of building trade relationships and developing trade agreements, so it is important that we deal with an issue that is of concern to business partners overseas. Dealing with it will help us with our international competitiveness. This bill contributes to that aim by ensuring that international business partners can be assured that their customers’ personal information will be protected.

My colleague Charles Chauvel talked about this legislation being seen as pro-business. But other legislation that is seen as pro-business by this Government is, in fact, very short-sighted and ill-founded in many cases. The examples I will give are the changes in employment legislation, changes like those I referred to earlier today in relation to access to worksites. Those changes may be seen by an ideological few as pro-business, but they are unnecessary and potentially hamper the good organisation of workers so that they can get decent wages, have a strong voice at work, and be part of ensuring that their workplaces are more productive. I consider them to be very anti-business.

The Privacy (Cross-border Information) Amendment Bill essentially deals with the cross-border transfer of personal data. It also includes the ability to enforce cross-border provisions in privacy law. That is important so that we are able to take action where there is potential for a breach. It is intended to stop New Zealand being used as an intermediary for the avoidance of other States’ privacy laws by removing current restrictions on who can request private information, enabling public sector agencies to charge for making personal information available to overseas foreign nationals, providing for the referral of cross-border complaints to the appropriate privacy enforcement authority, and establishing a mechanism for controlling the transfer of information outside of New Zealand where the information has been routed through New Zealand to circumvent the privacy laws of the country from where the information originated.

The issue of privacy is an important one and the voting will show that. We all recognise that privacy is important. Over time the ability for us to have our privacy undermined has grown as the ability to store and transfer data, and also the surveillance of individuals, has increased. This is the sort of legislation that requires constant consideration. It is a bit like the consumer legislation debated earlier this morning—the Motor Vehicle Sales Amendment Bill. Things change very quickly, so it is timely that we look at this. It would be interesting for people to consider that even in 5 years the flow of information round the world has sped up, and the magnitude of those information flows has increased. Privacy is important, and this legislation both considers whether our legislation is robust enough—and, clearly, we have come to the decision that it is not—and future-proofs our Privacy Act to ensure that we take account of changed circumstances globally. These are the reasons why Labour members are supporting this legislation.

In an era of increasing globalisation and e-commerce our current inability to give privacy assurances to our trading partners is a potential impediment to trade. One of the particular matters that this bill deals with and that the select committee considered is the European Union’s particularly stringent requirements in relation to this area, and the bill takes that matter into account in its provisions. Getting privacy law right is important for both individuals and for businesses. Businesses have to be able to ensure that the benefits obtained by the use of new technology do not compromise individuals’ expectations for security in the use of personal information.

As I mentioned earlier, this bill complements the Law Commission’s review of privacy laws, and I have to say that there is more work to be done on that. To reinforce the point I made earlier, this is yet another bill that arises from work done by the previous Labour Government. There have been many such bills this week and it will be interesting to see what the Government will do in terms of substantive and positive, forward-looking legislation of its own. The main provisions of the bill provide the Privacy Commissioner with the discretion to prohibit the transfer of personal information from New Zealand to another State if the commissioner is satisfied that that will breach OECD guidelines, for example, governing the protection of privacy, or may circumvent privacy or data protection laws of the State from which it has been, or will be, received. So the Privacy Commissioner gets some new powers in this bill. The commissioner may not prohibit the transfer of information, however, where the transfer is required or authorised by any enactment, convention, or other instrument imposing international obligations on New Zealand. There is a limit to the ability of the commissioner to prohibit transfer in that particular situation.

Currently, our Privacy Act provides that an individual must be a citizen or permanent resident of New Zealand to make a request under the Privacy Act—that is, a request to obtain confirmation of whether an agency holds personal information, to be given access to personal information, or to correct that personal information. That changes under this bill, which is very important. It removes that residence restriction to enable foreign nationals to access that information.

TODD McCLAY (National—Rotorua) Link to this

Thank you very much, Mr Deputy Speaker—