Rob Stock, Panic over planned beef-up of privacy laws, The Press/Te Matatika, 3 August 2024
ANALYSIS: Insurers, banks, charities, museums, archives, galleries, libraries, small companies, credit reporting bureaus, and data brokers who “rent” out peoples data should all be exempted from new privacy laws, MPs have been told.
The justice select committee is hearing submissions on the Privacy Amendment Act, which would require companies and other organisations to notify people when they indirectly acquire their data from another party.
The idea of the law is to reveal to improve transparency so individuals know who was using their data, and for what purpose, lifting the veil on the trade in their personal data.
But so many organisations were asking for exemptions that National MP James Meager said on Thursday if the committee accepted all the pleas it would “be close to exempting every kind of organisation in the country”.
At its first reading in May, MPs from every party spoke in favour of the bill.
But at select committee hearings multiple commercial interests said it would be costly, undermine normal commerce, and result in people being subjected to a bewildering number of text and email notifications from organisations acquiring their data.
So who wants out of the Privacy Amendment Bill, and why?
Your favourite museum
Glam sector organisations (galleries, libraries, archives and museums) as well as historians say the planned law would be an existential threat to them.
Adelle Fitzpatrick, from Museums Aotearoa, the industry association for museums, said: “This means that any references to, or images of, a living person would require a museum, gallery, library or archive to seek that person’s permission to collect and display their name, and or image.”
There is an exception in the bill that would allow organisations not to notify people, if it was “not reasonably practical”, but David Reeves, chief executive of Auckland War Memorial Museum Tāmaki Paenga Hira, told MPs that was not enough as it would leave Glam institutions guessing as to what they needed to so.
Reeves and Historian Anna Green, president of the Oral History Association Te Kete Kōrero-a-Waha o Te Motu, both sought specific exemptions to be included in the bill for their sectors to enable them to continue doing what they do for the public good.
Reeves said in 2010, the Auckland War Memorial Museum was gifted the Sir Edmund Hilary archive of over 100 boxes of documents, some 30 linear metres of stacked documents, and 30,000 photographs, containing many references and images of living people.
Would it have accepted that archive, if it meant going through it to identify every living person, and notifying them that it included personal data, he asked.
“It’s a job that feels insurmountable, perhaps, if you will forgive the joke, like Everest itself,” he said.
Life and general insure
The insurance industry has successfully got exemptions put into acts, such as the Fair Trading Act exemption allowing it to include unfair contract terms in its policies.
It would like an industry exemption for this act too.
When collecting information to check that people making claims are not lying, insurers use information from databases like Motor Vehicle Register, repairers and suppliers, government agencies such as the New Zealand Police, and other insurers.
They can do this because a condition of getting insurance is agreeing to insurers being able to do this.
In addition, the Insurance Council (ICNZ) told MPs, having to tell people when they collect information on them would hinder the work of the private investigators they hire to investigate some of their customers.
ICNZ said an example “might be where a fraud investigator collects information from a policyholder’s neighbour”.
It warned about the costs of it, saying the law had to be pragmatic, and any law change must be given careful consideration to ensure that the privacy benefits it provides are not outweighed by compliance costs and notification fatigue
The council also said part of the original justification for the law was to ensure New Zealand retained its EU adequacy status for trade purposes, but the EU had now accepted that even without the proposed change, the EU had determined New Zealand had an adequate level of protection for personal data transferred from the European Union.
Life insurer AIA worried that when it collected data off people applying for policies, it would inevitably lead to them collecting information about applicants’ family members, who would have to be contacted.