The Justice and Electoral Committee has examined the Privacy (Cross-border Information) Amendment Bill and recommends that it be passed with the amendments shown.
The bill amends the Privacy Act 1993. The Act is silent on the cross-border enforcement of privacy laws. The bill remedies this by
•enabling foreign nationals located overseas to access and correct personal information
•authorising the Privacy Commissioner to refer a complaint to an overseas privacy enforcement agency, if that complaint is within the jurisdiction of that authority
•enabling the Privacy Commissioner to prohibit the transfer of personal information outside New Zealand in cases where that information has been routed through New Zealand to avoid the privacy laws of the originating country.
Clause 8 of the bill as introduced inserts new Part 11A into the principal Act to impose new controls on the transfer of personal information received from overseas, where the information has been routed through New Zealand to avoid the originating country’s privacy laws.
New section 114B would authorise the Privacy Commissioner to prohibit the transfer of personal information from New Zealand to another State if the Commissioner was satisfied on reasonable grounds of three things:
•the information would be received in New Zealand from another State and would be likely to be transferred to another State where the privacy protection is not comparable to that established by the Privacy Act
•the transfer would circumvent the laws of the State where the information originated
•the transfer would be likely to contravene the basic principles of national application set out in Part 2 of the OECD Guidelines.
We heard concern that the way the basic principles of national application in the OECD Guidelines have been incorporated in the bill might result in future changes in the Guidelines being incorporated into the statutory framework of the Privacy Act without examination by Parliament.
To address this we recommend inserting new Schedule 5A to set out the basic principles of national application. This would ensure that changes to the principles of national application in the OECD Guidelines would not be incorporated into the Privacy Act automatically. We recommend a consequential amendment to insert new clause 8A to allow the Governor-General to make regulations to amend new Schedule 5A. This would allow the principles set out in new Schedule 5A to be amended to reflect any changes made by the OECD. We note that amendments to new Schedule 5A would be subject to the Regulations (Disallowance) Act 1989.
To avoid unnecessary duplication, we recommend deleting new section 114B(1)(b), as the matters intended to be considered by the Commissioner within this subsection could be considered by the Commissioner under new section 114B(1)(a).
We recommend inserting new section 114BA to make it explicit that when determining whether to prohibit a transfer of personal information, the Privacy Commissioner could use the investigative powers in Part 9 of the principal Act, in the same way as if the Commissioner were conducting an inquiry under section 13(1)(m) of the Act. This would ensure that the Commissioner could hear or obtain information from any person he or she considered necessary.
The Privacy (Cross-border Information) Amendment Bill was referred to us on 1 April 2009. The closing date for submissions was 14 May 2009. We received and considered two submissions from interested groups and individuals. We heard one submission.
We received advice from the Ministry of Justice.
Chester Borrows (Chairperson)
Kanwaljit Singh Bakshi
Dr Kennedy Graham
Hon Nathan Guy (from 24 June 2009)
Hon David Parker
Dr Richard Worth (until 16 June 2009)