Privacy Commissioner urges the Government to tighten up privacy laws including bringing in a civil penalty regime

The Government is being urged to beef up privacy legislation by the man whose job it is to enforce it.

Michael Webster says the problem is so serious that some people are not signing up for goods and services because they fear their personal information might be stolen.

Webster is New Zealand's Privacy Commissioner and was speaking to initiate a series of webinars as part of Privacy Week. They mark 30 years since the Privacy Act was implemented.

“With the pace of technology and change there’s already a need to strengthen our legislation,” Webster told his audience in a message on YouTube.

“It is my view that legislative changes are needed to ensure New Zealand’s privacy law is fit-for-purpose in the digital age.”

He said he would like to see New Zealand as a country where people were confident that their privacy would be protected. But this was not the case.

“My office’s research shows that three out of five New Zealanders are concerned about businesses sharing their personal information without their permission,” he said.

“A recent study by Internet NZ showed that one of our top concerns online is threats to privacy. And in the past 12 months, two thirds of New Zealanders have chosen not to use at least one online service because of security or privacy concerns.”

Webster went on to say there was a 41% increase in privacy breaches between the 2021/22 and 2022/23 years. And more than half of all New Zealanders would avoid doing something on the internet for fear of their activity being tracked.

And he said other countries are acting to strengthen their privacy law, and New Zealand should do the same.

“You might be surprised to learn that the New Zealand Privacy Act does not contain a civil penalty regime, ”Webster said.

"We are an outlier in not having civil penalties....such penalties could apply to negligence as well as to deliberate breaches.

“The low-level criminal offences in the Act only target specific non-compliance such as an agency failing to report a serious privacy breach, rather than penalising a serious breach that has inconvenienced thousands of Kiwis and in some cases caused them serious harm.”

He said Australia had boosted its privacy laws after large scale hacking of the companies Optus and Medibank. But New Zealand was experiencing the same thing, with the breach of cyber security at the finance company Latitude.

“Having the full range of effective tools in the regulatory toolbox is increasingly essential for privacy regulators, including ones that can be used for the most serious privacy breaches,” he said.

“My privacy, your privacy, has been, and will continue to be, under threat and we need to continually evolve our legal protections to stay ahead of the curve.