Digital Identity Services Trust Framework Bill

The Digital Identity Services Trust Framework Bill, now before Parliament for its second reading, aims to build consistency, confidence and efficiency in the provision of digital identity services.

It will do this through a mix of primary legislation, a set of Trust Framework (TF) rules, and regulations.

Specific measures include:

• an opt-in accreditation scheme that establishes minimum requirements digital identity service providers must meet to handle personal and organisational information and allows those providers to upgrade their systems to comply with TF rules at their own pace. This will likely attract government departments, existing identity service providers, and other private sector organisations that verify identities
• a TF Board to be responsible for undertaking education, publishing guidance and monitoring the effectiveness of the TF. The Board will also have the responsibility of recommending and consulting on draft TF rules, and
• the creation of a TF Authority that will decide applications for accreditation, maintain a register of accredited providers, conduct investigations (following complaints or on its own initiative), and grant remedies for breaches.

The Bill does not override any obligations under the Privacy Act.

Read the Bill as reported back.

Data and Statistics Bill

The Data and Statistics Bill seeks to modernise how data and official statistics are collected, held and published by the government and was reported back on 9 May.

The Bill was intended to be non-controversial but was criticised by the NZ Council for Civil Liberties for having insufficient regard to the principles of the Privacy Act and for giving too much discretion to the Government Statistician.

The OPC had been consulted during the policy development phases and had “an overall comfort” with the Bill’s design but put in a late submission recommending a number of additional safeguards.

The select committee adopted some of these recommendations but decided that others were not necessary. The result is a relatively small number of mainly technical amendments.

View the Bill.

Latest OPC privacy survey – level of public concern unclear

According to OPC’s latest Privacy Awareness and Engagement – a two yearly snapshot – the three privacy concerns most worrying New Zealanders are:

• businesses sharing their personal information without permission
• data being collected about children online without parental consent, and
• the security of information on the internet.

Each of these issues attracted a 60% “concerned” response. But overall, the results showed that the level of concern about individual privacy and protection has fallen back to the levels experienced in 2001 (about 50%), after surging through the 2010s.

OPC noted, though, that further investigation would be needed before a firm conclusion could be drawn as Internet NZ’s 2021 survey had found “the exact opposite”.

View the survey.

Australian privacy law review

The Australian Federal Government is reviewing the Australian Privacy Act 1988. Review areas include:

• whether the Act effectively protects personal information and provides a practical and proportionate framework for promoting good privacy practices
• whether individuals should have direct rights of action to enforce privacy obligations
• whether a statutory tort for serious invasions of privacy should be introduced into Australian law
• the effectiveness of existing enforcement powers and mechanisms, and
• the desirability and feasibility of an independent certification scheme to monitor and demonstrate compliance with Australian privacy laws.

Submissions on the first consultation round closed on 10 January 2022.

The 230 page submission from the Office of the Australian Information Commissioner (OIAC) supported the establishment of a positive duty on organisations to handle personal information fairly and reasonably, saying this would provide a new baseline for privacy practice that meets community expectations and would help to restore and grow trust.

But, to be effective, it would need to be backed by organisational accountability measures similar to those under the European Data Protection Regulation (GDPR), a greater ability to pursue significant privacy risks and systemic non-compliance, and a simplified civil penalty regime.

Chapman Tripp will monitor the progress of the Australian review and any resulting legislation from the perspective of likely relevance to New Zealand.

View the website announcement, and the OIAC submission.

Companion piece of legislation

A companion reform, being developed in tandem with the review but further advanced and expected to be passed this year, is the Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021. Among its provisions are:

• tighter obligations on social media and other online platforms to obtain informed consent
• a binding online privacy code of conduct to be jointly developed by OIAC and industry, which will provide specific protections for children, including a new requirement on social media platforms to take all reasonable steps to verify the age of their users and to obtain parental consent for users under 16, and
• sharply higher maximum penalties (just over AU$0.5m for an individual and up to $10m for a body corporate).

The Bill’s definition of “online platforms”, as now drafted, catches many insurers, banks, superannuation funds and other financial providers, causing concern in these industries about the likely implications for them.

To learn more, read the article.

Aviation Security takes on the Privacy Commissioner

Stuff has obtained under the Official Information Act what it describes as “a series of terse letters” between the Office of the Privacy Commissioner (OPC) and Aviation Security (Avsec) about a trial of new facial recognition software at Wellington Airport, begun in February this year and scheduled to run until the end of October.

OPC was concerned that the technology was “potentially intrusive and inaccurate” and that Avsec had “leapt to this solution without first undertaking a thorough examination of the alternatives”. It raised these concerns also with the Civil Aviation Authority.

However Avsec obtained independent legal advice that the tool did not contravene the Privacy Act. Avsec told Stuff that the image was stored only while the person was in the airport security queue, and was held on a highly secure server before being deleted.

To learn more, see the article.

Google scores knock-out win in iPhone users class action

The UK Supreme Court has delivered a third round knock-out to Google in a class action brought by Richard Lloyd on behalf of the around four million Apple iPhone users in England and Wales in late 2011-early 2012 when Google secretly tracked its users’ internet activity without consent and used the data for commercial purposes.

Google had already paid a civil penalty of US$22.5m in 2012 to settle charges brought by the US Federal Trade Commission and US$17m in 2013 to settle consumer-based actions in the US. And it had already gone two rounds against Lloyd in the UK – winning in the first court only to have that win overturned in the Court of Appeal.

The Supreme Court decision, which was unanimous, will be welcomed by other data controllers as it establishes that:

• damages for loss of control are not available for breach of the Data Protection Act 1988 (this has since been overtaken by the UK General Data Protection Regulation but the relevant provision is similar), and
• even had the claim been able to brought as a representative action (as in this case), it would still have been necessary to establish the harm to each individual consumer.

To find out more, see the Supreme Court judgment.

ACC appoints independent review on use of client information

The ACC Board and the Treasury have commissioned an independent review following the suspension of 14 staff for inappropriately accessing and using client information.

The Terms of Reference include making recommendations on:

• systems and policies in relation to access and use of client data among ACC staff
• oversight, monitoring and auditing to detect and deter inappropriate behaviours, and
• ongoing staff training.

The review will be conducted over a maximum period of six months, beginning from mid-November.

Read the statement.

Still too loose

The results of two recent global studies indicate that rising cyberattack risk and the need to protect against it are still only dimly understood.

Cybersecurity solutions firm Check Point Software found that the number of reported cyberattacks worldwide surged 40% in the year to 30 September, and 40% of respondents to the 2021 Thales Global Cloud Security Study said they had experienced a cloud-based data breach in the past 12 months.

However only 17% of the survey had encrypted more than half their cloud-stored data – creating easy opportunity for cyber hacks. And, even among those businesses that had encryption, 34% left control of the keys to service providers rather than retaining control themselves.

View the Check Point Software survey article, and the Thales survey article.

Teaching Council apologises unreservedly

The Teaching Council of Aotearoa New Zealand has apologised unreservedly to the “around 43” people affected by an inadvertent data breach involving a spreadsheet of information, some of it sensitive.

The breach, which occurred in December, was due to human error. The Council has since reviewed its processes to prevent a recurrence.

Read the Council's statement.

Speak to our experts

We hope you find our insights within this publication useful. Please get in touch with one of our experts if you would like to discuss any topic in more detail. We offer definitive advice on privacy and data protection regulations, their practical application, pitfalls and enforcement. 

Kelly McFadzien, Partner

Nick Letham, Partner

Tim Sherman, Partner