New Zealand to get a Consumer Data Right
The Consumer Data Right (CDR) will be similar to the GDPR concept of data portability and is expected to allow consumers to require data holders securely share the consumer’s data with third parties.
The CDR will provide consumers with greater access to, and control over, their data and is intended, over time, to give access to a wider range of products and services and to facilitate competition among providers of such products and services in designated sectors.
The CDR will be introduced on a sector by sector basis, similar to the approach adopted in Australia in 2019. The Government expects to introduce CDR legislation in 2022.
Read our commentary and the Government announcement.
Privacy concerns around COVID scanning and physical sign in policy
An open letter led by Dr Andrew Chen, a research fellow at The Centre for Informed Futures in The University of Auckland, and signed by around 120 people, including Michael Baker, Siouxsie Wiles, Shaun Hendy and some heavy hitters from academia and the law, urges the Government to provide stronger legislative protections around contact tracing records.
The letter follows the Government’s 22 August announcement that record keeping would be mandatory and would remain in place for some high risk venues at all alert levels. Dr Chen had expected that the Public Health Order would include clear privacy protections but the only protection it offers is that the records will be deleted after 60 days.
Concerns include that the lack of privacy protections could allow police and government agencies to misuse the information for investigatory or enforcement purposes, private sector agencies to use it for marketing, employers to use it for purposes outside of health and safety, or individuals to use it “coercively” against other individuals.
Minister Hipkins has given an “absolute reassurance” that the data will not be misused and is so far resisting the need for further regulation. And the Office of the Privacy Commissioner (OPC) has issued guidance reminding organisations of their obligations under the Privacy Act to ensure that any personal information is held securely and cannot be accessed by people who do not need to see it.
To learn more, see the letter and OPC guidance.
Closer privacy relationship with the UK
The OPC has entered a Memorandum of Understanding (MOU) with the UK Information Commissioner’s Office which commits both parties to promote exchanges to assist each other in the enforcement of privacy laws.
There is also every reason to expect that the relationship may be deepened beyond the MOU with the announcement late last month that John Edwards is the preferred candidate for the role of UK Information Commissioner. The appointment process requires a number of steps by the UK Parliament so may take several weeks.
Read the MOU and OPC statement.
UK retains EU adequacy status
The EU has awarded the UK adequacy status under the General Data Protection Regulation (GDPR) and the Law Enforcement Directive on the basis that the UK data protection system continues to be based on the rules which applied before Brexit.
However the EU has put in place a four year “sunset clause” to protect against the possibility that the UK may diverge in future from the EU framework.
Read the EU Commission statement.
Google agrees to play nicely in the sandbox
The online advertising industry is concerned that Google’s plans to remove third party cookies from its Chrome browser will compromise their ability to collect information for personalising ads and would make them ever more reliant on Google’s user databases.
The UK Competition and Markets Authority (CMA) has been engaging with Google on the matter and Google gave the CMA an undertaking that whatever it develops in its Privacy Sandbox project to effect its decision to remove third party cookies from its Chrome browser will not provide it with an unfair advantage.
However the CMA’s investigation concluded that, while the alternative tracking technologies Google was developing through Sandbox would better protect users’ privacy, they would also allow Google to exploit its dominant market position.
There is some scepticism in the industry as to how much these commitments will affect Google’s conduct in practice. The CMA is now consulting on the commitments.
Read the article.
UK Children’s Code fully in force
The Children’s Code developed by the UK Information Commissioner’s Office came into full force on 2 September after a year in transition. It ensures that online services likely to be accessed by children respect a child’s rights and freedoms when using their personal data.
The Code has already been influential with members of the US Senate and Congress calling on US tech and gaming companies to adhere to it on a voluntary basis.
See the ICO statement.
New data protection regime in China
China’s Data Protection Law came into force on 1 September 2021 and will be reinforced by a companion piece of legislation – the Personal Information Protection Law (PIPL) – which was enacted on 21 August and will come into effect on 1 November 2021.
Both are planks in the Chinese Government’s “informisation policy” which President Xi Jinping has characterised as the modern equivalent of industrialisation.
The PIPL is modelled on the GPDR, although with a stronger cybersecurity focus, and aims to regulate personal information processing activities, safeguard the orderly flow of data, and facilitate the reasonable use of private information.
As the regulations and even some infrastructure to support the new regime are still being developed, it is difficult to assess what the impacts will be for businesses dealing with China. But PIPL will require data handlers outside of China that process the personal information of Chinese citizens to establish a dedicated entity or to appoint a representative within China to be responsible for matters relating to their processing operations.
To learn more, read the article.
DHB wins against RNZ
The Wellington High Court has granted injunctions sought by the Waikato District Health Board (DHB) against Radio New Zealand (RNZ) and “unknown defendants”, finding that there are “serious questions to be decided” in relation to RNZ’s decision to publish illegally obtained information about a child patient of the DHB.
The child’s identity was not revealed but the Court found that it could be easily deduced by persons familiar with the family.
The information at issue was part of the stolen dataset which was posted on the dark web by the hackers responsible for the 18 May cyberattack, and which they supplied to media outlets in an attempt to provide more leverage to their extortion of the DHB.
The Court rejected RNZ’s defence of public interest, saying:
In terms of where the overall justice of the matter lies, there are strong arguments to the effect that it is not in the public interest that the confidentiality of the private, personal and sensitive information in the stolen dataset be breached.
"Equally, there are public policy arguments against permitting unknown defendants to attempt to profit in a way which assists extortionists to inflict maximum pressure on their victim to comply with their ransom demands and/or to intimidate other potential victims by demonstrating to them the willingness of media organisations in particular to utilise stolen confidential data for their own ends."
The Privacy Commissioner has stated that he will consider applying for leave to intervene in support of the DHB in any substantive hearing. He is also considering referring RNZ to the Broadcasting Standards Authority and/or the New Zealand Media Council.
See the decision, the Privacy Commissioner’s statement and our commentary.
Government accuses China of malicious cyber activity in New Zealand
New Zealand has joined with the other Five Eyes nations, NATO, Japan and the EU in strongly condemning malicious cyber activity undertaken here and globally by the Chinese Ministry of State Security through Advanced Persistent Threat 40 (APT40).
The Minister Responsible for the Government Communications Security Bureau (GCSB), Andrew Little, said the GCSB had established the link through “a robust technical attribution process” and that it had separately confirmed that APT40 was responsible for the exploitation of Microsoft Exchange vulnerabilities in New Zealand this year.
GCSB considers that around 30% of serious cyberattacks against New Zealand organisations are State-sponsored.
See the statement.
Uber found to have interfered with privacy in Australia
The Office of the Australian Information Commissioner (OAIC) has determined that Uber interfered with the privacy of an estimated 1.2 million Australians (Uber customers and drivers) by failing to appropriately protect their personal data following a cyber-attack on US-based Uber Technologies Inc. and Dutch-based Uber B.V. at the end of 2016.
Rather than disclosing the breach to the OAIC, Uber paid the ransom demanded by the attackers, and waited almost a year before conducting a full assessment of the personal details that may have been accessed.
Uber was found to be in breach of the Privacy Act 1988 by “not taking reasonable steps to protect Australians’ personal information from unauthorised access and to destroy or de-identify the data as required”.
The OAIC has ordered Uber to:
- prepare, implement and maintain a data retention and destruction policy, information security program, and incident response plan
- submit these policies and their implementation to review by an independent expert, with the findings referred to the OAIC, and
- make any necessary changes emerging from this process.
See the OAIC's statement.
RBNZ cops first compliance notice under new Privacy Act
The Reserve Bank was issued with a compliance notice from the OPC on 15 September – the first use of this new tool created by the Privacy Act 2020.
The cyberattack experienced by the Bank in December 2020 and reported to the OPC on 9 January, identified a number of weaknesses in the Bank’s systems and processes for protecting personal information.
The compliance notice specifies the steps the Bank must take in order to address those weaknesses and to comply with privacy principle 5, relating to the storage and security of personal information.
The Bank commissioned a report from KPMG on the incident and the OPC’s findings of non-compliance with privacy principle 5 were consistent with that report. The Bank was already working on the issues identified in KPMG’s investigation at the time the compliance notice was issued.
View the compliance notice and RBNZ statement.
Ransomware attacks up sharply on last year
Ransomware attacks reported to the Government’s Computer Emergency Response Team (Cert NZ) were up 150% in the June quarter. Sharp rises were also recorded for suspicious network traffic (up 125%) and unauthorised access (up 37%).
However the number of incidents in all three categories was still relatively low at 30, nine and 174 respectively.
This compares to 618 for phishing and credential harvesting (by far the most common category of offence) and 390 for scams and fraud (the second most common), although both were slightly down on the March quarter numbers – contributing to an overall quarter-on-quarter fall of 6%.
There is a consensus among the experts that cybercrime is significantly under-reported but the trends evident in the data are consistent with anecdotal evidence and with the Australian experience (see item below).
Read the report.
NZ caught up in global ransomware attack
New Zealand was caught up in sophisticated cyberattack on Kaseya, a California-based global software supplier in July, which saw customers using Kaseya’s VSA remote management and monitoring system have their devices encrypted by REvil ransomware.
The attack has been described as “colossal” and forced one victim – a Swedish supermarket chain – to close most of its 800 stores. Kaseya’s software is used by around 40,000 organisations globally, which includes New Zealand based organisations.
Following the attack Kaseya released a tool that users could run to check their VSA server for signs of compromise. CertNZ sent out an advisory encouraging affected organisations to use this tool.
To find out more, see the Stuff article and CertNZ advisory.
