Blog

Introduction

Given that it’s Privacy Week 2021, I thought I’d jot down my thoughts on 40 common privacy potholes. I’ve described them as potholes because it’s not uncommon for agencies to think they’re doing the right thing or to be going about their business as usual, only to find themselves stumbling due to a pothole they didn’t see or were not aware of. It’s rare for agencies to deliberately do things that breach people’s privacy, but it’s not that uncommon for agencies to fall foul of the Privacy Act unwittingly. Sometimes that’s because they haven’t taken enough care, but other times it’s because they were not aware of a particular legal requirement, or had simply misunderstood what the law requires, or had relied on someone else who has made a mistake. [Read more…] about Privacy Week 2021 – StopLookGo Privacy’s top 40 common privacy potholes

Introduction

What’s happening

On 30 January 2021, Stuff ran an article called Landlords publishing ‘bad tenants’ lists online could be breaking the law. According to the article:

• landlords “are compiling lists of so-called ‘bad tenants’ on websites and social media”; and
• one of these websites “offers members access to a list of people who are deemed undesirable tenants”.

[Read more…] about Why ‘bad tenant’ websites can be problematic

Introduction

If you work frequently on issues under the Privacy Act, one of the topics you’ll have addressed over the years is the position where an agency (let’s call it the “Primary Agency”) uses another agency or organisation (let’s call it the “Processing Agency”) to store or process personal information for the Primary Agency. In this scenario, under section 3(4) of the Privacy Act 1993, the personal information is deemed to be held by the Primary Agency, and not the Processing Agency, as long as the Processing Agency doesn’t use or disclose the information for its own purposes.

[Read more…] about Does the Privacy Act 2020 narrow the scope of the ‘storage or processing’ holding provision?

Introduction

The Civil Defence National Emergencies (Information Sharing) Code 2013 (Civil Defence Code, a code of practice under the Privacy Act) is a powerful tool for agencies that need to collect, use or disclose personal information as part of responding to the COVID-19 epidemic (or any state of national emergency). In substance, when it applies, it modifies some of the standard information privacy principles relating to collection, use and disclosure of personal information. In other words, some of the Privacy Act’s usual controls on the collection, use and disclose of personal information yield to the exigencies of the emergency at hand.

[Read more…] about Is the Civil Defence National Emergencies (Information Sharing) Code 2013 clear enough?

Let’s look at subject-matter this time

In my last post, Which Government departments have the most information collection, use and sharing provisions?, I described which Government departments and non-Crown agencies feature the most in specific statutory provisions concerning (or that could cover) the collection, use or sharing of personal information.

[Read more…] about What would a subject-matter ranking of information collection, use and sharing provisions look like?

If you’ve read “Why we need to understand more than the Privacy Act“, you’ll know my view that we cannot fully understand how New Zealand law addresses the collection, use and sharing of personal information by understanding the Privacy Act alone. To obtain a full understanding, we often need to understand other laws and how they interact with the Privacy Act.

That’s all well and good, but just how many specific statutory provisions are there in our statute books that address or, given their breadth, could cover the collection, use and sharing of personal information?

[Read more…] about Which Government departments have the most information collection, use and sharing provisions?