This Privacy Week, acting privacy commissioner Liz MacPherson wants people to think about who holds their information – and for agencies to honour the trust placed in them.
Privacy isn’t about keeping all your information a secret. It’s about choosing who to trust with your personal information, what they can do with it and who they can share it with. The Covid-19 pandemic has transformed every part of our lives over the past two years, including our attitudes towards privacy and our own personal information. When we talk about personal information, we mean information that goes to the core of who you are – your name, your address, your birthday, your health information – your identity. Personal information confers power. Trusting that this information will be kept private by the agencies you share it with is a cornerstone of our high-trust society, and something we want to protect.
Over the course of the pandemic, New Zealanders have shown that by and large we are prepared to sacrifice some of our individual privacy to assist the health and safety of the wider community. People were asked to provide information about themselves that they might not have been comfortable disclosing prior to the pandemic, including everything from locations given to contact tracers, to showing their vaccination status to strangers.
We also know that Covid-19 hugely impacted our online spending habits. Whether it was during lockdowns, or just because people were choosing to shop online instead of going out in public, we saw a massive increase in online purchasing. One would have to assume that a number of New Zealanders were doing it for the first time, and that some people felt that they had to shop online. In lockdown you either got your essential goods and services, or you didn’t.
Perhaps this is why, in the latest report issued by the Office of the Privacy Commissioner, people might appear to be less concerned about their own privacy than they were two years ago. But dig deeper and you’ll find that we’re still interested in what’s happening with our personal information and how much control we have over its use. Six out of 10 New Zealanders are worried about businesses sharing their personal information without permission, and the same number are worried about the overall security of their personal information on the internet.
You may have encountered this yourself when signing up for an app or service and being asked for a lot more information than the company should strictly need. And when your Spidey sense is tingling, the first thing to do is to stop. Shop around. Free apps are not always free – you may be paying for a product with your personal information, which may in turn be on-sold to third parties. Challenge the business or the agency directly around whether they actually need the information they are asking for.
If you are met with resistance from a business, or you don’t feel as if you can take control of the situation yourself, that is when you can come to the Office of the Privacy Commissioner. We have dealt with cases where prospective tenants were being asked by property managers for far more information that was actually necessary to apply for a property, including questions about their health and sexual orientation. Because they didn’t want to miss out on a house, the individuals concerned felt like they had to provide that information. That’s a real imbalance of power, and one where we stepped in to create systemic change by creating new guidance and clarity for landlords and property managers.
One of the most powerful privacy rights New Zealanders have is the right to access the information organisations and businesses hold about them. It was concerning to find that only half of the people we surveyed knew that they have this right. The accuracy of the information is crucial, because so often it forms the basis of important decisions being made by businesses or government agencies which can affect your life and well-being. Responding quickly to people’s requests for their own information is another way agencies can build trust with their customers and clients.
Another of our cases involved a man who was incorrectly associated with the debt of someone else for over two years. He didn’t know anything was wrong until he was unable to have his utilities connected to his property. After he gained access to the information held by the debt management company, he realised it was somebody else’s debt. Through our processes, he had this rectified and was provided a confidential settlement amount for the harm caused. If you are curious about the information agencies hold about you, our About Me tool makes it easy for you to ask them directly.
It is in the best interests of agencies and businesses to protect the taonga that is our personal information. Two out of three New Zealanders surveyed said they would consider changing a provider if they heard about poor privacy. Reading the privacy policies before you sign up to anything is important, but what is essential is that businesses make these statements understandable. If it is going to take someone an hour to read a statement full of legal jargon, it is likely that they will just agree without fully understanding what is going to happen to their information.
People tend to think about privacy breaches in terms of leaks or hacks, any instance of their information leaving an organisation and entering the public arena. But it is important to remember that privacy breaches can also occur within organisations where people who shouldn’t have access to sensitive information – or who are trusted with it – access and share it inappropriately.
Our report also found that the leading reason for privacy breaches in Aotearoa remains human error, such as mistakenly attaching sensitive information to an email, or sending an email to the wrong person. We see this happening too often, and it raises another question – are companies putting in the right safeguards against these human errors?
Having access to the personal information of New Zealanders is a privilege, so agencies need to make sure that they’ve got the right systems and processes in place to keep that information safe. Whether dealing with private or public organisations, people need to trust that their personal information is going to be looked after. If we don’t have that trust, then people won’t feel safe to participate in society. Putting people in control of their information and being transparent ultimately builds a foundation of trust, and with trust comes the ability to innovate, to find solutions to complex issues, and to create a stronger and more resilient Aotearoa.