spinofflive
Sam Neill discusses privacy law with a dinosaur in Jurassic Park, 1993. ©Universal
Sam Neill discusses privacy law with a dinosaur in Jurassic Park, 1993. ©Universal

PoliticsSeptember 6, 2018

NZ’s privacy law is covered in dust. We need a reboot for the internet age

Sam Neill discusses privacy law with a dinosaur in Jurassic Park, 1993. ©Universal
Sam Neill discusses privacy law with a dinosaur in Jurassic Park, 1993. ©Universal

Our privacy law is the operating system for how organisations handle our information, and it affects each of us every day, writes James Ting-Edwards of InternetNZ

New Zealand’s privacy law is finally, finally going to get an update. In a year that’s seen a range of big stories on big privacy threats, that’s good news.

There was Cambridge Analytica, who wanted to influence elections, so they built a quiz app that grabbed data from all your Facebook friends. There were local breaches too, through Z Energy’s fuel card website and Vector’s outage app. These are privacy breaches because they put personal information at risk, information like your name or street address which can be collected, accessed or passed on to others when it shouldn’t.

Our privacy law is meant to control how our information is used, and protect us against privacy breaches. It’s the operating system for how organisations get and use our information. And though we’re living in the Internet age, it hasn’t been properly updated since Jurassic Park first hit cinemas.

That’s right. New Zealand’s Privacy Act was written in 1993. Computers ran Windows 3.1, ‘e-mail’ had yet to lose its hyphen, and it was mainly for people working in universities. My mum had a job updating work databases by driving 3.5 inch floppy disks between offices.

The point being, we’ve seen a few changes since then. First, the widespread adoption of dial-up internet. Then, people buying and selling stuff online. And now, smartphones and social media becoming astonishingly ordinary parts of life.

Those changes have posed big challenges for privacy. Despite its age, our Privacy Act has actually stood up pretty well. It established flexible principles for protecting privacy and set up the Privacy Commissioner as a watchdog to hear complaints and keep an eye on things. That’s a good model for a law that adapts as technology changes. But a good operating system still needs updates. We need our parliament to take those updates seriously.

In 2018, protecting our privacy is vital for trust online. Using the internet often means sharing our information. Lots of us have lots of user accounts, including accounts we’ve forgotten about. Facebook. LinkedIn. Neopets. MySpace. The information we put online through these services is valuable, not only to inform and target ad campaigns but also for unauthorised and criminal uses.

Data breaches are a large and increasing threat to our privacy. The MySpace breach in 2014 included about 360 million emails, usernames, and passwords. By 2016, these were being sold on dark web markets as a resource for identity theft and other crimes. Ironic references aside, the rest of us have forgotten MySpace. But it lives on through the sale of breached accounts to target and inform criminal activity.

These privacy harms can have a long shelf-life. In July 2018, people around the world received blackmail emails, saying “I have hacked you, and have webcam footage of you in a compromising position”.  These emails cleverly included, as proof, a real password associated with the target email address. In many cases, a password from the 2012 LinkedIn breach from six years earlier.

Our Jurassic Park-era privacy law fails to provide even basic protections against these harms. An update is long overdue. The Privacy Commissioner first reviewed the law in 1998, the year The Truman Show came out. Then in 2011, the Law Commission reported on its review. That’s the year Thor was released. It’s now been seven years (or three Marvel Movie sequels) since that review. And its recommendations still haven’t been implemented.

After that long, long wait, we finally have a Privacy Bill being considered by Select Committee. For a bill written in 2013, it’s pretty good. It takes some of the obvious steps needed for better privacy protection. For example, it will require organisations to notify users and the Privacy Commissioner about data breaches. It will let the Commissioner issue “compliance notices” to tell organisations what they have to do in response to privacy problems.

At InternetNZ, we’ve joined the 165 other people and organisations submitting on the bill. All the submissions I’ve read support the bill as a path to better privacy protections that work for the next decade. People want better privacy, and organisations want to offer better privacy. Privacy is good for business.

Within that overall support, there are a few things we and others want improved. We think that the way New Zealand does breach notifications should be closer to the model in Australia, and under the European Union’s General Data Protection Regulation (GDPR). If organisations can align notification practices across countries, they’re more likely to do this well. We think the threshold for breach notifications should be a little bit higher to get this alignment (and to avoid flooding people with too many notifications they can’t act on).

We also want our government to think deeply about the GDPR. One reason is to see if the GDPR has good ideas, which we could adapt to suit our own framework. But the main reason is to keep our stamp of privacy approval. Right now, Europe treats New Zealand privacy law as “adequate”. That means we can export to the EU without every organisation doing its own privacy compliance. That’s a very big deal for New Zealand tech companies and exports via the internet. With a deadline of 2020 to review our privacy, we have to get our thinking caps on now.

The main thing we need is for our politicians to sit up and take notice. Privacy is a human right. Our privacy law is the operating system for how organisations handle our information, and it affects each of us every day.

We’re asking the Justice Select Committee to improve and pass the Privacy Bill. We’re asking them to consider and consult on new changes arising from submissions before reporting back to Parliament. And we’re asking for MPs to think about our privacy more often than Jurassic Park gets a reboot.

Keep going!
Winston Peters’ party continues to clip Jacinda Ardern’s wings in what is now becoming a trend. Photo by Mark Tantrum/Getty Images
Winston Peters’ party continues to clip Jacinda Ardern’s wings in what is now becoming a trend. Photo by Mark Tantrum/Getty Images

PoliticsSeptember 5, 2018

Not yet a crisis, but Ardern needs to regain momentum, clarity and cohesion

Winston Peters’ party continues to clip Jacinda Ardern’s wings in what is now becoming a trend. Photo by Mark Tantrum/Getty Images
Winston Peters’ party continues to clip Jacinda Ardern’s wings in what is now becoming a trend. Photo by Mark Tantrum/Getty Images

The prime minister faces a cluster of challenges from her coalition partner and from within her own party. As she heads for Nauru, Ardern needs to figure out what’s gone missing, writes Guyon Espiner of RNZ

Momentum, clarity and cohesion are essential check-in items for a happy travelling government but right now they are three items of lost luggage for the Labour-led government.

A crisis? No. Recoverable? Certainly. But Jacinda Ardern faces a cluster of challenges from her coalition partner and from within her own party.

New Zealand First continues to clip Labour’s wings in what is now becoming a trend.

First it was the Three Strikes Law. Justice Minister Andrew Little told everyone it would be repealed. Then, when it was about to go to Cabinet, and as the prime minister was preparing to go on maternity leave, Winston Peters pulled the plug.

Now it’s refugee numbers. Immigration Minister Iain Lees-Galloway told everyone the quota would increase from 1,000 to 1,500. In June media reported the minister was preparing a paper for Cabinet.

Then, from the Pacific Islands Forum in Nauru, where the major issue is refugee policy, and with the prime minister just about to join him there, Peters pulls the plug.

Labour will now be scrambling to get NZ First agreement to make good on its promise for an intake of 1,500 refugees. But given the strength of Peters’ stated opposition, that now looks doubtful. Or it will come at a price.

Media exploring the distance between the coalition partners on these issues are sometimes met with a loud riposte: They’re different parties! It’s MMP, stupid!

They have a point. But it’s a point Labour and NZ First must absorb themselves. Either Labour ministers are carelessly promoting plans which don’t have full government support or NZ First is reminding Labour where the real power lies.

NZ First MP Shane Jones seems to be relishing these moments. He attacks Air New Zealand, the prime minister bats back by appointing the Air New Zealand chief executive Christopher Luxon to head her new Business Advisory Council, established amid a collapse in business confidence. Then Jones bites back, dismissing Luxon as a celebrity appointment.

Volatility from NZ First is particularly unhelpful for Ardern right now because her own crew are creating turbulence too.

Clare Curran, formerly open government minister, makes the same mistake twice: Failing to properly declare meetings with high-profile players in media and communications. She is demoted from Cabinet but remains a minister.

Why does she lose open government and keep broadcasting, where the same offence was committed? With her future unresolved, Curran remains an opposition target.

Minister Meka Whaitiri is also in limbo, accused of “manhandling” her new press secretary. Rather than cutting her loose Ardern has set up an inquiry which could drag on for weeks. Meanwhile leaks dribble out about what actually happened.

Ardern won’t have to face questions in parliament on the issue for the rest of the week as she flies out to the Pacific Islands Forum. That too proved a distraction with media interest in the Royal New Zealand Air Force plane making a special return trip to pick her up, a cost estimated at $80,000.

Perhaps only a few partisans will begrudge Ardern making these arrangements to accommodate her new family but it does rather draw the sting from criticism of the opposition leader Simon Bridges for spending a similar sum on his regional tour.

Ardern’s flight out to the forum will be largely empty, with her and maybe a smattering of staff rattling around in that plane. It might be a good time to figure out what’s gone missing in the past few weeks.

Someone needs to find the lost luggage and the flight plan. The government needs to regain momentum, clarity and cohesion. It needs to look like it knows where it’s going and assure people that the moving parts are travelling in the same direction.

First published at RNZ 


The Bulletin is The Spinoff’s acclaimed, free daily curated digest of all the most important stories from around New Zealand delivered directly to your inbox each morning.

Sign up now


But wait there's more!