New Zealand's electronic trade with Europe could be threatened if the government fails to bring our privacy legislation up to the standard required by the European Union.
Privacy Commissioner Bruce Slane has recommended two amendments to the Privacy Act to bring it in line with the European Union's 1995 Directive on Data Protection, which came into force last year. The directive limits exportation of personal data to countries outside the EU which do not ensure an adequate level of protection. This has the potential to have a significant impact on businesses in this region handling personal information about EU residents.
"I am concerned that New Zealand may fail the 'adequacy test' because of a lack of action on these two points," says Slane. "Personal discussions with staff at the European Commission have reinforced my concern. These issues require urgent government action."
Slane says section 34 of the Privacy Act restricts the right to make information privacy requests to New Zealand citizens and permanent residents wherever they are and to people who are in New Zealand. This means a European who formerly lived and worked in New Zealand has no right of access to information held about him/her here unless he/she is in New Zealand when the the request is made. Slane has recommended that these requirements be abolished. Also, the Privacy Act does not protect information from being transferred from New Zealand to data havens — countries which do not have adequate privacy protection. Nor does it prevent the routing of personal data through New Zealand to another agency in a data haven. Slane has recommended that the act should be amended to include express provision for controlling trans-border data flows.
The recommendations are currently before the Minister of Justice, Tony Ryall.
According to Slane, if these changes were made New Zealand's data protection law would give it a competitive trade advantage over countries such as Australia and Canada, which have yet to enact privacy legislation, and the US, which is generally opposed to privacy legislation. The US has conflicted with the European approach because US big business has resisted any broad-based privacy laws being passed in that country.
"The US may yet negotiate a special position for itself. Small countries like New Zealand have no such prospect."
Last month the US government released a draft of guidelines seeking to bridge privacy differences between the US and the European Commission (which heads the EU) and the matter will be further discussed at a bilateral summit on June 21.