Compliance notices under the Privacy Bill Or Cave Canem

What happens now? The current powers of the Commissioner

The current powers of the Commissioner

Complaint investigations Own motion inquiries Recommendations Referral to the Director of Human Rights Proceedings Naming policy Statutory powers to demand information (offence to fail to provide without reasonable cause) Can take evidence on oath

What’s wrong with that?

Serious breaches that the agency is unwilling to address Systemic or repeat breaches where no progress made Have to use a middle person in the enforcement process – additional time and resources => Enforceable compliance notice

Privacy Commissioner 2.0

Sections 124 - 135 When the Commissioner can issue a compliance notice (124) What the Commissioner has to consider before issuing (125) Process for issuing (125) Form and service (126) What agency has to do after receiving (127) Variation or cancellation (128) Normal powers to obtain information (129) Enforcement of compliance notice if no action taken (130) Appeals against compliance notices or variation/cancellation decisions (131) Interim order suspending notice pending appeal (132) Remedies, costs and enforcement (133)

When will the Commissioner issue a notice? Question: Routine use? Or save compliance notices for special cases?

When will the Commissioner issue a notice? Discretionary – nothing to stop it being routine as long as process observed When there’s something to be fixed and agency isn’t voluntarily fixing it (or not acting fast enough) Where the agency’s actions are causing or may cause harm – particularly if that harm is serious

What type of breach can lead to notice?

What type of breach can lead to notice? Any breach of the Act Including breach of privacy principle/Code rule Breach of provisions of an approved information sharing agreement … … or an information matching agreement Wrongful failure to notify individual of data breach (or publicly notify) Breach of a public register privacy principle

Mandatory relevant considerations Another means under Privacy Act or another Act for handling it? Seriousness Likelihood of repeat Number of people affected Whether agency has been co-operative Likely costs to agency of complying To extent Commissioner considers factor relevant and information about that factor is readily available to Commissioner

Process Agency must have reasonable opportunity to comment – needs to be told In writing What breach is (with stat provision) summarise conclusions about factors Specify steps that Commissioner considers need to be made to remedy breach, inc conditions Dates by which agency must remedy

Form of final notice Similar to draft … requirements are set out in 126 Discretionary as to whether includes steps necessary to remedy, conditions, or dates Must tell agency of right of appeal

Options if you get a notice

Question: what happens if you think the Commissioner has got the facts or the law wrong?

Options if you get a notice Must take steps to comply asap Unless Apply to vary or cancel (persuade Commissioner that info needs to be amended, that you’ve complied, or that all/part is no longer needed) Appeal against all/part of notice or decision about variation/cancellation ------- substantive/procedural/factual/legal/challenge to discretion Appeal must be lodged within 15 working days of issue/receipt Apply for interim order suspending compliance notice pending appeal (Chairperson of Tribunal decides)

What not to do if you get a notice

Enforcement Commissioner can take enforcement proceedings in Tribunal If agency has ignored the notice, far less ability to object to enforcement ONLY ground is that agency believes the notice has been fully complied with Tribunal must not look at how notice was issued … … must not look at merits of the notice Remedies are discretionary, but chances are high that will order you to comply

Remedies Not an excuse that was unintentional or not negligent Or that has partially fixed the problem – unless no further reasonable steps to take Order to comply by date specified by Tribunal Order that agency perform any act specified in order by date specified in order (eg reporting to Commissioner on progress) Confirm, cancel, modify notice (or variation decision) Costs as Tribunal sees fit

Summary Forceful new powers – systemic or cavalier breaches Checks and balances on exercise of power to issue Still a strong role for voluntary action – voluntary compliance means there is no notice Also practical options if agency disagrees with Commissioner

Thanks! Now it’s time for afternoon tea … Katrine Evans, Hayman Lawyers k.evans@haymanlawyers.co.nz