One Size Fits All Data Protection in New Zealand: Processes and Outcomes Gehan Gunasekara & Erin Dillon

Introduction “The blood running through the veins of twenty-first century commerce increasingly consists of information about individuals.” Collection and processing of personal data Data outsourcing Data mining / profiling / tracking Predictive behaviour mapping

Paper Overview New Zealand’s one size fits all Privacy Act 1993 Data protection history Dispute resolution process Statistical analysis: nature of defendants, remedies, areas litigated

International Context Early data protection measures (1970s) European approach: seamless regime: private and public sector covered US approach: public sector only- private sector piecemeal approach: E.g. video Privacy Protection Act 1988 OECD Guidelines (Trans-border) APEC Privacy Framework

International Developments The EU Directive (1995) Adequacy standard Prohibition of personal data exports

International Developments EU / US dispute Safe Harbor Principles compromise The New Zealand approach

Data Protection Principles Nature of data protection principles (IPPs) Open ended flexibility resists obsolescence The significance of process Interpretation The right to remedies

Research Focus Areas of litigation and outcomes “Real remedies in concrete instances affecting real people” Dedicated tribunal: Human Rights Review Tribunal Minor role for the courts Jurisprudence 1993 to 2006 Statistical analysis: public / private sector, IPPs litigated, remedies $, representation and outcomes

Data Protection in NZ Early law enforcement data processing

Data Protection in NZ Information Matching legislation 1991 National Privacy Commissioner Information matching risks Information matching safeguards

Data Protection in NZ Freedom of Information legislation (1982/ 1987) Information based Individual access to data held in public sector Role of Ombudsman

Privacy Act 1993 Public and Private sector “agencies” Areas excluded: personal affairs, legislature, judiciary, news media All “personal information” covered One stop shop: access to ALL personal information and remedies for misuse Reduction in compliance costs (multiple agencies/ different rules)

Privacy Act 1993 Flexibility: codes of practice (Commissioner) Examples: Health Information Privacy Code, Credit Reporting Privacy Code More / less stringent than IPPs

Privacy Act 1993 IPPs contain exceptions: law enforcement, legal proceedings, health and safety, statistical / research Access can be denied: e.g. privacy of another individual, evaluative material and promise of confidentiality Public registers subject to separate public register principles

Dispute Resolution Process Avoids courts Privacy Commissioner Inquisitorial and conciliatory role Powers Settlement is priority 1993 – 2006: 81 per cent of complaints settled Most settled before finding by PC 4 per cent of complaints ruled to have substance / privacy interference

Dispute Resolution Process PC has discretion to refer to Director of Human Rights Proceedings (DHRP) 47 referrals vs. 173 taken by complainant 42 % resulted in favourable ruling by Tribunal 11 substantive appeals to the courts Tribunal reversed in 3 1 appeal to the Court of Appeal

Litigation in New Zealand Social context: non- litigious culture Example: No-fault accident compensation maximum lump sum = $100,000 $40,000 highest privacy award to date Defamation / libel special case

Litigation in New Zealand Tribunal composition Role of chairperson Role of PC “Substantial merits” without regards to technicalities Evidentiary difficulties: link with interpretation

Litigation in New Zealand Proceedings can be brought if: Referral by PC and DHRP Plaintiff where PC / DHRP does not Need for prior investigation by PC Average < 10 Tribunal cases per year 140 cases : 81 substantive decisions included

The Defendants Statutory definition of private / public sector

The Defendants 62 per cent = public sector defendants 6 public sector organisations account for 43 % of total cases 41 per cent = private sector (some cases counted as both private and public as more than 1 defendant)

The Defendants Of private sector 39 per cent = health sector 25 % of total cases = non-health private sector (commercial and not-for-profit orgs) These orgs include: banks, insurance companies, individuals, funeral directors and clubs

Areas Litigated IPPs and Code Rules Multiple IPPs per case Overseas comparison

Remedies NB: More than one remedy common

Remedies Remedies awarded to successful plaintiffs (42% of all claims): Damages (21 cases) Costs (7 cases) Range $200 - $40,000 Range $ $1,338 Mean $7, Mean $ Median $4,000 Median $500 Unsuccessful Plaintiff Pay Costs of Defendant (10 cases) Range $500 - $12,500 Mean $4, Median $2,750

Representation Non-legal representation allowed Risks of non-legal representation Representation did not affect success

Representation Comparison of Remedies for Plaintiffs With and Without Representation Damages: With (7) Without (14) Range $200 - $40,000 $500 -$20,000 Mean $12, $3, Median $10,000 $3,000 Costs: With (2) Without (5) Range $500- $1,338 $ $1, Mean $919 $ Median $919 $500

Representation Comparison of Outcomes for Plaintiffs With and Without Representation Unsuccessful Plaintiff Pays Costs of Defendant: With (4) Without (6) Range $1, $12,500 $500 - $10,000 Mean $5, $3, Median $3,000 $2,750

Significant Cases Most non-technical and pragmatic Early cases re: scope of Act and exclusions Influence of legal principle Evidentiary difficulties

Significant Cases High Court appeals Limitations Hamilton vs. The Deanery 2000 Ltd Proceedings Commissioner vs. Harder

Conclusions Advantages of NZ approach Conciliation vs. Litigation Litigation rare: success rate low Most suits against public sector Low rate of representation, and representation non-legal Areas most litigated: Denial of access to and improper disclosure of personal information

Tribunal and Court’s Contribution Interpretation Unduly legalistic? Modest damage awards Day in court