1. One Size Fits All Data Protection in New Zealand: Processes and Outcomes Gehan Gunasekara & Erin Dillon

2. Introduction “The blood running through the veins of twenty-first century commerce increasingly consists of information about individuals.” Collection and processing of personal data Data outsourcing Data mining / profiling / tracking Predictive behaviour mapping

3. Paper Overview New Zealand’s one size fits all Privacy Act 1993 Data protection history Dispute resolution process Statistical analysis: nature of defendants, remedies, areas litigated

4. International Context Early data protection measures (1970s) European approach: seamless regime: private and public sector covered US approach: public sector only- private sector piecemeal approach: E.g. video Privacy Protection Act 1988 OECD Guidelines (Trans-border) APEC Privacy Framework

5. International Developments The EU Directive (1995) Adequacy standard Prohibition of personal data exports

6. International Developments EU / US dispute Safe Harbor Principles compromise The New Zealand approach

7. Data Protection Principles Nature of data protection principles (IPPs) Open ended flexibility resists obsolescence The significance of process Interpretation The right to remedies

8. Research Focus Areas of litigation and outcomes “Real remedies in concrete instances affecting real people” Dedicated tribunal: Human Rights Review Tribunal Minor role for the courts Jurisprudence 1993 to 2006 Statistical analysis: public / private sector, IPPs litigated, remedies $, representation and outcomes

9. Data Protection in NZ Early law enforcement data processing

10. Data Protection in NZ Information Matching legislation 1991 National Privacy Commissioner Information matching risks Information matching safeguards

11. Data Protection in NZ Freedom of Information legislation (1982/ 1987) Information based Individual access to data held in public sector Role of Ombudsman

12. Privacy Act 1993 Public and Private sector “agencies” Areas excluded: personal affairs, legislature, judiciary, news media All “personal information” covered One stop shop: access to ALL personal information and remedies for misuse Reduction in compliance costs (multiple agencies/ different rules)

13. Privacy Act 1993 Flexibility: codes of practice (Commissioner) Examples: Health Information Privacy Code, Credit Reporting Privacy Code More / less stringent than IPPs

14. Privacy Act 1993 IPPs contain exceptions: law enforcement, legal proceedings, health and safety, statistical / research Access can be denied: e.g. privacy of another individual, evaluative material and promise of confidentiality Public registers subject to separate public register principles

15. Dispute Resolution Process Avoids courts Privacy Commissioner Inquisitorial and conciliatory role Powers Settlement is priority 1993 – 2006: 81 per cent of complaints settled Most settled before finding by PC 4 per cent of complaints ruled to have substance / privacy interference

16. Dispute Resolution Process PC has discretion to refer to Director of Human Rights Proceedings (DHRP) 47 referrals vs. 173 taken by complainant 42 % resulted in favourable ruling by Tribunal 11 substantive appeals to the courts Tribunal reversed in 3 1 appeal to the Court of Appeal

17. Litigation in New Zealand Social context: non- litigious culture Example: No-fault accident compensation maximum lump sum = $100,000 $40,000 highest privacy award to date Defamation / libel special case

18. Litigation in New Zealand Tribunal composition Role of chairperson Role of PC “Substantial merits” without regards to technicalities Evidentiary difficulties: link with interpretation

19. Litigation in New Zealand Proceedings can be brought if: Referral by PC and DHRP Plaintiff where PC / DHRP does not Need for prior investigation by PC Average < 10 Tribunal cases per year 140 cases : 81 substantive decisions included

20. The Defendants Statutory definition of private / public sector

21. The Defendants 62 per cent = public sector defendants 6 public sector organisations account for 43 % of total cases 41 per cent = private sector (some cases counted as both private and public as more than 1 defendant)

22. The Defendants Of private sector 39 per cent = health sector 25 % of total cases = non-health private sector (commercial and not-for-profit orgs) These orgs include: banks, insurance companies, individuals, funeral directors and clubs

23. Areas Litigated IPPs and Code Rules Multiple IPPs per case Overseas comparison

24. Remedies NB: More than one remedy common

25. Remedies Remedies awarded to successful plaintiffs (42% of all claims): Damages (21 cases) Costs (7 cases) Range $200 - $40,000 Range $121.33 - $1,338 Mean $7,449.80 Mean $711.28 Median $4,000 Median $500 Unsuccessful Plaintiff Pay Costs of Defendant (10 cases) Range $500 - $12,500 Mean $4,401.99 Median $2,750

26. Representation Non-legal representation allowed Risks of non-legal representation Representation did not affect success

27. Representation Comparison of Remedies for Plaintiffs With and Without Representation Damages: With (7) Without (14) Range $200 - $40,000 $500 -$20,000 Mean $12,885.71 $3,303.27 Median $10,000 $3,000 Costs: With (2) Without (5) Range $500- $1,338 $121.33 - $1,269.64 Mean $919 $628.20 Median $919 $500

28. Representation Comparison of Outcomes for Plaintiffs With and Without Representation Unsuccessful Plaintiff Pays Costs of Defendant: With (4) Without (6) Range $1,529.86- $12,500 $500 - $10,000 Mean $5,007.50 $3,998.30 Median $3,000 $2,750

29. Significant Cases Most non-technical and pragmatic Early cases re: scope of Act and exclusions Influence of legal principle Evidentiary difficulties

30. Significant Cases High Court appeals Limitations Hamilton vs. The Deanery 2000 Ltd Proceedings Commissioner vs. Harder

31. Conclusions Advantages of NZ approach Conciliation vs. Litigation Litigation rare: success rate low Most suits against public sector Low rate of representation, and representation non-legal Areas most litigated: Denial of access to and improper disclosure of personal information

32. Tribunal and Court’s Contribution Interpretation Unduly legalistic? Modest damage awards Day in court