Privacy risks

How government is seen to treat personal information contributes significantly to government's reputation as fair, transparent and trustworthy. In New Zealand the protection of personal information is provided for by the Privacy Act 1993. The international context of that legislation is generally irrelevant to its domestic operation. However, that context becomes important when offshore ICT services are considered. It is not as simple as saying that any transfer or collection by offshore agencies is bad or inherently risky to the privacy of New Zealanders.

The Privacy Commissioner recommends privacy impact assessments as the best practice tool for examining and documenting privacy risks and mitigations and publishes a free downloadable Privacy Impact Assessment Handbook.

In fact, while privacy legislation dates back to at least the 1970s, the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data on which most modern laws are based, has its origins in concerns that differences in the treatment of personal information could lead to non-tariff trade barriers and impede the free flow of international trade. It is why the Organisation for Economic Co-operation and Development (OECD) and Asia Pacific Economic Cooperation (APEC) work on privacy is part of larger projects to encourage freer trade and electronic commerce internationally. That economic driver adds weight to New Zealand's responsibilities towards personal information as a signatory to the Universal Declaration of Human Rights.

For example, while the Privacy Commissioner has expressed concern about personal information being sent offshore in an address to the 2007 GOVIS Conference, she has also signed a Memorandum of Understanding with the Australian Privacy Commissioner on cross-border cooperation over privacy complaint investigations. The Commissioner's office also participates in a range of activities at APEC, Asia-Pacific Privacy Authorities (APPA), and through the OECD, designed to encourage international cooperation on protection of personal information. The Data Protection Pathfinder, an APEC initiative, is working towards promoting a framework of principles on how cross-border rules should work across economies.

Those international efforts to collaborate on cross-border data privacy complicate our advice by providing a moving target. APPA started as a trans-Tasman initiative and now includes Hong Kong, Korea, and last year Canada.  All the international bodies mentioned above have active programmes and other organisations may have useful resources, such as the International Chamber of Commercemodel contracts, that can be applied to mitigate privacy risks.

Privacy risks

  • Unauthorised release of personal information
  • Inability to provide legitimate access by the data subject to personal information
  • Inability to cooperate with Privacy Commissioner over complaints of interference with privacy
  • Inability of the Privacy Commissioner to investigate or enforce against offshore offenders
  • Inability to guarantee the protection of personal information in foreign jurisdictions which do not have privacy/data protection laws
  • Foreign laws which conflict with the Privacy Act or offer less protection for the privacy of personal information
    • Some offshore locations may be less problematic than others. Countries whose privacy legislation is considered 'adequate' under the European Union Directive 95/46/EC may provide acceptable protection for personal information but agencies should check on the applicability of that protection to information from New Zealand and on enforceability from outside the potential hosting country
    • Conversely, some jurisdictions may have legislation that permits their government access to any source of personal information held in that country. The Privacy Act gives immunity to breaches of the information privacy principles outside New Zealand that result from an agency's compliance with foreign laws (Section 10).
  • The Commissioner reported on the implications of that provision in Necessary and Desirable (1998) Chapter 2.18, and in updates to that report in April 2000 and January 2003.

Example mitigations