Privacy complaints tipped to soar
New Zealanders can now launch mass lawsuits against companies and government agencies that mishandled their information, as part of the biggest shake-up of the country’s privacy laws in decades.
The number of breaches of New Zealanders’ privacy reported to the privacy watchdog was also expected to jump dramatically in 2021, after the Privacy Act 2020 came into effect on December 1 requiring organisations to report all breaches that cause, or could cause, ‘‘serious harm’’.
Experience from overseas suggests the changes could lead to a seven-fold increase in the number of privacy breaches reported.
The law change has also given Privacy Commissioner John Edwards the power to issue organisations with privacy compliance notices and prosecute repeat offenders, who could face fines of up to $10,000 per incident.
Previously, there were few repercussions for those who broke the rules.
Overseas-based businesses operating in New Zealand must also comply with the new law, regardless of whether they have a physical or legal presence here.
The changes come as the Privacy Commissioner’s annual report reveals details of some of the hundreds of breaches reported in the year to June 2020.
These include a power company that revealed a man’s new address to his abusive ex-partner, which she then used to leave abusive notes in his mailbox.
In another case, a shop had to remove a CCTV photograph it posted in its window and on Facebook of a woman who staff claimed, incorrectly, was a shoplifter.
None of the organisations responsible for the breaches were named in the report. In total, the commissioner received 205 notifications about privacy breaches from government agencies and businesses and he responded to 7734 inquiries from members of the public last year.
Victims of the breaches collected $216,400 in payouts.
But organisations accountable for breaches could now face much bigger penalties.
Under the new legislation, people affected by large privacy breaches can lodge ‘‘representative claims’’ on behalf of the other victims. Given that individuals can be awarded up to $350,000 in damages, cases involving multiple litigants could result in large claims.
Edwards said the new law was the ‘‘first major reset’’ of privacy protections in a generation.
He had yet to use his new powers but hoped the threat of enforcement would encourage organisations to treat people’s data with more care.
Gehan Gunasekara, University of Auckland associate professor of commercial law and chairman of the Privacy Foundation, said the new law had strengthened privacy protections.
However, he believed there was more to be done.