Penalty for identity theft boosted

Identity theft is to be outlawed with a fine of up to $10,000 under an overhaul of privacy laws.

The Government is to beef up the watchdog powers of the privacy commissioner. Organisations will also be required to report data breaches to the commissioner, and notify those affected in serious cases.

Penalty fines are to be increased and two new offences created.

Failing to notify the commissioner of a privacy breach or impersonating someone to obtain their personal information will be illegal and carry a fine of up to $10,000.

It will also be against the law to destroy documents containing personal information that a person has sought access to.

Justice Minister Judith Collins announced the changes, saying they were necessary because of advances in technology.

‘‘Our proposals will put strong incentives in place to ensure business, government departments and other organisations take privacy seriously,’’ Collins said.

The proposals follow mass privacy breaches at ACC and the Ministry of Social Development.

They stem from a 2012 Law Commission review of the Privacy Act, which is more than two decades old.

‘‘Large amounts of personal information are now stored online and transmitted digitally – this has benefits, but also poses potential risks,’’ Collins said.

‘‘It’s now possible for huge amounts of data to be released in a single privacy breach, potentially affecting large numbers of people.’’

The commissioner will have new powers, including the ability to issue compliance notices. Currently, the watchdog can only make recommenda- tions.

However, fines will apply only to private agencies. The Government says it believes the prospect of being ‘‘named and shamed’’ is an effective deterrent within the public service.

Organisations that send personal information offshore must ensure it is protected and subject to acceptable standards. This includes firms that use cloud computing services or overseas call centres. If the offshore company has a breach, the Kiwi organisation may be subject to a complaint and required to notify the breach.

Collins said the new proposals were consistent with new OECD guidelines. The commissioner received a $7 million Budget boost this year.

The Privacy Act will be repealed. But the Government is to undertake ‘‘targeted technical consultation’’ before new legislation is introduced to Parliament.