NZ negotiating dangerous waters in data privacy debate

The Greek myth of Scylla and Charybdis tells of the story of how Odysseus was forced to sail his ship through a narrow strait flanked on one side by a ragged rock shoal, described as a six-headed sea monster, and a ferocious whirlpool on the other.

Forced to choose one of these two horrors, Odysseus steered his boat towards the rock, sacrificing many of his crew but saving his boat in the process.

This dilemma gave rise to the popular phrase “between the devil and the deep blue sea”.

And this is pretty much where New Zealanders find themselves in the context of the current stoush between Facebook and the Privacy Commission.

On the one hand, you have a powerful independent company controlling servers filled with user data.

On the other, you have a government organisation eager to gain greater control over how that data is used.

In light of the recent Cambridge Analytica scandal, it would be easy to side with the government as the great protector of Kiwi privacy and call for greater control of Facebook’s activities.

There certainly is validity to this — so much so that even Mark Zuckerberg offered what appears to be a riddle in saying: “I’m not sure we shouldn’t be regulated.”

This regulation could, however, have major repercussions well beyond the Cambridge Analytica scandal and even Facebook.

Indeed, legislative decisions of this calibre shouldn’t be made high on emotion and as a knee-jerk reaction to the tarnished reputation of a major player.

The stoush between Facebook and the Privacy Commission arises from a request by the Privacy Commissioner for access to private messages sent between users, which may have contained defamatory remarks about the complainant.

Facebook declined to provide access to this information, arguing New Zealand privacy law doesn’t apply to this case because its data is managed in Ireland.

The Privacy Commission responded by naming and shaming the company for having breached the provisions of the Privacy Act.

Privacy Commissioner John Edwards has been adamant that the breach notice had nothing to do with the Commission’s desire to “trawl through Facebook users’ accounts” and that it’s rather about ensuring that Facebook abides with New Zealand law given it counts more than 2.5 million New Zealanders as users.

Controversially, Apple CEO Tim Cook declined on the principle that it would set a precedent giving the US government “power to reach into anyone’s device to capture their data”.

“Opposing this order is not something we take lightly,” Cook said.

“We feel we must speak up in the face of what we see as an overreach by the US government.”

Of course, there will always be those who welcome such measures on the principle that they “have nothing to hide” and that it protects them from the real baddies.

Data security activist Edward Snowden has long asked those who make such claims to hand over their social media and email account passwords to prove the point that there are very few of us who would be happy to have our private conversations shared with anyone else.

It’s also notable that Snowden has long been deeply concerned about governments’ surveillance of their citizens.

This is not to say that this privacy commissioner or this government would ever use their power to extract private information from users’ social media accounts.

And while we might trust this government, can we trust the next one, the one thereafter or the one after that?

These questions are important to ask right now because there is currently a bill that has been put forward proposing an increase of the powers of the Privacy Commission by enabling it to impose a fine of up to $10,000 against organisations that breach the rules set out in the Privacy Act.

Privacy Commissioner Edwards has openly stated that he wants this to go even further so that it gives his office the power to impose fines of up to $1 million — particularly when dealing with big multinational firms flush with cash.

Edwards’ timing of the breach notice, almost melodramatic deletion of his Facebook account and strongworded op-ed go a long way towards casting Facebook in the role of the villain in this instance.

But things aren’t that easy in the data debate.

And in veering as far away as possible from the six-headed beast that Facebook now represents, we potentially risk sailing straight into a churning whirlpool entirely of our own making.