Resources to assist Privacy Act 2020 compliance
The Office of the Privacy Commissioner (OPC) has rolled out a range of tools and resources to assist compliance with Privacy Act 2020.
- NotifyUs is an online tool to help businesses and organisations decide whether a privacy breach meets the “serious harm” threshold requiring that it be notified to the Privacy Commissioner and, if it does, to make that notification.
- New principle 12 introduces restrictions on disclosing personal information to foreign persons or entities. The Principle 12 Decision Tree takes users through a series of questions covering all of the possible grounds for disclosure under the principle.
- If you are relying on an agreement to ensure personal information remains protected by adequate safeguards when disclosed to foreign persons or entities, the OPC has released template model clauses and a Model Clause Agreement Builder that can be used as a base for creating such information sharing agreements.
Guidance on responding to requests for CCTV footage
The Privacy Commissioner has also provided advice on how to respond to requests for CCTV footage, which comes under privacy principle six stating that people have the right to information about themselves.
Where the CCTV is in a public place, such as a supermarket, the response should be reasonably straightforward. But where the video is more sensitive (e.g. from a prison, a hospital, a swimming pool or a gym), it may be necessary to protect the identity of third parties, requiring the use of a secure masking technique. The guidance explores the protection options available.
For more information, read the guidance here.
Privacy breach forces review of vaccine booking systems
The Ministry of Health launched a review of vaccine booking systems nationwide last month after a privacy breach within the Canterbury District Health Board exposed the personal data of more than 700 people.
The information released was sensitive (including name, date of birth, National Health Index number, and where and when individuals were getting vaccinated) – all of which was readily accessible within the public-facing code of the website.
Read the article here.
EU proposes rules around AI
The European Commission has issued proposed regulations for the harmonisation of artificial intelligence (AI), which would ban some AI applications and restrict others but would allow the use of facial recognition technology in the event of a terrorist attack or when searching for criminals or missing children.
To become law the proposed rules, which have been long-awaited, will need to be approved by the European Parliament and member states. This cannot be guaranteed as the European Data Protection Supervisor has condemned facial recognition a “deep and non-democratic intrusion” into people’s lives which should be banned from Europe.
Read the article here.
NZX on path back from cyberattacks
The NZX is now in the implementation phases of an action plan agreed with the Financial Markets Authority (FMA) to address the issues exposed by a series of cyberattacks last year which forced NZX to repeatedly stop trading.
The plan is comprehensive, covering NZX’s arrangements for governance oversight, industry engagement, information technology capability, cyber security, human resources, crisis management planning and risk management.
For more information, see the FMA's update.
Large increase in reported cyber security breaches last year
CERT NZ received 7,809 security incident reports last year, up 65% on 2019. The most common complaints related to phishing and credential harvesting (up 76%), followed by scams and fraud (up 11%), and malware (up 2,008%). In 14% of cases, some form of financial loss was sustained, to a total value of $16.9m.
Win for Dotcom against Attorney-General
The Court of Appeal has found that Dotcom’s privacy was interfered with when some 52 public agencies transferred personal information requests received from him in 2015 to the Attorney-General.
Dotcom had asked that the requests be treated as urgent as they pertained to legal action relating to an extradition eligibility hearing due to commence in September that year. However the Attorney-General declined the requests on the ground that they were vexatious and included information that was trivial.
The Court of Appeal had been asked to rule on whether a request under the Privacy Act could be transferred to another agency where the requestor sought urgency and the basis for the urgency request was a matter that could only be properly evaluated by that agency (as opposed to the original recipient).
The Court determined that, even under these circumstances, agencies can only transfer a request if the personal information requested is more closely connected with the functions or activities of the transferee agency. It is irrelevant that the nature of the request is more closely connected to the transferee agency.
The Court did, however, find that an application for urgency may be a relevant factor for an agency in determining whether to refuse an information request, “not of itself” but depending on the context – although the threshold for vexatiousness would be very high.
Examples might include a “grossly excessive” number of urgency requests or reasons given for urgency, which were not credible
The case was decided under the Privacy Act 1993, but the principles in contention have been carried over to the Privacy Act 2020.
Read the decision here.
Invasion of privacy development
We reported in our May 2020 Data Points edition that the High Court judgment in Henderson v Walker expanded the scope of the tort of invasion of privacy by finding that the threshold for an action being an invasion of privacy was met by providing personal documents without authorisation. Widespread publicity of those personal documents or personal information was not required in order for an action to be available.
In Hyndman v Walker, the Court of Appeal was asked to rule on a similar case – this time determining whether Mr Hyndman’s privacy had been invaded after Mr Walker indirectly disclosed Mr Hyndman’s private communications with Mr Henderson to a Mr Holden, who then used that information against Mr Hyndman.
The Court accepted that Mr Hyndman had a reasonable expectation of privacy in his communications, but found that the disclosure was not “highly offensive” so, under New Zealand statute and unlike in the UK, no offence was established.
The Court did point out that the tort has not been developed much in the 16 years since its inception in New Zealand law and that it “may well benefit from re-examination” including being updated and liberalised to deal better with developments in technology.
To find out more, read the decision.
H&M fined €35m for violating workers’ privacy
H&M has been fined €35m by the German privacy watchdog for recording extensive personal information from hundreds of employees, including medical symptoms and religious beliefs, and using it to evaluate work performance and to make employment decisions.
A configuration error in October 2019 resulted in the data base, which had been collected from 2014 onwards, becoming accessible company-wide.
Read the article here.
UK Information Commissioner cracks down on unsolicited calls
- CPS Advisory Limited: fined £130,000 for making over 100,000 unauthorised marketing calls in relation to personal pensions, using personal information bought from third party data providers.
- Digital Growth Experts Limited: fined £60,000 for sending over 16,000 “nuisance” marketing text messages without valid consent between 29 February and 30 April 2020. An aggravating factor was that the marketing sought to capitalise on the COVID-19 pandemic by promoting a hand sanitiser as effective against the virus.
- Reliance Advisory Limited: fined £250,000 for making over 15 million unauthorised calls in relation to claims management services between 1 January and 1 June 2019.
- Pownall Marketing Limited: fined £250,000 for making over 365,000 unsolicited marketing calls in relation to claims management services during 1 January and 28 May 2019.
- Rancom Security Limited: fined £110,000 for making over 850,000 direct marketing calls of which over 560,000 were to numbers specifically protected against direct marketing calls during 1 June 2017 and 31 May 2018.
- House Guard UK Limited: fined £150,000 for making over 660,000 direct marketing calls of which over 370,000 were to numbers specifically protected against direct marketing calls during 8 May 2018 and 21 December 2018.
…and big fines for failing to keep personal data secure:
- British Airways: fined £20m for failing to protect the personal data of over 420,000 individuals between 22 June and 5 September 2018 following a cyber-attack on the company’s IT systems. Names, addresses and credit card details were accessed, as well as the usernames and passwords of British Airways employees and exclusive club members.
- Marriot International Inc: fined £18.4m for failing to keep the personal data of over 330m individuals secure following a cyber-attack on two of its hotel networks during 2014. The privacy breach was not detected until September 2018.
- Ticketmaster UK Limited: fined £1.25m for failing to keep the personal data of potentially 9.4 million individuals secure between February and June 2018 after a chat-bot installed on its online payment page was compromised.
Clearview’s facial recognition deemed illegal in Canada
Canadian privacy authorities have ordered Clearview AI to delete all Canadian faces from its facial recognition database.
The order follows a year-long inquiry which found that the information was collected without consent and was being used for inappropriate purposes, creating a system that “inflicts broad-based harm on all members of society, who find themselves continually in a police line-up”.
Social media companies, including Facebook and LinkedIn, sent cease and desist orders to Clearview last year after a New York Times investigation revealed that Clearview was lifting images illegally from their platforms.
To learn more, read the article and Canadian report.
RBNZ Governor leads data breach response
Reserve Bank Governor Adrian Orr led the Bank’s response to the malicious breach of a file sharing application, saying the Bank was giving the incident its full attention and apologising unreservedly to those affected. “Personally, I own this issue and I am disappointed and sorry”, he said.
The Bank immediately commissioned a forensic cyber investigation and has also appointed an independent third party to undertake a comprehensive general review. The Terms of Reference for that review are publicly available.
Be assured, we are taking action. We are working closely with public authorities and utilising international experts as we respond. We are doing so in a whole of government framework, using the National Security System.
The Bank was not a specific target but was caught up in a global attack on customers of US software company Accellion. Orr said later that the information leak might have been avoided had Accellion notified the Bank of the hack earlier, or told it that a patch was available which would have secured the system.
The Bank is currently looking for a new platform but has reported difficulty in sourcing a reliable alternative.
To learn more, read RBNZ's statements (15 January 2021 , 9 February 2021) and Terms of Reference, and Insurance Business NZ's article.
Spotless victim of serious data breach
Cleaning and catering company Spotless has sustained a serious data breach in both New Zealand and Australia.
Indications are that the company’s HR files may have been hacked, compromising personal information that might be used for identity theft, including the passport and tax numbers of past and present employees.
Spotless has advised the victims and notified the relevant privacy authorities.
Read the Stuff article and blog post.
