1 / 32

One Size Fits All Data Protection in New Zealand: Processes and Outcomes

One Size Fits All Data Protection in New Zealand: Processes and Outcomes. Gehan Gunasekara & Erin Dillon. Introduction. “The blood running through the veins of twenty-first century commerce increasingly consists of information about individuals.” Collection and processing of personal data

len
Download Presentation

One Size Fits All Data Protection in New Zealand: Processes and Outcomes

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. One Size Fits All Data Protection in New Zealand: Processes and Outcomes Gehan Gunasekara & Erin Dillon

  2. Introduction • “The blood running through the veins of twenty-first century commerce increasingly consists of information about individuals.” • Collection and processing of personal data • Data outsourcing • Data mining / profiling / tracking • Predictive behaviour mapping

  3. Paper Overview • New Zealand’s one size fits all Privacy Act 1993 • Data protection history • Dispute resolution process • Statistical analysis: nature of defendants, remedies, areas litigated

  4. International Context • Early data protection measures (1970s) • European approach: seamless regime: private and public sector covered • US approach: public sector only- private sector piecemeal approach: E.g. video Privacy Protection Act 1988 • OECD Guidelines (Trans-border) • APEC Privacy Framework

  5. International Developments • The EU Directive (1995) • Adequacy standard • Prohibition of personal data exports

  6. International Developments • EU / US dispute • Safe Harbor Principles compromise • The New Zealand approach

  7. Data Protection Principles • Nature of data protection principles (IPPs) • Open ended flexibility resists obsolescence • The significance of process • Interpretation • The right to remedies

  8. Research Focus • Areas of litigation and outcomes • “Real remedies in concrete instances affecting real people” • Dedicated tribunal: Human Rights Review Tribunal • Minor role for the courts • Jurisprudence 1993 to 2006 • Statistical analysis: public / private sector, IPPs litigated, remedies $, representation and outcomes

  9. Data Protection in NZ • Early law enforcement data processing

  10. Data Protection in NZ • Information Matching legislation 1991 • National Privacy Commissioner • Information matching risks • Information matching safeguards

  11. Data Protection in NZ • Freedom of Information legislation (1982/ 1987) • Information based • Individual access to data held in public sector • Role of Ombudsman

  12. Privacy Act 1993 • Public and Private sector “agencies” • Areas excluded: personal affairs, legislature, judiciary, news media • All “personal information” covered • One stop shop: access to ALL personal information and remedies for misuse • Reduction in compliance costs (multiple agencies/ different rules)

  13. Privacy Act 1993 • Flexibility: codes of practice (Commissioner) • Examples: Health Information Privacy Code, Credit Reporting Privacy Code • More / less stringent than IPPs

  14. Privacy Act 1993 • IPPs contain exceptions: law enforcement, legal proceedings, health and safety, statistical / research • Access can be denied: e.g. privacy of another individual, evaluative material and promise of confidentiality • Public registers subject to separate public register principles

  15. Dispute Resolution Process • Avoids courts • Privacy Commissioner • Inquisitorial and conciliatory role • Powers • Settlement is priority • 1993 – 2006: 81 per cent of complaints settled • Most settled before finding by PC • 4 per cent of complaints ruled to have substance / privacy interference

  16. Dispute Resolution Process • PC has discretion to refer to Director of Human Rights Proceedings (DHRP) • 47 referrals vs. 173 taken by complainant • 42 % resulted in favourable ruling by Tribunal • 11 substantive appeals to the courts • Tribunal reversed in 3 • 1 appeal to the Court of Appeal

  17. Litigation in New Zealand • Social context: non- litigious culture • Example: No-fault accident compensation maximum lump sum = $100,000 • $40,000 highest privacy award to date • Defamation / libel special case

  18. Litigation in New Zealand • Tribunal composition • Role of chairperson • Role of PC • “Substantial merits” without regards to technicalities • Evidentiary difficulties: link with interpretation

  19. Litigation in New Zealand Proceedings can be brought if: • Referral by PC and DHRP • Plaintiff where PC / DHRP does not • Need for prior investigation by PC • Average < 10 Tribunal cases per year • 140 cases : 81 substantive decisions included

  20. The Defendants • Statutory definition of private / public sector

  21. The Defendants • 62 per cent = public sector defendants • 6 public sector organisations account for 43 % of total cases • 41 per cent = private sector • (some cases counted as both private and public as more than 1 defendant)

  22. The Defendants • Of private sector 39 per cent = health sector • 25 % of total cases = non-health private sector (commercial and not-for-profit orgs) • These orgs include: banks, insurance companies, individuals, funeral directors and clubs

  23. Areas Litigated • IPPs and Code Rules • Multiple IPPs per case • Overseas comparison

  24. Remedies NB: More than one remedy common

  25. Remedies Remedies awarded to successful plaintiffs (42% of all claims): Damages (21 cases) Costs (7 cases) Range $200 - $40,000 Range $121.33 - $1,338 Mean $7,449.80 Mean $711.28 Median $4,000 Median $500 Unsuccessful Plaintiff Pay Costs of Defendant (10 cases) Range $500 - $12,500 Mean $4,401.99 Median $2,750

  26. Representation • Non-legal representation allowed • Risks of non-legal representation • Representation did not affect success

  27. Representation Comparison of Remedies for Plaintiffs With and Without Representation Damages: With (7) Without (14) Range $200 - $40,000 $500 -$20,000 Mean $12,885.71 $3,303.27 Median $10,000 $3,000 Costs: With (2) Without (5) Range $500- $1,338 $121.33 - $1,269.64 Mean $919 $628.20 Median $919 $500

  28. Representation Comparison of Outcomes for Plaintiffs With and Without Representation Unsuccessful Plaintiff Pays Costs of Defendant: With (4) Without (6) Range $1,529.86- $12,500 $500 - $10,000 Mean $5,007.50 $3,998.30 Median $3,000 $2,750

  29. Significant Cases • Most non-technical and pragmatic • Early cases re: scope of Act and exclusions • Influence of legal principle • Evidentiary difficulties

  30. Significant Cases • High Court appeals • Limitations • Hamilton vs. The Deanery 2000 Ltd • Proceedings Commissioner vs. Harder

  31. Conclusions • Advantages of NZ approach • Conciliation vs. Litigation • Litigation rare: success rate low • Most suits against public sector • Low rate of representation, and representation non-legal • Areas most litigated: Denial of access to and improper disclosure of personal information

  32. Tribunal and Court’s Contribution • Interpretation • Unduly legalistic? • Modest damage awards • Day in court

More Related