In New Zealand we’re pretty content with our lot—being known for breathtaking natural scenery and dominating on the world rugby stage. We’re not always up on the latest and greatest advancements as a small, less-ancient country, and we’re OK with that. But when we do innovate and lead the pack, we tend to create waves. We were, for example, the first country in the world to give women the right to vote, and it is therefore no great surprise that we now have our second female prime minister.
About the author
Mary Shirley is a New Zealand-qualified lawyer with 15 years of ethics and compliance experience working for regulators, in-house, and private practice/consultancy. She is currently global Head of Culture of Integrity and Compliance Education at Fresenius Medical Care.
A former Compliance Week Top Minds winner, Mary also hosts the Great Women in Compliance Podcast, which aims to create a platform for the outstanding achievements of women in the field and sharing ideas and providing learning opportunities. She co-authored ”Sending the Elevator Back Down: What We’ve Learned From Great Women in Compliance” (CCI Press, 2020).
Editor’s note: Mary is a member of the CW Advisory Board.
In the world of data privacy, we’ve had our little Privacy Act 1993 governing the land with 12 information privacy principles for nearly three decades. Recently, the privacy law was revised by the enactment of the Privacy Act 2020 as of Dec. 1. This Act repeals and supersedes the 1993 law.
The changes to the new Act, now with 13 information privacy principles, include new extraterritorial application; mandatory breach notification; new powers for the Privacy Commissioner; and new criminal offenses and penalties, including pecuniary penalties of up to NZD $10,000 (U.S. $7,135).
The advancements to the law on the above points are not particularly surprising—the 1993 legislation had been criticized for having limited teeth, and mandatory breach notification is the latest baseline standard for many other jurisdictions with data privacy legal protections in place.
One change that is particularly interesting is Section 100 of the 2020 Act. It provides that an apology can be made without admitting guilt. This brings a very human touch to the legislation that will likely make a big difference in the mediation and settlement process. Privacy infringements can feel very emotional. There is a reason why the emotive term “violation” is often used hand in hand with a privacy breach. Being able to say “I’m sorry this happened to you” is very different than “I’m sorry I caused you harm.” The Act provides that the former can be proffered in good conscience without putting the offeror in a position of admitting liability.
The introduction of such a provision is not one I’ve seen before, and so this begs the question: Will this have a positive effect, and will other countries follow the lead of New Zealand in this respect?
Something that remains to be seen is whether this section will be beneficial to the people of New Zealand. I am predicting it will. Under current Prime Minister Jacinda Ardern, we have seen a non-traditional form of leadership—one that focuses on empathy and the well-being of the people, taking a wide and holistic view of well-being. This apology provision is right along the same vein, and so its introduction does not come as a great shock to me.
Is this leadership working, you may be asking? The people of New Zealand signal yes. Ardern was re-elected by a convincing majority in the recent elections.
I checked in with Andre Bywater, a partner at Cordery law firm and a renowned global data privacy expert (particularly with the General Data Protection Regulation in the European Union), and asked him for his thoughts on Section 100.
“The New Zealand approach is to be welcomed as a very positive development,” he said. “This is the line that often has to be taken when informing individuals about a data breach.”
It seems when we appreciate, see, and hear each other, the world becomes a better place and tensions diminish. I have high hopes for the success of the New Zealand Privacy Act 2020 and hope the world is watching to see what happens next.
No comments yet