New Zealand’s New Privacy Law 2020 is Now in Force

New Zealand has meaningfully updated its privacy law, The Privacy Act 2020, which took force December 1.

The new Privacy Act 2020 is a significant advancement of New Zealand’s privacy law, and encompasses numerous changes, including:

Data Breach Reporting Obligations: There are new reporting obligations for data breaches. Companies are required to notify the Office of the Privacy Commissioner (OPC) directly of a breach. To manage data breach notifications, New Zealand launched a new tool, NotifyUs, which allows companies to determine whether or not they need to make a notification to the government, and then also facilitates an easy report directly to the government through the Data Protection Authority’s website. Older breaches can also be updated through the tool, which can be found here.

New Tools for Enforcing the Right of Access: The OPC has new authority to issue compliance notices to businesses, which will require the entity to disclose whether or not personal data about an individual is held. There are some exemptions in the law, but broadly, this will be an important enforcement and transparency mechanism.

Similar Safeguards Requirement: Principle 12 of the Privacy Act is newly added. This principle now requires a form of adequacy, or “similar safeguards” prior to sending information out of jurisdiction.

Extraterritorial Applicability: Another important update is a provision adding extraterritorial applicability of the law. Post-GDPR, this is not a surprising addition. Entities that are conducting business in New Zealand, even if just virtually / digitally from areas out of New Zealand, will be subject to the act.

New Criminal Provisions: The Privacy Act 2020 has also made certain actions a criminal offense, including:
- Impersonating someone in order to gain unauthorized access to information;
- Fines for businesses which destroy personal information knowing that a request has been made to access that information.

Here is a detailed OPC resource that outlines all of the changes to the law.

Posted December 3, 2020 in Digital Privacy, Governance, Privacy Law

New Report: Risky Analysis: Assessing and Improving AI Governance Tools

We are pleased to announce the publication of a new WPF report, “Risky Analysis: Assessing and Improving AI Governance Tools.” This report sets out a definition of AI governance tools, documents why and how these tools are critically important for trustworthy AI, and where these tools are around the world. The report also documents problems in some AI governance tools themselves, and suggests pathways to improve AI governance tools and create an evaluative environment to measure their effectiveness. AI systems should not be deployed without simultaneously evaluating the potential adverse impacts of such systems and mitigating their risks, and most of the world agrees about the need to take precautions against the threats posed. The specific tools and techniques that exist to evaluate and measure AI systems for their inclusiveness, fairness, explainability, privacy, safety and other trustworthiness issues — called in the report collectively AI governance tools – can improve such issues. While some AI governance tools provide reassurance to the public and to regulators, the tools too often lack meaningful oversight and quality assessments. Incomplete or ineffective AI governance tools can create a false sense of confidence, cause unintended problems, and generally undermine the promise of AI systems. The report contains rich background details, use cases, potential solutions to the problems discussed in the report, and a global index of AI Governance Tools.
National IDs Around the World — Interactive map

About this Data Visualization: This interactive map displays the presence...
Report: From the Filing Cabinet to the Cloud: Updating the Privacy Act of 1974

This comprehensive report and proposed bill text is focused on the Privacy Act of 1974, an important and early Federal privacy law that applies to the government sector and some contractors. The Privacy Act was written for the 1970s information era -- an era that was characterized by the use of mainframe computers and filing cabinets. Today's digital information era looks much different than the '70s: smart phones are smarter than the old mainframes, and documents are now routinely digitized and stored and perhaps even analyzed in the cloud, among many other changes. The report focuses on why the Privacy Act needs an update that will bring it into this century, and how that could look and work. This work was written by Robert Gellman, and informed by a two-year multi-stakeholder process.