New Zealand is committed to the Universal Declaration of Human Rights and has ratified the International Covenant on Civil and Political Rights, both of which contain a right to privacy.Universal Declaration of Human Rights, Art 12; International Covenant on Civil and Political Rights, Art 17. Privacy law in New Zealand is dealt with by statute and the common law. The Privacy Act 2020 addresses the collection, storage and handling of information. A general right to privacy has otherwise been created in the tort of privacy. Such a right was recognised in Hosking v Runting 3 NZLR 385, a case that dealt with publication of private facts. In the subsequent case C v Holland NZHC 2155 the Court recognised a right to privacy in the sense of seclusion or a right to be free from unwanted intrusion.
Legislation
New Zealand Bill of Rights Act 1990 The New Zealand Bill of Rights Act 1990 (NZBORA) is based on the International Covenant on Civil and Political Rights,New Zealand Bill of Rights Act 1990, long title. however no express right to privacy is included in the Act. Despite the lack of an express right, privacy is the foundation for many of the rights contained within NZBORA, such as freedom from unreasonable search and seizure as protected by section 21.New Zealand Bill of Rights Act, s 21; Steven Penk and Rosemary Tobin, Privacy Law in New Zealand at 18. The fact that a right to privacy is not included in NZBORA does not affect or invalidate it in any way.New Zealand Bill of Rights Act 1990, s 28. It is suggested that privacy was not included in NZBORA due to its difficulty to define, and because the social environment at the time was not one in which it was appropriate to implement a right with vague and uncertain parameters.Hosking v. Runting 2 NZLR 1 at -.
Privacy Act 2020 New Zealand has a statute entitled the Privacy Act 2020 (which replaced the Privacy Act 1993). However, despite its declaration that it is an Act to promote and protect individual privacy, it in fact only covers information privacy. The Privacy Act was created to combat concerns about technological advances and their potential to be used to access private information, when this risk had been far less under manual data systems.Steven Penk and Rosemary Tobin Privacy Law in New Zealand at 50-51.
The Act contains 13 Information Privacy Principles which govern the handling of private information by agencies. An 'agency' is widely defined as any person or body of persons, whether public or private, and whether corporate or unincorporated, with specified exceptions. There are also numerous exceptions to the Information Privacy Principles, which can be found both within the principles and in other places within the Act.See Privacy Act 2020, s 22, principles 2 and 3, and ss 45-57 as examples.
When an individual feels there has been a breach of the principles he or she can lodge a complaint with the Privacy Commissioner. The Privacy Commissioner investigates the complaint and undertakes a process of conciliation rather than punishment. If the complaint cannot be settled, it may be referred to the Human Rights Review Tribunal, which may or may not consider the situation anew, and it's quite likely that they won't consider a complaint at all (especially if the issue is related to debt). If the Tribunal finds there has been a breach, it may award a range of remedies including damages and restraining orders.
The Privacy Act recognises that privacy is not an absolute concept and that there are other factors which need to be weighed to determine what the outcome should be. The Privacy Commissioner must always have regard to factors such as human rights, social interests, and international obligations and guidelines. The Privacy Commissioner is able to make authorisations regarding the use of private information which would normally be contrary to the Act if he or she is satisfied that the public interest or benefit outweighs the interference with privacy.
Broadcasting Act 1989 The Broadcasting Act 1989 requires broadcasters to maintain standards consistent with the privacy of the individual. The Act establishes the Broadcasting Standards Authority (BSA), which has the functions of receiving and deciding complaints against broadcasters, issuing opinions relating to ethical conduct and standards in broadcasting, and issuing codes of practice for broadcasters and encouraging compliance with them.Broadcasting Act 1989, ss 4(1)(c) and 20-21. Privacy is consistently mentioned in the codes and standards of practice issues by the BSA.Steven Penk and Rosemary Tobin Privacy Law in New Zealand at 206. While the Broadcasting Act does not provide any explanation of what constitutes a breach of privacy, the BSA has seven principles relating to alleged breaches of privacy.Hosking v Runting 1 NZLR 1 at -. In considering a complaint, the BSA can award a variety of remedies if it finds there has been a breach, but there is no ability to take a complaint to a court of law based on the standards contained within the Act.Broadcasting Act 1989, s 13.
Common law A general tort of invasion of privacy exists in New Zealand. The case which is accepted to be the first which found that a tort of privacy may exist was Tucker v News Media Ownership Ltd, in which the judge supported the introduction of such a tort into the law of New Zealand. A few years later in Bradley v Wingnut Films, the judge accepted that a tort of privacy did exist in New Zealand law, but that it should be approached with caution as it was in the earlier stages of development. The most crucial New Zealand High Court decision was that of P and D v Independent News Auckland Ltd, where the court defined the elements of a tort of privacy as: The public disclosure of facts The facts disclosed are of a private nature The facts made public would be considered highly offensive to a reasonable person There is insufficient legitimate public concern in having the facts made public.
The New Zealand Court of Appeal in a bare majority in Hosking v Runting accepted that there was a tort of privacy in New Zealand. The tort was affirmed as protection in this area was needed and the breach of confidence tort was not suitable to cover situations involving privacy. The two requirements for the tort set out by the majority closely reflect those set out in P v D: Existence of facts which were reasonably expected to be private Publicity given to those facts which would be considered highly offensive by the objective and reasonable person. In addition, privacy had to be weighed against the defence of legitimate public concern which encompasses the right to freedom of expression.
The Supreme Court of New Zealand has in one case accepted that a tort of privacy exists for the purposes of a case before it, but had differing opinions about its requirements and application. In Brooker v Police the court acknowledged the decision of Hosking but refrained from commenting.
Security and intelligence
New Zealand’s intelligence and security agencies
Two government bodies are responsible for monitoring New Zealand's national security: the Government Communications Security Bureau (the 'GCSB') and the Security Intelligence Service (the 'SIS'). Prior to the introduction of the Intelligence and Security Act 2017, these bodies operated strictly independently of one another, and general mystery surrounded their exact functions and capabilities. Much of the confusion originated from the fact that the SIS and GCSB appeared to have differing objectives which meant that, if required, co-operation and coordination would likely be complex and convoluted.
For example, only the SIS could perform surveillance, or spy, on New Zealanders, as provided by the New Zealand Security Intelligence Service Act 1969. There were stipulations as to what 'spy-activities' were permitted, and as a pre-requisite, any proposed surveillance had to be relevant to "security" and its associated threats, such as instances of 'espionage, sabotage, subversion or terrorist attacks'.
The 2013 surveillance landscape
In September 2012, Paul Neazor, the Inspector-General of Intelligence and Security advised John Key, the then New Zealand Prime Minister, of a situation which would later be called an "unlawful interception" of an individual known as Kim Dotcom by the GCSB. Following a formal request from the United States' Federal Bureau of Investigation that Kim Dotcom be extradited to the United States, the GCSB spied on Mr Dotcom in order to assist the FBI's request. However, as the GCSB did not have the legal authority to conduct surveillance, Justice Gilbert of the Court of Appeal, deemed unlawful.The New Zealand Herald "Judge: Dotcom spied on two months longer than previously admitted" (21 July 2017) http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11893618e
Following this widely publicised incident, GCSB Director Ian Fletcher and Chief Executive of the Department of the Prime Minister and Cabinet Andrew Kibblewhite initiated a review of compliance. They assigned the then Cabinet Secretary Rebecca Kitteridge with undertaking the review to look into the "activities, systems and processes since 1 April 2003". This date is significant as it was the date from which the Government Communications Security Bureau Act 2003 came into force.
The “Kitteridge Report” ultimately concluded that GCSB lacked the legal basis and authority to perform many of its intelligence acts – including the surveillance carried out on Kim Dotcom. The Kitteridge Report made a number of recommendations to ensure that the Government agency had the legal authority to do the activities necessary. All of the recommendations presented in the Kitteridge Report were accepted by the Government and GCSB which led to a number of legislative reforms. These included giving the GCSB the express capability to legally perform surveillance on New Zealanders when required by the SIS, the police or Defence forces.Andrea Vance “Demystifying the GCSB bill: Spies and lies” (20 August 2013) At the time when these changes were introduced, with mounting public concern about New Zealanders' rights to privacy, the then Prime Minister John Key stated that the "new legislation does not add up to an expansion of the bureau’s powers".
It is now permissible for GCSB to legally spy on New Zealanders as a result of the 2013 reforms. In addition, the GCSB's role has expanded and it is now able to perform surveillance on "behalf of the SIS, the police or the Defence forces, or for the purposes of cyber security".
The 2016 surveillance landscape
In August 2016 the then Prime Minister John Key announced that due to the threat of ISIS and global terrorism, the New Zealand Government would be introducing new legislation to provide further safeguards for New Zealanders.
New Zealand's first Intelligence and Security Review was undertaken by Sir Michael Cullen and Dame Patsy Reddy, and looked at "the legislative framework governing the agencies and considered whether they were well placed to protect New Zealand’s current and future national security while protecting individual rights". The review was completed at the end of February 2016, and its findings proposed that one Act be introduced to bring all of New Zealand's intelligence and security agencies together.
Cullen and Reddy identified a number of issues in their report. One of the prominent issues identified was that the fragmented legislative landscape meant that it was difficult to bring the multiple agencies together when required. Because each intelligence and security agency operated under its own legislative framework, it was confusing for New Zealanders to understand which agency was responsible for what, and exactly what their lawful powers and capabilities were.
The reviewers concluded that a "single Act" was necessary to overcome these issues. They commented that a single Act would: