Submission to the Justice Committee on the Privacy Bill Bill 34-1, 2018 - Andrew Ecclestone 31 May 2018 - NZ Parliament
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Submission to the Justice Committee on the Privacy Bill Bill 34-1, 2018 Andrew Ecclestone 31 May 2018
Privacy Bill Submission Andrew Ecclestone
Submission to the Justice Committee on the Privacy Bill 2018
About the submitter
Andrew Ecclestone is a former Senior Investigator Official Information Practice
Investigations in the Office of the Ombudsman. He has also worked for the State
Services Commission, and the UK Department for Constitutional Affairs.
Oral submission
I wish to appear before the Committee. My contact details are included in the
covering letter to the Committee.
About this submission
This submission focuses on one issue: giving effect to the Law Commission’s
recommendation that the Ombudsmen be made an ‘agency’ subject to the Privacy
Act.
Page 1Privacy Bill Submission Andrew Ecclestone
Overall support for the Privacy Bill
1. In general, I support the Privacy Bill. It is a long overdue update to New
Zealand’s legal framework for protecting and managing personal information.
Defining the Ombudsman as an ‘agency’ subject to the Privacy Act
2. Clause 6 of the Privacy Bill is the Interpretation clause, which defines various
terms used in the Bill. One of the key terms to be defined is ‘agency’.
3. The definition of ‘agency’ has two parts. Paragraph (a) specifies what is
included in the definition, and is broad:
means any person or body of persons, whether corporate or
unincorporate, and whether in the public sector or the private
sector and, to avoid doubt, includes a department;1
4. Paragraph (b) specifies a limited list of roles and organisations that are then
excluded from the definition of ‘agency’. The legal effect of this exclusion is
that they are not required to comply with the ‘privacy principles’ defined in
clause 19 of the Bill.
5. The practical effect of the exclusion is that people will have no rights under the
Privacy Act to access or correct information about themselves, or ensure it is
being gathered, stored and managed in accordance with the privacy principles.
6. Privacy is a human right to be enjoyed by all natural persons.2 As such – and as
the Law Commission pointed out – ‘Provisions that limit the application of the
privacy principles in various ways are consistent with international human rights
1
‘Department’ is defined in clause 6 as ‘a government department named in Part 1 of Schedule 1 of
the Ombudsmen Act 1975’.
2
Article 3 of the Universal Declaration of Human Rights (‘security of the person’) and Article 17 of
the International Covenant on Civil and Political Rights.
Page 2Privacy Bill Submission Andrew Ecclestone
and privacy instruments, so long as the limitations are authorised and
specified in law, are reasonable and are as few as possible.’3
7. In August 2011, the Law Commission published Report 123, on stage 4 of its
review of the law of privacy in New Zealand. It considered the exclusion of
various entities from the definition of ‘agency’ in Chapter 4 of the report.
8. In paragraphs 4.20-4.24 of the report, the Commission considered whether or
not the Ombudsmen should be removed from the list of entities listed in
paragraph (b) of the definition of ‘agency’, thereby making the Ombudsmen
subject to the Privacy Act.
9. Recommendation 37 of the Law Commission was ‘The Ombudsmen should
be deleted from the list of entities excluded from the definition of
“agency”.’ 4
10. This recommendation has not been accepted by the previous or current
government, although it is unclear how much attention has been paid to this
particular issue by the current government, having inherited a Privacy Bill
largely drafted in accordance with decisions made by the previous
administration.
11. The Ministry of Justice’s listing of the Law Commission’s recommendations,
and the action proposed to be taken under the previous government has been
published online.5
3
Paragraph 4.1 (emphasis added), Review of the Privacy Act 1993, Law Commission report 123,
Wellington, August 2011. Accessed from http://lawcom.govt.nz/our-projects/privacy
4
Paragraph 4.24, Review of the Privacy Act 1993, Law Commission report 123, Wellington, August
2011. Accessed from http://lawcom.govt.nz/our-projects/privacy
5
Appendix One to the Cabinet Paper: Reforming the Privacy Act 1993, published on the Ministry of
Justice website at: https://www.justice.govt.nz/assets/Documents/Publications/appendix-one-to-
cabinet-paper-reforming-the-privacy-act-1993.pdf
Page 3Privacy Bill Submission Andrew Ecclestone
12. This states, in relation to Recommendation 37, that:
Modified proposal is to amend the Ombudsmen Act so that
information on how the Ombudsmen deal with personal information
must be included in their annual report.
13. In other words, the Ministry of Justice decided to recommend that the
Government reject the Law Commission’s recommendation on this point, and
the previous and current Ministers of Justice have either overlooked the issue,
or agreed with the Ministry’s suggested course of action.
14. The lack of clarity on Ministers’ views on this is apparent from the silence on
the topic in the information I received in response to an Official Information Act
(OIA) request to the Ministry of Justice for the information it held on this
matter.6
15. The key document disclosed by the Ministry in its response is a short note
signed off in November 2012, and attached to this submission as Annex A.
16. The note states that the officials, ‘agree that there needs to be a good reason
for the principles not to apply to agencies.’ However, it then simply repeats the
Ombudsmen’s objections to being included in the list of agencies to which the
privacy principles apply. In spite of the Law Commission having considered
and rejected these objections, the note states ‘We consider that these
arguments are persuasive’.
17. The Ministry lists the three factors for rejecting the Privacy Commissioner’s
recommendation that the Ombudsmen be made subject to the Privacy Act.
These are outlined in paragraph 4.20 of the Law Commission report:
• The Ombudsmen are the “last line” check on the exercise of
executive power, and should not be subject to investigation by an
agency such as the Privacy Commissioner that is itself subject to
the Ombudsmen’s jurisdiction.
6
Exclusion of the Ombudsmen from scope of the Privacy Bill, available online here:
https://fyi.org.nz/request/7805-exclusion-of-the-ombudsman-from-scope-of-the-privacy-bill
Page 4Privacy Bill Submission Andrew Ecclestone
• The Ombudsmen Act already contains sufficient protections with
respect to the handling of personal information.
• Providing for principle 6 access rights in respect of personal
information at the margins of the Ombudsmen’s secrecy
requirements could impede the Ombudsmen’s ability to carry out
their statutory functions of resolving complaints in a thorough and
timely manner.
18. The Law Commission rejected the first argument in paragraph 4.21 of its
report, stating ‘We do not think that there is anything unusual or problematic in
making one complaints body subject to investigation by another.’ It cited the
fact that the Privacy Commissioner is subject to the Ombudsmen under the
Ombudsmen Act and OIA.
19. The Ministry’s note states that it considers the Ombudsmen’s first point to be
‘particularly’ persuasive, but does not deal with the Law Commission’s rebuttal
of that argument. If the Government were to follow the Ministry’s and
Ombudsmen’s logic to its natural conclusion, it would in effect be saying that
the Ombudsmen should be exempted from the Public Records Act 2005,
health and safety, and employment laws, because the various investigation and
oversight bodies for those laws fall within the Ombudsmen’s jurisdiction. Is the
Government and Ministry seriously suggesting that this should be the case,
and that the Ombudsmen should not have to keep good records, or that the
staff of the Ombudsmen are not entitled to protection for their health and
safety, or to trade union representation under the Employment Relations Act
2000? If not, their argument falls, and the Justice Committee should remove
the Ombudsmen from paragraph (b) of the definition of ‘agency’.
20. The Law Commission also rejected the second argument advanced by the
Ombudsmen and accepted by Ministry officials. In paragraph 4.22 the
Commission stated,
On the second of the Ombudsmen’s points, we consider that the
existing provisions in the Ombudsmen Act do not cover all the
ground in the Privacy Act. The Ombudsmen’s secrecy provisions
do not, for example, deal with matters such as collection and
Page 5Privacy Bill Submission Andrew Ecclestone
retention of personal information that are covered by the privacy
principles.
21. The Ministry’s note states ‘We are also not convinced that there is an actual
problem with the way Ombudsmen handle personal information now justifying
change.’ There are three problems with this statement.
22. First, there is absolutely no evidence that the Ministry sought to gather any
evidence about the Ombudsmen’s practices with regard to handling personal
information. They certainly did not ask the public for their experiences of
seeking to obtain or correct their personal information from the Ombudsmen,
so presumably the Ministry officials were operating on the basis of ‘no news is
good news’. Alternatively, they simply relied upon an assurance from the
Ombudsmen that there were no problems, which is hardly an independent test
of a claim. It is questionable whether the Ministry even did this, since in its
supplementary OIA response to me (Annex B to this submission), the Ministry
stated that it held no information from the Ombudsmen about
recommendation 37.7
23. Second, if the Ombudsmen are excluded from the definition of ‘agency’, a
person complaining to the Privacy Commissioner about the Ombudsmen’s
response to their request for access to their personal information will be told
that the Ombudsmen is not subject to the Privacy Commissioner’s jurisdiction.
Leaving the Ombudsmen as arbiter of any complaint about how they
themselves have responded to a request about the handling of personal
information is clearly contrary to normal principles of natural justice.
24. Third, and more fundamentally, the Ministry’s argument that it is unconvinced
there is a problem at present is completely beside the point. As the Law
Commission noted, and the Ministry ostensibly accepted, since privacy is a
human right, any departure from the principle that the Privacy Act should apply
7
Supplementary response to my OIA request, dated 30 May 2018, attached as Annex B or
accessible here:
https://fyi.org.nz/request/7805/response/25612/attach/4/20180530%20Supplementary%20letter.
pdf
Page 6Privacy Bill Submission Andrew Ecclestone
as widely as possible must have a strong reason. Or as the Ministry’s own note
states:
All organisations should be subject to the Act unless there is a
good reason to the contrary. Other Parliamentary Officers are
subject to the Act as are the Courts. The Law Commission could
not see any good reasons to exclude the Ombudsmen.
25. The Law Commission rejected the Ombudsmen’s third argument for not being
made subject to the Privacy Act in paragraph 4.23 of its report, stating:
With regard to the possible impact of principle 6 access rights on
the Ombudsmen’s exercise of their statutory functions, we think
that sufficient protection for the Ombudsmen’s complaints-
resolution functions is provided by the combination of the secrecy
obligation in the Ombudsmen Act (which would override the
Privacy Act by virtue of section 7) and section 55(d) of the Privacy
Act, which provides that nothing in principles 6 and 7 applies in
respect of:
information contained in any correspondence or communication that has
taken place between the office of the Ombudsmen and any agency and
that relates to any investigation conducted by an Ombudsman under the
Ombudsmen Act 1975 or the Official Information Act 1982 or the Local
Government Official Information and Meetings Act 1987, other than
information that came into existence before the commencement of that
investigation.
26. The Ministry’s note makes no attempt to rebut the Law Commission’s
argument on this point, tacitly accepting the Ombudsmen’s claim about the
impact on its workload of having to deal with people requesting information
from it.
27. This is a weak argument, as I am sure members of the Justice Committee will
easily see, since every other organisation defined as an ‘agency’ under the
Privacy Act could make a claim about not needing to respect people’s rights
under the Act because of the work it creates for them.
Page 7Privacy Bill Submission Andrew Ecclestone
28. Ironically, it is an argument that has been undermined by the Ombudsmen
themselves in their submission to the Law Commission’s 2009-12 review of the
Official Information Act 1982.8
29. In paragraphs 14.24 – 14.36 of The Public’s Right to Know, the Law
Commission addressed the issue of applying the OIA to Officers of Parliament.
In paragraph 14.26 the Commission stated:
We cannot identify any issue of principle which leads to the
conclusion that the [Office of the Controller and Auditor General]
OCAG (including Audit New Zealand) should be entirely excluded
from the OIA. We think extending the scope of the OIA to include
the OCAG, which itself plays an important role in New Zealand’s
accountability arrangements, would provide an important signal
about the role the OIA plays in holding public bodies to account. At
least in respect of its administrative functions, including its use of
public resources, the OCAG should be as accountable as any other
public body.
30. In the next paragraph, the Commission continued in respect of the
Ombudsmen:
For similar reasons, the Ombudsmen have suggested to us that
consideration should be given to making them, at least in
respect of their administrative functions, subject to the OIA.
Information held by the Ombudsmen or other agencies in respect
of the Ombudsmen’s investigative functions is explicitly excluded
from the scope of the OIA.
We agree that, in principle, extending the OIA to include the
Ombudsmen’s administrative functions is appropriate. It does not
send a satisfactory message if the Ombudsmen, the authority
charged with holding other agencies to account under the OIA, are
themselves completely exempt from it. We thus recommend that
subject to the exceptions we discuss below, the Ombudsmen
should be subject to the OIA.9 (emphasis added)
8
The Public’s Right to Know: Review of the Official Information Legislation, Law Commission
Report 125, Wellington, July 2012. Accessed at: http://lawcom.govt.nz/our-projects/official-
information-act-1982-and-local-government-official-information-act-1987
9
Ibid, paragraphs 14.27-14.28
Page 8Privacy Bill Submission Andrew Ecclestone
31. The Law Commission concluded with Recommendation R122:
The Offices of Parliament (the Ombudsmen, the Office of the
Controller and Auditor-General and the Parliamentary
Commissioner for the Environment) should be subject to the OIA
by inclusion in Schedule 1. Information relating to any audit,
assurance work, inquiry or investigation undertaken by an Office of
Parliament should be excluded from the definition of “official
information” in section 2 of the OIA.10
32. In considering whether the Ombudsmen should continue to be excluded from
the definition of ‘agency’ in the Privacy Act, members of the Justice Committee
may find it difficult to accept that Ombudsmen should somehow not be subject
to one key information access and governance regime – the Privacy Act - when
they have themselves volunteered themselves to be subject to the OIA.
33. There is however one additional argument for making the Ombudsmen subject
to the Privacy Act. This is that the employees of the Ombudsmen should have
the same rights and protections under the law regarding the collection, use,
management, access to and disposal of their personal information as the
employees of any other organisation in New Zealand. It is somewhat ironic that
the people who work hard to uphold New Zealander’s rights to official
information are not themselves able to benefit from the protections and rights
created by the Privacy Act.
34. The Law Commission notes, in paragraph 4.22 of its report on the Privacy Act
that:
The Ombudsmen were willing to accept the application of privacy
principles 6 and 7 to personal information about employees and
former employees.
35. Given this statement, it is somewhat puzzling, given its unquestioning
acceptance of the Ombudsmen’s other arguments for remaining exempt from
the privacy principles, that the Ministry of Justice’s note on
Recommendation 37 does not address this point at all.
10
Ibid, following paragraph 14.36, page 340
Page 9Privacy Bill Submission Andrew Ecclestone
36. Although the Ombudsmen indicated their willingness to grant their employees
and former employees these limited rights, they did not wish to have this
effected by being made an ‘agency’ under the Privacy Act. The Law
Commission’s report continues:
However, they said that if such access and correction rights were
to be legislated for, it would be preferable for this to be done by
incorporating principles 6 and 7 in the Ombudsmen Act, rather
than providing for complaints under the Privacy Act.
37. This does not seem a desperately strong argument, and inherently rests on the
second point the Ombudsmen made to the Law Commission, that they should
not be subject to investigation by an agency that is subject to the
Ombudsmen’s own jurisdiction. That argument was firmly despatched by the
Law Commission in paragraph 4.21, and further explanation as to why it does
not hold water can be found in paragraphs 19 and 23 of this submission.
38. The Ministry of Justice’s response to the Law Commission’s recommendation
that the Ombudsmen be made subject to the Privacy Act is merely to
Amend the Ombudsmen Act so that information on how the
Ombudsmen deal with personal information must be included in
their annual report.
39. The Ministry’s November 2012 note (Annex A to this submission) concludes
with the comment that ‘The Ombudsmen have not yet been consulted on this
proposal.’ It is concerning that the Ministry reached its decision to reject the
Law Commission’s recommendation without consulting the Ombudsmen. They
may have discovered that the Ombudsmen were in fact persuaded by the Law
Commission’s arguments. They could even have amended their proposed
response to give effect to the Ombudsmen’s minimal concession of granting
some form of principle 6 and 7 rights to current and former employees.
40. One might have hoped that in the intervening five and half years since the note
was written that the Ministry would, in its normal exchange of correspondence
with the Ombudsmen on various issues (including amendments to the
Ombudsmen Act via the Statutes Amendment Bills), have consulted the
Ombudsmen on this issue. Not least since the Ministry’s Cabinet Paper for the
Page 10Privacy Bill Submission Andrew Ecclestone
previous Minister of Justice states that the Ombudsmen have been consulted
on the proposals for reform of the Privacy Act.11 But in its table comparing the
Privacy Bill with the Law Commission recommendations (disclosed as
Document 7 in response to my OIA request), the Ministry has noted that
‘Schedule 8 (consequential amendments) does not seem to include this
amendment to the Ombudsmen Act’. Furthermore, as previously noted, in its
supplementary response to my OIA request (Annex B to this submission), the
Ministry states that ‘the Ministry has not been able to locate’ any information
received from the Ombudsmen, either in correspondence or at a meeting,
relating to the Law Commission’s recommendation that the Ombudsmen be
made subject to the Privacy Act.
41. In any event, the Ministry’s proposed action of amending the Ombudsmen Act
to require some kind of information to be buried within an annual report is so
vague that it is entirely unclear how it could possibly achieve any beneficial
outcome for people’s legitimate interests regarding the handling of their
personal information.
42. Finally, I note that the Australian Commonwealth Ombudsman is subject to
Australia’s Privacy Act 1988 and the Privacy Commissioner’s jurisdiction, and
the UK Parliamentary Ombudsman is subject to the Data Protection Act 2018
(and to the Data Protection Act 1998 before that) and the Information
Commissioner’s jurisdiction.12
11
Paragraph 103 of the Cabinet Paper Reforming the Privacy Act 1993 (Document 5 in the Ministry’s
response to my OIA request), which can be accessed here:
https://www.justice.govt.nz/assets/Documents/Publications/cabinet-paper-reforming-the-privacy-
act-1993.pdf . Interestingly, paragraph 59 of Minister Little’s Cabinet Paper on introduction of the
Privacy Bill 2018 does not list the Ombudsmen as consultees, a remarkable oversight given that
several of the Law Commission’s recommendations impact the Ombudsmen. This paper can be
accessed here: https://www.justice.govt.nz/assets/Documents/Publications/cabinet-paper-
privacy-bill-2018-approval-for-introduction-and-additional-policy-decisions.pdf
12
For Australia, see the section 6 definition of ‘agency’ in the Privacy Act 1988 accessible here:
https://www.legislation.gov.au/Details/C2018C00034 . The Commonwealth Ombudsman’s legal
team have confirmed to me by email that they fit within this definition, and advise people of their
privacy rights here: http://www.ombudsman.gov.au/privacy-policy .
For the United Kingdom, see the section 7 definition of ‘public authority’ and ‘public body in the
Data Protection Act 2018 and section 3 and Part VI of Schedule 1 of the Freedom of Information
Page 11Privacy Bill Submission Andrew Ecclestone
Recommendation
43. I strongly recommend that the Justice Committee reject the weak arguments of
the Ministry of Justice and the Ombudsmen to deny people their rights, and
instead amend the Privacy Bill to give effect to Law Commission
Recommendation 37. This will follow the basic principle that there must be
truly exceptional reasons to depart from universal application of people’s rights
through the Privacy Act, and that no such reasons have been advanced that
can withstand scrutiny.
44. This can be done very simply, by deleting sub-paragraph (ix) ‘an Ombudsman’
from the list of roles and organisations in paragraph (b) of the clause 6
definition of ‘agency’.
45. In doing so, the Committee will significantly strengthen the rights of all those
who rely on the Ombudsmen (including Members of Parliament), ensure that
the Ombudsmen’s ever-increasing current and former staff benefit from the
same rights as other New Zealanders, and place the Ombudsmen on the same
footing as their fellow Officers of Parliament, the Controller and Auditor General
and the Parliamentary Commissioner for the Environment.
---------------------
Act 2000, accessible in the following locations:
http://www.legislation.gov.uk/ukpga/2018/12/section/7/enacted and
http://www.legislation.gov.uk/ukpga/2000/36/section/3
Page 12Annex A
Annex B
You can also read
