320 likes | 404 Vues
Explore data protection processes and outcomes in New Zealand, covering legislation, dispute resolution, international context, litigation insights, and statistical analysis. Learn about key principles, remedies, and the role of the Privacy Commissioner.
E N D
One Size Fits All Data Protection in New Zealand: Processes and Outcomes Gehan Gunasekara & Erin Dillon
Introduction • “The blood running through the veins of twenty-first century commerce increasingly consists of information about individuals.” • Collection and processing of personal data • Data outsourcing • Data mining / profiling / tracking • Predictive behaviour mapping
Paper Overview • New Zealand’s one size fits all Privacy Act 1993 • Data protection history • Dispute resolution process • Statistical analysis: nature of defendants, remedies, areas litigated
International Context • Early data protection measures (1970s) • European approach: seamless regime: private and public sector covered • US approach: public sector only- private sector piecemeal approach: E.g. video Privacy Protection Act 1988 • OECD Guidelines (Trans-border) • APEC Privacy Framework
International Developments • The EU Directive (1995) • Adequacy standard • Prohibition of personal data exports
International Developments • EU / US dispute • Safe Harbor Principles compromise • The New Zealand approach
Data Protection Principles • Nature of data protection principles (IPPs) • Open ended flexibility resists obsolescence • The significance of process • Interpretation • The right to remedies
Research Focus • Areas of litigation and outcomes • “Real remedies in concrete instances affecting real people” • Dedicated tribunal: Human Rights Review Tribunal • Minor role for the courts • Jurisprudence 1993 to 2006 • Statistical analysis: public / private sector, IPPs litigated, remedies $, representation and outcomes
Data Protection in NZ • Early law enforcement data processing
Data Protection in NZ • Information Matching legislation 1991 • National Privacy Commissioner • Information matching risks • Information matching safeguards
Data Protection in NZ • Freedom of Information legislation (1982/ 1987) • Information based • Individual access to data held in public sector • Role of Ombudsman
Privacy Act 1993 • Public and Private sector “agencies” • Areas excluded: personal affairs, legislature, judiciary, news media • All “personal information” covered • One stop shop: access to ALL personal information and remedies for misuse • Reduction in compliance costs (multiple agencies/ different rules)
Privacy Act 1993 • Flexibility: codes of practice (Commissioner) • Examples: Health Information Privacy Code, Credit Reporting Privacy Code • More / less stringent than IPPs
Privacy Act 1993 • IPPs contain exceptions: law enforcement, legal proceedings, health and safety, statistical / research • Access can be denied: e.g. privacy of another individual, evaluative material and promise of confidentiality • Public registers subject to separate public register principles
Dispute Resolution Process • Avoids courts • Privacy Commissioner • Inquisitorial and conciliatory role • Powers • Settlement is priority • 1993 – 2006: 81 per cent of complaints settled • Most settled before finding by PC • 4 per cent of complaints ruled to have substance / privacy interference
Dispute Resolution Process • PC has discretion to refer to Director of Human Rights Proceedings (DHRP) • 47 referrals vs. 173 taken by complainant • 42 % resulted in favourable ruling by Tribunal • 11 substantive appeals to the courts • Tribunal reversed in 3 • 1 appeal to the Court of Appeal
Litigation in New Zealand • Social context: non- litigious culture • Example: No-fault accident compensation maximum lump sum = $100,000 • $40,000 highest privacy award to date • Defamation / libel special case
Litigation in New Zealand • Tribunal composition • Role of chairperson • Role of PC • “Substantial merits” without regards to technicalities • Evidentiary difficulties: link with interpretation
Litigation in New Zealand Proceedings can be brought if: • Referral by PC and DHRP • Plaintiff where PC / DHRP does not • Need for prior investigation by PC • Average < 10 Tribunal cases per year • 140 cases : 81 substantive decisions included
The Defendants • Statutory definition of private / public sector
The Defendants • 62 per cent = public sector defendants • 6 public sector organisations account for 43 % of total cases • 41 per cent = private sector • (some cases counted as both private and public as more than 1 defendant)
The Defendants • Of private sector 39 per cent = health sector • 25 % of total cases = non-health private sector (commercial and not-for-profit orgs) • These orgs include: banks, insurance companies, individuals, funeral directors and clubs
Areas Litigated • IPPs and Code Rules • Multiple IPPs per case • Overseas comparison
Remedies NB: More than one remedy common
Remedies Remedies awarded to successful plaintiffs (42% of all claims): Damages (21 cases) Costs (7 cases) Range $200 - $40,000 Range $121.33 - $1,338 Mean $7,449.80 Mean $711.28 Median $4,000 Median $500 Unsuccessful Plaintiff Pay Costs of Defendant (10 cases) Range $500 - $12,500 Mean $4,401.99 Median $2,750
Representation • Non-legal representation allowed • Risks of non-legal representation • Representation did not affect success
Representation Comparison of Remedies for Plaintiffs With and Without Representation Damages: With (7) Without (14) Range $200 - $40,000 $500 -$20,000 Mean $12,885.71 $3,303.27 Median $10,000 $3,000 Costs: With (2) Without (5) Range $500- $1,338 $121.33 - $1,269.64 Mean $919 $628.20 Median $919 $500
Representation Comparison of Outcomes for Plaintiffs With and Without Representation Unsuccessful Plaintiff Pays Costs of Defendant: With (4) Without (6) Range $1,529.86- $12,500 $500 - $10,000 Mean $5,007.50 $3,998.30 Median $3,000 $2,750
Significant Cases • Most non-technical and pragmatic • Early cases re: scope of Act and exclusions • Influence of legal principle • Evidentiary difficulties
Significant Cases • High Court appeals • Limitations • Hamilton vs. The Deanery 2000 Ltd • Proceedings Commissioner vs. Harder
Conclusions • Advantages of NZ approach • Conciliation vs. Litigation • Litigation rare: success rate low • Most suits against public sector • Low rate of representation, and representation non-legal • Areas most litigated: Denial of access to and improper disclosure of personal information
Tribunal and Court’s Contribution • Interpretation • Unduly legalistic? • Modest damage awards • Day in court