Welcome to 2023’s privacy and cybersecurity wrap-up. We are kicking off on a tour of the most recent legal developments – and exploring whether our predictions from last year came to fruition. Our journey will start at home with a summary of New Zealand’s latest advancements. Next, we’ll jump across the ditch and see how the Aussies have dealt with similar privacy and cybersecurity challenges. We’ll conclude our time together by considering the global response to AI regulation. So, sit back, relax, and enjoy the ride! 

Changes in the New Zealand privacy world

Our not-so-new-anymore Privacy Commissioner, Mr. Michael Webster had a productive 2023, particularly by introducing plans to legislate different aspects of privacy law in New Zealand. Consequently, it has been a prolific year for our privacy insights! We wrapped up Privacy Week 2023, which the Commissioner organises each year to promote privacy awareness, inform people of their rights under the Privacy Act, and help educate agencies about their responsibilities. We covered the consumer data revolution on the horizon, on which the Commissioner encouraged submissions. We followed the Commissioner’s insights on how to think about the consequences of using generative AI technologies and talked about how to ensure the AI dream does not become your biggest nightmare. We reported on the privacy amendment bill introducing a new information privacy principle 3A setting out disclosure requirements when personal information is collected indirectly (which the Commissioner supported). To top off a busy year we, along with the Commissioner, embarked on the next chapter of regulation biometrics in Aotearoa.

Enforcement action

Enforcement activity on both sides of the ditch is increasing, thanks to the many high-profile cyber incidents affecting New Zealand and Australia. Across the pond, Australia has chosen a formal approach to regulation. The Australian Government officially agreed to rejig the legislative framework of their Privacy Act 1988. The Attorney-General, Mark Dreyfus, agreed to 38 of the Department’s 116 recommended changes – agreeing to a further 68 in principle. Attention small business owners: this may impact you too. A key change, agreed to in principle, will remove the exemption on businesses generating less than AU$3 million in annual revenue from needing to comply with the Privacy Act. In 2024, we will get to see how the Australian Government finalises these details and whether it influences any change to our own privacy legislation.

Cyber incidents

Businesses have continued to be out-smarted by a growing string of cyber-attacks. NZ$14.7 million was lost in cyber incidents during the first three quarters of 2023. In March, we provided our tips on how to respond to a data breach. If you’re in the mood to listen rather than read, in September we produced an episode of our podcast Hold That Thought talking about how to respond to privacy breaches. Looking at the list of victims this year, Auckland Transport AT suffered a bombardment of web bots from ransomware group ‘Medusa.’ Another ransomware attack struck Smartpay Holdings in June. Customer information was stolen from some of their systems. Finally, and we’ve left the biggest to last, Latitude Finance fell victim to one of Australia and New Zealand’s largest known data breaches. The breach resulted in 7.9 million Australian and New Zealand drivers’ licenses and 53,000 passport numbers being stolen. The OPC has now started an investigation into the breach. 

Both New Zealand and Australia are responding. The New Zealand Government plans to merge our Computer Emergency Response Team and the National Cyber Security Centre to create a super-cybersecurity agency dealing with national matters. While integration will continue for several years, the change will streamline New Zealand’s response to cybersecurity threats. In Australia, the Government has now released their ‘cyber strategy’ focusing on growing Australia as a role model for global cybersecurity.

New Zealand may have some competition with its response strategy – because by 2023, Australia wants to lead the world as the nation with the strongest cybersecurity strategy. Watch this space!

Privacy Amendment Bill

Last year, we predicted that changes to the Privacy Act 2020 were afoot. Spoiler alert: we were right. The Ministry of Justice introduced a Privacy Amendment Bill in September. If passed, this bill would increase disclosure requirements for agencies that collect personal information. In line with certain international standards, agencies may soon have to notify individuals whom they indirectly collect personal information from as well. 

At the time, we shared our concerns that these changes may not significantly advance the privacy rights of individuals in practice and that the administrative burdens may outweigh any realistic benefits. However, progress is still progress. Particularly where those changes harmonise our privacy laws with other key jurisdictions - which will help us maintain our EU adequacy status in compliance with the GDPR. 

Biometrics

In November 2023, the OPC announced it was developing a Biometrics Privacy Code Exposure Draft. In our recent article, we noted that the OPC intends to refresh existing requirements for organisations collecting biometric information (for example, facial recognition technology, retinal scans and voice recognition). In early 2024, the OPC plans to release an exposure draft of the code. You can share your opinion on the draft once it is released.

The OPC has also voiced its opinion on the privacy risks of CCTV cameras in school bathrooms. For school Boards of Trustees, the OPC recommends conducting a Privacy Impact Assessment to identify the risks of CCTV data collection in bathrooms – and whether less intrusive measures will achieve similar results. 

Children and Young People's Privacy Project

Consultation has recently closed for the OPC’s Children and Young People’s Privacy Project. The project is intended to highlight the unique challenges faced by children and young people in a digital world. Early next year, the OPC will ask for another round of public engagement. In particular, the OPC wants to hear from tamariki/children and rangatahi/young people.

Consumer data rights

Earlier this year, the Ministry of Business, Innovation & Employment sought submissions on a proposed Customer and Product Data Bill. The draft law proposed the creation of ‘consumer data rights’ (CDR). Our view is that you can use your CDR to request what information data organisations keep about you to understand and maximise the efficiency of your living habits. As a business, you could also use consumer data to better understand customer wants and needs. 

EU-US Data Privacy Framework

Watch out, Max Schrems is back! As we discussed earlier this year, the European Commission adopted a revised EU-US Data Privacy Framework in July. The European Commission’s ‘adequacy decision’ accepts how the United States currently protects personal data for the purposes of the European Union’s GDPR. However, Schrems said he will be back in 2024 to challenge the latest version of this privacy framework.

The Future of global AI regulation

In September, the OPC provided guidance for all New Zealanders on how the Information Privacy Principles at the core of the Privacy Act 2020 apply when using AI to collect personal information. The OPC’s advice focuses on meaningful, but not difficult, changes everyone can make to the way they use AI.

In October 2020, our colleagues across the ditch wrote about Australia’s approach to the relationship between AI and intellectual property. Their conclusion was that the patentability of AI-created innovations is unlikely in Australia. While we watch this space, New Zealand businesses should take heed and start protecting AI-generated work with contractual and technical defences.

For the rest of the world, the race is on for global AI regulation. In early December, the European Union (EU) confirmed their decision to draft a provisional AI Act. It will be the first AI Act we have seen. The Act will create a risk-based framework of stricter rules, and harsher penalties, where threats associated with AI are high. If the draft is accepted, the AI Act may come into effect as early as 2025. 

In the scramble to manage AI, other countries have similar plans in the developmental stages. In April, our colleagues in Canada released a Dentons Global article explaining their plans for an AI Data Act. Israel is choosing a similar path, releasing its draft policy on AI use. China and Brazil are also exploring this approach. However, the UK has taken a different turn. In dubbing their stance as a ‘pro-innovation approach to AI regulation,’ the UK Government intends to remove any present barriers to innovation while managing the risks of AI use. 

Other countries have also started to release specific guidance on AI use – particularly for businesses. In October, the United States White House released a fact sheet on how to safely use AI. President Biden’s advice focuses on his desire to protect the privacy of all Americans by increasing transparency requirements.

Could court judges be replaced with AI? Unlikely. But this month, the Courts of New Zealand released specific guidelines for the use of AI in courts and tribunals. The guidelines set out seven key concerns for using AI in the legal world. Particular concerns surround confidentiality, ethical issues and accuracy. While the focus is on concerns, the guidelines do indicate that AI can also be a useful tool – provided it used with care and caution.

Next year, the United Nations Office of the Secretary-General’s Envoy on Technology will release a final report on the global significance of AI. We also expect several countries to release their draft codes of conduct on how they intend to regulate AI. 

Although New Zealand is certainly not aiming for the front of this race, we have the benefit of seeing what works and what doesn’t for global powers that have already taken steps towards regulating AI. Who knows, maybe this time next year, New Zealand will have taken substantive steps far beyond issuing a guidance document linking AI to our Information Privacy Principles!

We can confirm a human definitely wrote this insight.

Our year ahead in privacy article suggested you might have had an AI tour guide this year. Although this was not the case, privacy and cybersecurity will continue developing. We are expecting to see even more changes as regulatory bodies attempt to keep up with technological developments. While that brings us to the end of today’s tour, join us in 2024 to explore what happens next!

If you have any questions or are interested in finding out more about privacy 2023 – and how it may be shaped in 2024, please get in touch with our privacy experts Campbell Featherstone, Hayley Miller, Hayden Wilson, Gunes Haksever or Ashleigh Ooi.

This article was written by Emily Barea, a summer clerk, Lavi Abitbol, a solicitor and Gunes Haksever, a senior associate in our commercial, technology and privacy team.