Kia ora koutou,
Happy new year from Aotearoa New Zealand. It feels good to have 2021 behind us and, while last year was fairly eventful, 2022 looks to be even more so.
To help us plan the year ahead, the IAPP released its 2022 Global Legislative Predictions. To summarize my contribution for NZ, 2022 will be an exciting year of developments that will complement our reformed Privacy Act 2020, helping us regain our position at the forefront of future-proofed privacy regulation, but also signaling the emergence of an Aotearoa New Zealand approach to privacy that reflects our unique bicultural foundation. Developments will include the introduction to Parliament of a bill implementing a new consumer data right — NZ’s version of the data portability right — increased efforts by the privacy commissioner and government agencies to take into account cultural perspectives (particularly Māori perspectives) on privacy when exercising their functions, and the appointment of a new privacy commissioner.
Pulling many of these developments together, the NZ Government chief privacy officer recently released a new Privacy Maturity Assessment Framework for agencies to use to conduct their privacy self-assessments. These self-assessments enable agencies to focus on how to grow their privacy capability and maturity by reflecting on how they think about and manage the personal information they are entrusted with. To achieve this, the PMAF focuses on:
- Establishing privacy as a core part of high-quality service delivery based on values of respect, trust and transparency.
- Including values, behaviors and practices that encourage a people-centered approach to privacy to complement established risk-informed practices.
- Integrating other good practice advice aimed at making it easier to understand what "doing the right thing" looks like, such as the Data Protection and Use Policy, and aligning with complementary domains such as information security and information management.
- Encouraging an approach that clearly links the personal information collected to the desired outcomes.
- Partnering with Māori to understand and respond to their interests in the collection and use of personal information about Māori, and to provide for such information to be interpreted with reference to Māori priorities, values and worldviews.
The development of this exciting and forward-thinking framework was funded in part from an iappANZ legacy grant. While developed for the public sector, the GCPO anticipates that private sector agencies could also benefit from the framework, using both the PMAF and the underlying DPUP to better align privacy with a broader focus on service delivery, customer experience, and the wellbeing of people and communities. I agree, and in my view, the five DPUP principles which underpin the framework perfectly demonstrate a burgeoning Aotearoa New Zealand privacy approach that we can all learn from:
- He Tāngata — Focus on improving people’s lives — individuals, children and young people, whānau, iwi and communities.
- Manaakitanga — Respect and uphold the mana and dignity of the people, whānua, communities or groups who share their data and information.
- Mana Whakahaere — Empower people by giving them choice and enabling their access to, and use of, their data and information.
- Kaitiakitanga — Act as a steward in a way people understand and trust.
- Mahitahitanga — Work as equals to create and share valuable knowledge.
We hope to host an event with the GCPO this year, so they can explain the new framework to our members in more detail. In the meantime, our Auckland and Wellington KnowledgeNet Chapter Chairs have begun the process of developing a joint program of events for IAPP members for 2022. In light of continuing COVID-19 uncertainty in the coming months, KnowledgeNet events will be virtual at least for the first half of this year. While we will miss the opportunity to meet in person, this has the upside of allowing us to share content across NZ and the broader APAC region. The first event for the year will be announced soon.
Stay safe and well.
Ngā mihi nui,