Kia ora koutou,

I would like to focus this week's Notes from the APAC Region on warmly welcoming New Zealand's new Privacy Commissioner Michael Webster, to our small and passionate privacy community. 

Webster commenced as commissioner on 5 July, taking the baton from Deputy Privacy Commissioner Liz MacPherson. He came to the role from the Department of Prime Minister and Cabinet, where he was Secretary of Cabinet and Clerk of the Executive Council for eight years. There's some precedent for this move — NZ's second Privacy Commissioner, Dame Marie Shroff, was also a previous Cabinet Secretary. This is certainly not a bad thing. Both Webster and Shroff have a clear history of, and devotion to, public service. For Webster, this has manifested in a focus on enabling and driving good governance, the promotion of democratic rights and values, and ensuring compliance with statutory provisions and constitutional conventions. This focus seems a good fit for our new privacy watchdog. 

On 28 July, the Office of the Privacy Commissioner hosted a fireside chat with the new privacy commissioner to discuss his perspectives and priorities. Three weeks into the job, this was a timely opportunity for the privacy community to get a measure on the new commissioner. He was candid and direct and, in my view, has clearly come into the role with his eyes wide open. Despite no direct background in privacy and, as one participant noted, no law degree, Webster was well-informed, well-read and had plainly put significant effort into understanding his new jurisdiction. A few key things stood out to me in particular:

• Commissioner Webster intends wisely to take time to set his vision and priorities, he offered a few initial views on the direction of privacy under his watch:
  • Privacy should be valued by everyone in an agency, not just the privacy officer. 
  • Privacy should be business as usual for agencies, a core value for public and private sector agencies, not an add-on compliance issue.
  • Privacy needs to be considered at the senior leadership level, with tone from the top a key driver of better privacy culture.
  • Personal information is taonga, and there is a sense of energy in the OPC to continue the important journey to fully understand and address the place of te ao Māori in our privacy framework. 

• He places great importance on what he terms the "privacy ecosystem." The OPC, policymakers, public and private sector agencies, individuals, NGOs, community and industry advocacy groups, iwi and other Māori organizations, privacy advisors, other regulators and Parliament, all have a role to play in ensuring good privacy outcomes. Michael intends to engage with and better leverage this ecosystem, with a greater focus on one-to-many rather than one-to-one, deploying resources for the greatest impact.

• Webster gave a clear signal that he would use the enforcement tools available to him, giving the recent rental sector review as a good example of effective enforcement action. Like his predecessor, however, he was careful to demonstrate that he would consider the spectrum of powers in the Privacy Act and use them appropriately. 

• Digital innovation and data transformation will deliver significant advantages to public and privacy sector agencies and to individuals. However, he takes the view that these should be managed ethically and with care. Agencies can do these things but should always ask whether they should. 

• He wants to see how big tech will demonstrate compliance with the Privacy Act, especially in relation to the collection and use of personal information about children and young people. He will be looking beyond words to practice. 

• When reminded that he is not a lawyer, Webster was unfazed. Returning to this concept of the privacy ecosystem, the new commissioner noted he is surrounded by experts — both within the OPC and out in the privacy profession. He intends to get out and meet stakeholders in the coming weeks and months, and I would encourage people to take him up on this offer to engage.

So Commissioner Webster — nau mai, haere mai. I, for one, am thrilled with your appointment and looking forward to working with you as you engage with our strong and committed privacy ecosystem. 

I am also thrilled to announce that we have confirmed the new commissioner as one of our keynote speakers at the upcoming IAPP ANZ Summit in November. He will join other excellent NZ thought leaders, including keynote Dan Te Whenua Walker, Microsoft's Chair of Indigenous. In what we hope will be a recurring summit topic on Considering Indigenous Privacy Perspectives, Megan Tapsell, Chair of the AI Forum NZ, will moderate an expert panel discussion on NZ's work to better address Māori privacy and data perspectives. This is shaping up to be one of our best summits yet, so make sure you take advantage of the early bird rate, which closes 5 Aug., and save your spot in Sydney. 

Finally, be sure to register for NZ's next KnowledgeNet event, taking place in person in Auckland and virtually on 24 Aug. We will hear from a panel of experts — including Consumer NZ CEO Jon Duffy — on the upcoming consumer data right. Registration for this event will be sent out shortly, and I look forward to seeing some of you there.

In the meantime, stay safe, be kind, and enjoy the digest.

Ngā mihi,

Daimhin