Kia ora koutou,
In a previous APAC Digest intro way back in June 2019, I lamented that our new Privacy Act had many shortcomings when compared to other privacy laws, such as the EU General Data Protection Regulation. One of these shortcomings was the lack of any right to data portability. At the time, I reported the New Zealand Justice Minister anticipated "a need for ongoing review and incremental reform given the rate of technological change and continual evolution of international privacy standards." It is pleasing now to report the government has progressed the right to data portability, now called the "consumer data right."
The right to data portability is viewed as critical in the digital age. It complements access rights by protecting individuals from being locked into a service by virtue of the amount of personal information it holds about them. Of course, this concept of "lock-in" has broader implications for consumer rights and competition. Enter the NZ Ministry of Business, Innovation and Employment. MBIE took charge of data portability in August 2020 when it released a discussion document seeking views on a new consumer data right.
Fast forward almost 12 months (good things take time). On 5 July, the government announced it decided to implement a new legislative framework for a consumer data right, noting "consumers should be in the driver's seat when it comes to how their personal information is used by third parties." The consumer data right describes a mechanism for consumers to securely share their personal information with trusted third parties, including other similar service providers or separate entities such as financial technology. As with other data portability rights, the consumer data right requires information be shared in a machine-readable format.
MBIE announced NZ's consumer data right will be rolled out on a sector-by-sector basis, similar to the approach taken in Australia, with the government designating individual markets, industries and sectors to which it applies. The banking sector is likely to be the first cab off the rank. The primary legislation will create an overarching framework for the right, including basic obligations that will apply to designated sectors. The types of personal information in scope for the right will be specified in each sector designation, with more detailed obligations set out in sector rules and data standards. The framework will also include a requirement for third-party data recipients to be accredited to ensure privacy and security standards are maintained.
A bill implementing the consumer data right will be introduced to Parliament in 2022. This commitment to the new consumer data right is an encouraging step in the process of remediating deficiencies in the new Privacy Act 2020 and ensuring NZ regains its position at the forefront of future-proofed privacy regulation. We remain hopeful other deficiencies, including a punitive fines regime and regulation of automated decision-making, are not forgotten.
Enjoy the digest.
Ngā mihi nui