Editor's note: The IAPP is policy neutral. We publish contributed opinion and analysis pieces to enable our members to hear a broad spectrum of views in our domains.
Privacy Week 2025 in Aotearoa New Zealand is now done and dusted. It was a great week that included an incredible program of webinars hosted by the Office of the Privacy Commissioner.
Keeping with tradition, IAPP members had the pleasure of hearing from Privacy Commissioner Michael Webster at a 13 May Auckland KnowledgeNet event. In a keynote address, Webster generously shared his reflections on the state of privacy in Aotearoa, outlined the OPC's key areas of focus for the next year and gave his perspective on areas of emerging privacy risk.
Webster notably featured statistics in his keynote, telling us quite a bit about the state of privacy in Aotearoa. In the last financial year, the OPC responded to over 6,000 privacy inquiries (over 100 a week) from members of the public, received over 1,000 privacy complaints — a 15% increase on the previous year — and received over 800 privacy breach reports (of which over 400 were serious).
Interestingly, while human error was the primary cause of privacy breaches in previous years, Webster noted the majority of serious breaches over the past year were caused by intentional or malicious activity, including employee browsing.
The OPC's 2025 privacy survey Research on Privacy Concerns and Use of Personal Information found that 82% of New Zealanders want more control and choice over the collection and use of their information; 67% would consider changing service providers due to poor privacy practices; 67% are concerned about the privacy of children; 77% think the OPC should have the power to issue large fines for serious privacy breaches; and 62% are concerned about government or business use of artificial intelligence to make decisions.
Webster suggested the survey results might prompt privacy professionals to ask how organizations can improve to address these concerns and what smart privacy regulation might look like in 10 years' time.
On the topic of smart regulation, Webster remains concerned about the state of New Zealand's Privacy Act 2020, noting it runs the risk of "losing alignment with like-minded countries," missing key obligations, rights and powers that are being implemented overseas to address new technologies. He said he will continue to advocate for modernization of the Privacy Act; we already know his views on the need for meaningful financial penalties — something the privacy survey shows the public strongly supports.
The survey also reinforced the importance of seeking and listening to a te ao Māori perspective on privacy. While 47% of New Zealanders are concerned about privacy, this figure rose to 53% for Māori. A staggering 79% of Māori respondents revealed that protecting personal information is a major concern, compared with 66% overall.
The figures were similarly higher for Māori respondents in relation to the use of facial recognition technology. The OPC has recently established a Māori Reference Panel to better understand and address the te ao Māori perspective.
The OPC will be advancing several significant initiatives over the coming year, including its inquiry into the use of facial recognition technology by Foodstuffs North Island, the development of the Biometrics Processing Privacy Code, guidance on the upcoming indirect notification obligation — known as Information Privacy Principle 3A — playing its part in the implementation of the Customer and Product Data Act and investigating referrals received from the Public Service Commission related to data misuse allegations at Manurewa Marae.
All these initiatives align with the OPC's three key areas of strategic focus for the year to come. First, it will provide guidance to support the implementation of legislative and regulatory privacy initiatives. Second, it will engage with organizations to build their privacy capability and empower New Zealanders to assert their privacy rights. Third, it will focus its activities on the technological and digital innovations being adopted by organizations, including the use of AI tools.
Returning to the "Privacy on Purpose" theme, Webster closed with a call for privacy professionals to re-frame the language of privacy, breaking the false dichotomy narrative. "In the language we use, in the way that privacy officers explain things, in addressing complex public policy problems, in developing new business strategies, we need to own and communicate that making privacy part of the discourse is not an either/or. It's an 'and' or a 'while.' It's doing privacy well," he said.
Let's all head into the next year with that call to action front of mind.
Daimhin Warner, CIPP/E, is the country leader, New Zealand, for the IAPP.
This article originally appeared in the Asia-Pacific Dashboard Digest, a free weekly IAPP newsletter. Subscriptions to this and other IAPP newsletters can be found here.
