Privacy Act reform

Complaints system reform

The Law Commission has noted that while the complaints system is generally working well there are measures that could be incorporated to improve the efficiency and effectiveness of the system.

Proposed measures include removing the legal test of "interference of privacy" and replacing it with a simple breach of the Act. As it stands there may be cases with merit which are not getting through this filter. 

It’s also proposed that the Privacy Commissioner be given power to determine complaints under principle 6 (access to personal information), with the Tribunal of Human Rights as an appeal body; and that the role of Director be removed.

We support any change that will streamline the complaints procedure and promote easy access for an individual to make a complaint and seek redress.

Enforcement

The current system is geared towards individual dispute resolution. It’s a reactive system, relying on the complaints process to enforce compliance with the principles. It’s effective for individual settlement but doesn’t address issues within a particular organisation or wider industry practice.

The Law Commission has proposed several reform options that would allow the Privacy Commissioner to take more proactive steps to ensure compliance within an organisation or wider industry.

Two key proposals were submitted:

Compulsory audits
A provisional proposal that the Privacy Commissioner be given mandatory audit powers. This would allow the Commissioner to be more proactive in promoting compliance with the Act rather than relying on the complaints process. It would also provide an incentive for agencies to maintain compliance. Priority would be given to areas such as the public sector, credit reporting and health information systems.

Enforcement notices
The Law Commission proposed allowing the Commissioner to issue binding enforcement notices. The Commissioner would identify a breach of the Act and then require the agency to comply. 

In 1997 we suggested the Privacy Commissioner should have the power to make binding orders. We stand by this recommendation. We strongly support the proposal to grant compulsory audits and give more enforcement power to the Privacy Commissioner.