Submission to the Justice Committee on the Privacy Bill Bill 34-1, 2018 - Andrew Ecclestone 31 May 2018 - NZ Parliament

Page created by Edward Castillo
 
CONTINUE READING
Submission to the Justice Committee on the Privacy Bill Bill 34-1, 2018 - Andrew Ecclestone 31 May 2018 - NZ Parliament
Submission to the Justice Committee
on the Privacy Bill

Bill 34-1, 2018

Andrew Ecclestone
31 May 2018
Submission to the Justice Committee on the Privacy Bill Bill 34-1, 2018 - Andrew Ecclestone 31 May 2018 - NZ Parliament
Privacy Bill Submission                                             Andrew Ecclestone

Submission to the Justice Committee on the Privacy Bill 2018

About the submitter
Andrew Ecclestone is a former Senior Investigator Official Information Practice
Investigations in the Office of the Ombudsman. He has also worked for the State
Services Commission, and the UK Department for Constitutional Affairs.

Oral submission
I wish to appear before the Committee. My contact details are included in the
covering letter to the Committee.

About this submission
This submission focuses on one issue: giving effect to the Law Commission’s
recommendation that the Ombudsmen be made an ‘agency’ subject to the Privacy
Act.

                                                                                Page 1
Privacy Bill Submission                                                                Andrew Ecclestone

Overall support for the Privacy Bill

1.      In general, I support the Privacy Bill. It is a long overdue update to New
        Zealand’s legal framework for protecting and managing personal information.

Defining the Ombudsman as an ‘agency’ subject to the Privacy Act

2.      Clause 6 of the Privacy Bill is the Interpretation clause, which defines various
        terms used in the Bill. One of the key terms to be defined is ‘agency’.

3.      The definition of ‘agency’ has two parts. Paragraph (a) specifies what is
        included in the definition, and is broad:

             means any person or body of persons, whether corporate or
             unincorporate, and whether in the public sector or the private
             sector and, to avoid doubt, includes a department;1

4.      Paragraph (b) specifies a limited list of roles and organisations that are then
        excluded from the definition of ‘agency’. The legal effect of this exclusion is
        that they are not required to comply with the ‘privacy principles’ defined in
        clause 19 of the Bill.

5.      The practical effect of the exclusion is that people will have no rights under the
        Privacy Act to access or correct information about themselves, or ensure it is
        being gathered, stored and managed in accordance with the privacy principles.

6.      Privacy is a human right to be enjoyed by all natural persons.2 As such – and as
        the Law Commission pointed out – ‘Provisions that limit the application of the
        privacy principles in various ways are consistent with international human rights

1
     ‘Department’ is defined in clause 6 as ‘a government department named in Part 1 of Schedule 1 of
     the Ombudsmen Act 1975’.
2
     Article 3 of the Universal Declaration of Human Rights (‘security of the person’) and Article 17 of
     the International Covenant on Civil and Political Rights.

                                                                                                   Page 2
Privacy Bill Submission                                                           Andrew Ecclestone

        and privacy instruments, so long as the limitations are authorised and
        specified in law, are reasonable and are as few as possible.’3

7.      In August 2011, the Law Commission published Report 123, on stage 4 of its
        review of the law of privacy in New Zealand. It considered the exclusion of
        various entities from the definition of ‘agency’ in Chapter 4 of the report.

8.      In paragraphs 4.20-4.24 of the report, the Commission considered whether or
        not the Ombudsmen should be removed from the list of entities listed in
        paragraph (b) of the definition of ‘agency’, thereby making the Ombudsmen
        subject to the Privacy Act.

9.      Recommendation 37 of the Law Commission was ‘The Ombudsmen should
        be deleted from the list of entities excluded from the definition of
        “agency”.’ 4

10. This recommendation has not been accepted by the previous or current
        government, although it is unclear how much attention has been paid to this
        particular issue by the current government, having inherited a Privacy Bill
        largely drafted in accordance with decisions made by the previous
        administration.

11. The Ministry of Justice’s listing of the Law Commission’s recommendations,
        and the action proposed to be taken under the previous government has been
        published online.5

3
     Paragraph 4.1 (emphasis added), Review of the Privacy Act 1993, Law Commission report 123,
     Wellington, August 2011. Accessed from http://lawcom.govt.nz/our-projects/privacy
4
     Paragraph 4.24, Review of the Privacy Act 1993, Law Commission report 123, Wellington, August
     2011. Accessed from http://lawcom.govt.nz/our-projects/privacy
5
     Appendix One to the Cabinet Paper: Reforming the Privacy Act 1993, published on the Ministry of
     Justice website at: https://www.justice.govt.nz/assets/Documents/Publications/appendix-one-to-
     cabinet-paper-reforming-the-privacy-act-1993.pdf

                                                                                              Page 3
Privacy Bill Submission                                                          Andrew Ecclestone

12. This states, in relation to Recommendation 37, that:

             Modified proposal is to amend the Ombudsmen Act so that
             information on how the Ombudsmen deal with personal information
             must be included in their annual report.

13. In other words, the Ministry of Justice decided to recommend that the
       Government reject the Law Commission’s recommendation on this point, and
       the previous and current Ministers of Justice have either overlooked the issue,
       or agreed with the Ministry’s suggested course of action.

14. The lack of clarity on Ministers’ views on this is apparent from the silence on
       the topic in the information I received in response to an Official Information Act
       (OIA) request to the Ministry of Justice for the information it held on this
       matter.6

15. The key document disclosed by the Ministry in its response is a short note
       signed off in November 2012, and attached to this submission as Annex A.

16. The note states that the officials, ‘agree that there needs to be a good reason
       for the principles not to apply to agencies.’ However, it then simply repeats the
       Ombudsmen’s objections to being included in the list of agencies to which the
       privacy principles apply. In spite of the Law Commission having considered
       and rejected these objections, the note states ‘We consider that these
       arguments are persuasive’.

17. The Ministry lists the three factors for rejecting the Privacy Commissioner’s
       recommendation that the Ombudsmen be made subject to the Privacy Act.
       These are outlined in paragraph 4.20 of the Law Commission report:

         •    The Ombudsmen are the “last line” check on the exercise of
              executive power, and should not be subject to investigation by an
              agency such as the Privacy Commissioner that is itself subject to
              the Ombudsmen’s jurisdiction.

6
    Exclusion of the Ombudsmen from scope of the Privacy Bill, available online here:
    https://fyi.org.nz/request/7805-exclusion-of-the-ombudsman-from-scope-of-the-privacy-bill

                                                                                            Page 4
Privacy Bill Submission                                                  Andrew Ecclestone

        •    The Ombudsmen Act already contains sufficient protections with
             respect to the handling of personal information.

        •    Providing for principle 6 access rights in respect of personal
             information at the margins of the Ombudsmen’s secrecy
             requirements could impede the Ombudsmen’s ability to carry out
             their statutory functions of resolving complaints in a thorough and
             timely manner.

18. The Law Commission rejected the first argument in paragraph 4.21 of its
     report, stating ‘We do not think that there is anything unusual or problematic in
     making one complaints body subject to investigation by another.’ It cited the
     fact that the Privacy Commissioner is subject to the Ombudsmen under the
     Ombudsmen Act and OIA.

19. The Ministry’s note states that it considers the Ombudsmen’s first point to be
     ‘particularly’ persuasive, but does not deal with the Law Commission’s rebuttal
     of that argument. If the Government were to follow the Ministry’s and
     Ombudsmen’s logic to its natural conclusion, it would in effect be saying that
     the Ombudsmen should be exempted from the Public Records Act 2005,
     health and safety, and employment laws, because the various investigation and
     oversight bodies for those laws fall within the Ombudsmen’s jurisdiction. Is the
     Government and Ministry seriously suggesting that this should be the case,
     and that the Ombudsmen should not have to keep good records, or that the
     staff of the Ombudsmen are not entitled to protection for their health and
     safety, or to trade union representation under the Employment Relations Act
     2000? If not, their argument falls, and the Justice Committee should remove
     the Ombudsmen from paragraph (b) of the definition of ‘agency’.

20. The Law Commission also rejected the second argument advanced by the
     Ombudsmen and accepted by Ministry officials. In paragraph 4.22 the
     Commission stated,

            On the second of the Ombudsmen’s points, we consider that the
            existing provisions in the Ombudsmen Act do not cover all the
            ground in the Privacy Act. The Ombudsmen’s secrecy provisions
            do not, for example, deal with matters such as collection and

                                                                                   Page 5
Privacy Bill Submission                                                      Andrew Ecclestone

           retention of personal information that are covered by the privacy
           principles.

21. The Ministry’s note states ‘We are also not convinced that there is an actual
      problem with the way Ombudsmen handle personal information now justifying
      change.’ There are three problems with this statement.

22. First, there is absolutely no evidence that the Ministry sought to gather any
      evidence about the Ombudsmen’s practices with regard to handling personal
      information. They certainly did not ask the public for their experiences of
      seeking to obtain or correct their personal information from the Ombudsmen,
      so presumably the Ministry officials were operating on the basis of ‘no news is
      good news’. Alternatively, they simply relied upon an assurance from the
      Ombudsmen that there were no problems, which is hardly an independent test
      of a claim. It is questionable whether the Ministry even did this, since in its
      supplementary OIA response to me (Annex B to this submission), the Ministry
      stated that it held no information from the Ombudsmen about
      recommendation 37.7

23. Second, if the Ombudsmen are excluded from the definition of ‘agency’, a
      person complaining to the Privacy Commissioner about the Ombudsmen’s
      response to their request for access to their personal information will be told
      that the Ombudsmen is not subject to the Privacy Commissioner’s jurisdiction.
      Leaving the Ombudsmen as arbiter of any complaint about how they
      themselves have responded to a request about the handling of personal
      information is clearly contrary to normal principles of natural justice.

24. Third, and more fundamentally, the Ministry’s argument that it is unconvinced
      there is a problem at present is completely beside the point. As the Law
      Commission noted, and the Ministry ostensibly accepted, since privacy is a
      human right, any departure from the principle that the Privacy Act should apply

7
    Supplementary response to my OIA request, dated 30 May 2018, attached as Annex B or
    accessible here:
    https://fyi.org.nz/request/7805/response/25612/attach/4/20180530%20Supplementary%20letter.
    pdf

                                                                                        Page 6
Privacy Bill Submission                                                        Andrew Ecclestone

     as widely as possible must have a strong reason. Or as the Ministry’s own note
     states:

           All organisations should be subject to the Act unless there is a
           good reason to the contrary. Other Parliamentary Officers are
           subject to the Act as are the Courts. The Law Commission could
           not see any good reasons to exclude the Ombudsmen.

25. The Law Commission rejected the Ombudsmen’s third argument for not being
     made subject to the Privacy Act in paragraph 4.23 of its report, stating:

           With regard to the possible impact of principle 6 access rights on
           the Ombudsmen’s exercise of their statutory functions, we think
           that sufficient protection for the Ombudsmen’s complaints-
           resolution functions is provided by the combination of the secrecy
           obligation in the Ombudsmen Act (which would override the
           Privacy Act by virtue of section 7) and section 55(d) of the Privacy
           Act, which provides that nothing in principles 6 and 7 applies in
           respect of:
                information contained in any correspondence or communication that has
                taken place between the office of the Ombudsmen and any agency and
                that relates to any investigation conducted by an Ombudsman under the
                Ombudsmen Act 1975 or the Official Information Act 1982 or the Local
                Government Official Information and Meetings Act 1987, other than
                information that came into existence before the commencement of that
                investigation.

26. The Ministry’s note makes no attempt to rebut the Law Commission’s
     argument on this point, tacitly accepting the Ombudsmen’s claim about the
     impact on its workload of having to deal with people requesting information
     from it.

27. This is a weak argument, as I am sure members of the Justice Committee will
     easily see, since every other organisation defined as an ‘agency’ under the
     Privacy Act could make a claim about not needing to respect people’s rights
     under the Act because of the work it creates for them.

                                                                                         Page 7
Privacy Bill Submission                                                             Andrew Ecclestone

28. Ironically, it is an argument that has been undermined by the Ombudsmen
       themselves in their submission to the Law Commission’s 2009-12 review of the
       Official Information Act 1982.8

29. In paragraphs 14.24 – 14.36 of The Public’s Right to Know, the Law
       Commission addressed the issue of applying the OIA to Officers of Parliament.
       In paragraph 14.26 the Commission stated:

            We cannot identify any issue of principle which leads to the
            conclusion that the [Office of the Controller and Auditor General]
            OCAG (including Audit New Zealand) should be entirely excluded
            from the OIA. We think extending the scope of the OIA to include
            the OCAG, which itself plays an important role in New Zealand’s
            accountability arrangements, would provide an important signal
            about the role the OIA plays in holding public bodies to account. At
            least in respect of its administrative functions, including its use of
            public resources, the OCAG should be as accountable as any other
            public body.

30. In the next paragraph, the Commission continued in respect of the
       Ombudsmen:

            For similar reasons, the Ombudsmen have suggested to us that
            consideration should be given to making them, at least in
            respect of their administrative functions, subject to the OIA.
            Information held by the Ombudsmen or other agencies in respect
            of the Ombudsmen’s investigative functions is explicitly excluded
            from the scope of the OIA.
            We agree that, in principle, extending the OIA to include the
            Ombudsmen’s administrative functions is appropriate. It does not
            send a satisfactory message if the Ombudsmen, the authority
            charged with holding other agencies to account under the OIA, are
            themselves completely exempt from it. We thus recommend that
            subject to the exceptions we discuss below, the Ombudsmen
            should be subject to the OIA.9 (emphasis added)

8
    The Public’s Right to Know: Review of the Official Information Legislation, Law Commission
    Report 125, Wellington, July 2012. Accessed at: http://lawcom.govt.nz/our-projects/official-
    information-act-1982-and-local-government-official-information-act-1987
9
    Ibid, paragraphs 14.27-14.28

                                                                                               Page 8
Privacy Bill Submission                                                  Andrew Ecclestone

31. The Law Commission concluded with Recommendation R122:

             The Offices of Parliament (the Ombudsmen, the Office of the
             Controller and Auditor-General and the Parliamentary
             Commissioner for the Environment) should be subject to the OIA
             by inclusion in Schedule 1. Information relating to any audit,
             assurance work, inquiry or investigation undertaken by an Office of
             Parliament should be excluded from the definition of “official
             information” in section 2 of the OIA.10

32. In considering whether the Ombudsmen should continue to be excluded from
        the definition of ‘agency’ in the Privacy Act, members of the Justice Committee
        may find it difficult to accept that Ombudsmen should somehow not be subject
        to one key information access and governance regime – the Privacy Act - when
        they have themselves volunteered themselves to be subject to the OIA.

33. There is however one additional argument for making the Ombudsmen subject
        to the Privacy Act. This is that the employees of the Ombudsmen should have
        the same rights and protections under the law regarding the collection, use,
        management, access to and disposal of their personal information as the
        employees of any other organisation in New Zealand. It is somewhat ironic that
        the people who work hard to uphold New Zealander’s rights to official
        information are not themselves able to benefit from the protections and rights
        created by the Privacy Act.

34. The Law Commission notes, in paragraph 4.22 of its report on the Privacy Act
        that:

             The Ombudsmen were willing to accept the application of privacy
             principles 6 and 7 to personal information about employees and
             former employees.

35. Given this statement, it is somewhat puzzling, given its unquestioning
        acceptance of the Ombudsmen’s other arguments for remaining exempt from
        the privacy principles, that the Ministry of Justice’s note on
        Recommendation 37 does not address this point at all.

10
     Ibid, following paragraph 14.36, page 340

                                                                                   Page 9
Privacy Bill Submission                                                 Andrew Ecclestone

36. Although the Ombudsmen indicated their willingness to grant their employees
     and former employees these limited rights, they did not wish to have this
     effected by being made an ‘agency’ under the Privacy Act. The Law
     Commission’s report continues:

           However, they said that if such access and correction rights were
           to be legislated for, it would be preferable for this to be done by
           incorporating principles 6 and 7 in the Ombudsmen Act, rather
           than providing for complaints under the Privacy Act.

37. This does not seem a desperately strong argument, and inherently rests on the
     second point the Ombudsmen made to the Law Commission, that they should
     not be subject to investigation by an agency that is subject to the
     Ombudsmen’s own jurisdiction. That argument was firmly despatched by the
     Law Commission in paragraph 4.21, and further explanation as to why it does
     not hold water can be found in paragraphs 19 and 23 of this submission.

38. The Ministry of Justice’s response to the Law Commission’s recommendation
     that the Ombudsmen be made subject to the Privacy Act is merely to

           Amend the Ombudsmen Act so that information on how the
           Ombudsmen deal with personal information must be included in
           their annual report.

39. The Ministry’s November 2012 note (Annex A to this submission) concludes
     with the comment that ‘The Ombudsmen have not yet been consulted on this
     proposal.’ It is concerning that the Ministry reached its decision to reject the
     Law Commission’s recommendation without consulting the Ombudsmen. They
     may have discovered that the Ombudsmen were in fact persuaded by the Law
     Commission’s arguments. They could even have amended their proposed
     response to give effect to the Ombudsmen’s minimal concession of granting
     some form of principle 6 and 7 rights to current and former employees.

40. One might have hoped that in the intervening five and half years since the note
     was written that the Ministry would, in its normal exchange of correspondence
     with the Ombudsmen on various issues (including amendments to the
     Ombudsmen Act via the Statutes Amendment Bills), have consulted the
     Ombudsmen on this issue. Not least since the Ministry’s Cabinet Paper for the

                                                                                 Page 10
Privacy Bill Submission                                                                Andrew Ecclestone

        previous Minister of Justice states that the Ombudsmen have been consulted
        on the proposals for reform of the Privacy Act.11 But in its table comparing the
        Privacy Bill with the Law Commission recommendations (disclosed as
        Document 7 in response to my OIA request), the Ministry has noted that
        ‘Schedule 8 (consequential amendments) does not seem to include this
        amendment to the Ombudsmen Act’. Furthermore, as previously noted, in its
        supplementary response to my OIA request (Annex B to this submission), the
        Ministry states that ‘the Ministry has not been able to locate’ any information
        received from the Ombudsmen, either in correspondence or at a meeting,
        relating to the Law Commission’s recommendation that the Ombudsmen be
        made subject to the Privacy Act.

41. In any event, the Ministry’s proposed action of amending the Ombudsmen Act
        to require some kind of information to be buried within an annual report is so
        vague that it is entirely unclear how it could possibly achieve any beneficial
        outcome for people’s legitimate interests regarding the handling of their
        personal information.

42. Finally, I note that the Australian Commonwealth Ombudsman is subject to
        Australia’s Privacy Act 1988 and the Privacy Commissioner’s jurisdiction, and
        the UK Parliamentary Ombudsman is subject to the Data Protection Act 2018
        (and to the Data Protection Act 1998 before that) and the Information
        Commissioner’s jurisdiction.12

11
     Paragraph 103 of the Cabinet Paper Reforming the Privacy Act 1993 (Document 5 in the Ministry’s
     response to my OIA request), which can be accessed here:
     https://www.justice.govt.nz/assets/Documents/Publications/cabinet-paper-reforming-the-privacy-
     act-1993.pdf . Interestingly, paragraph 59 of Minister Little’s Cabinet Paper on introduction of the
     Privacy Bill 2018 does not list the Ombudsmen as consultees, a remarkable oversight given that
     several of the Law Commission’s recommendations impact the Ombudsmen. This paper can be
     accessed here: https://www.justice.govt.nz/assets/Documents/Publications/cabinet-paper-
     privacy-bill-2018-approval-for-introduction-and-additional-policy-decisions.pdf
12
     For Australia, see the section 6 definition of ‘agency’ in the Privacy Act 1988 accessible here:
     https://www.legislation.gov.au/Details/C2018C00034 . The Commonwealth Ombudsman’s legal
     team have confirmed to me by email that they fit within this definition, and advise people of their
     privacy rights here: http://www.ombudsman.gov.au/privacy-policy .

     For the United Kingdom, see the section 7 definition of ‘public authority’ and ‘public body in the
     Data Protection Act 2018 and section 3 and Part VI of Schedule 1 of the Freedom of Information

                                                                                                  Page 11
Privacy Bill Submission                                                Andrew Ecclestone

Recommendation
43. I strongly recommend that the Justice Committee reject the weak arguments of
     the Ministry of Justice and the Ombudsmen to deny people their rights, and
     instead amend the Privacy Bill to give effect to Law Commission
     Recommendation 37. This will follow the basic principle that there must be
     truly exceptional reasons to depart from universal application of people’s rights
     through the Privacy Act, and that no such reasons have been advanced that
     can withstand scrutiny.

44. This can be done very simply, by deleting sub-paragraph (ix) ‘an Ombudsman’
     from the list of roles and organisations in paragraph (b) of the clause 6
     definition of ‘agency’.

45. In doing so, the Committee will significantly strengthen the rights of all those
     who rely on the Ombudsmen (including Members of Parliament), ensure that
     the Ombudsmen’s ever-increasing current and former staff benefit from the
     same rights as other New Zealanders, and place the Ombudsmen on the same
     footing as their fellow Officers of Parliament, the Controller and Auditor General
     and the Parliamentary Commissioner for the Environment.

                                     ---------------------

  Act 2000, accessible in the following locations:
  http://www.legislation.gov.uk/ukpga/2018/12/section/7/enacted and
  http://www.legislation.gov.uk/ukpga/2000/36/section/3

                                                                                 Page 12
Annex A
Annex B
You can also read