New Zealand Privacy Week 2021 was held recently; 10 – 14 May. This annual event is designed to help promote privacy awareness and to help inform people of their rights under the Privacy Act. A key event of the week was the Privacy Forum that was held here in Wellington on Friday 14 May. If you were unable to attend, the good news is that Axenic were there and the following blog is a review of some of the key insights from the event courtesy of Axenic Principal Consultant Lisa Zannino.
What is a notifiable privacy breach?
What constitutes a serious breach of privacy? Not sure? Did you know in the first four months since the Privacy Act 2020 came into force that 76 serious privacy breaches were notified to the Office of the Privacy Commissioner? One of these may have been a breach of your own personal information, and if so, hopefully you were also made aware of it. If your agency was the source of one of these breaches, this statistic was probably not a huge surprise, though for many individuals this could be quite alarming. As was made clear in the 2021 Privacy Forum by the Privacy Commissioner John Edwards, the level of concern from person to person over a privacy lapse can range from ‘whatever, same old’ to a ‘serious violation of trust’, and so the lens through which the level of harm from a privacy breach is assessed must consider this range of viewpoints.
The Commissioner also indicated that the Office is keen to flex its new enforcement action powers under the Privacy Act 2020, so why not err on the side of caution (for your customers) and use the organisation NotifyUs tool – just in case.
Renters and privacy
At some time in your life, or at present, you will likely have been a property renter. So all that personal information you dutifully supplied will have been (and may still be) stored away on file somewhere by at least one rental sector agency. Think about that. In recent years the amount and sensitivity of the personal information being gathered have been questioned as being excessive and even unfair, including bank statements and social media account details, which means even more sensitive information is being stored away. This was one facet from a panel session discussion that raised the uncomfortable issue that many rental property providers are simply individuals with limited privacy protection knowledge who will need to lift their game to ensure their would-be tenants’ privacy rights are maintained. Whilst larger organisations like Tenancy Practice Service Ltd and regional Property Investors’ Associations are working with the OPC to improve their stakeholders’ adherence to privacy requirements, smaller rental property managers may lack awareness and accountability in protecting personal information.
So to summarise, there are two key aspects which require raised awareness:
- For individuals to take measures to protect their privacy – Including being aware of their privacy rights, challenging requests for excessive or unreasonable amounts of personal information (which may be easier said than done, given the current imbalance of power in the competitive rental market) and asking to be provided with the personal information that may be held about them by an agency.
- For rental property providers to protect renter privacy – Raising awareness of their accountability regarding collecting only the personal information necessary to ensure a would-be tenant can meet rent obligations and will take adequate care of the property, and the obligations which must be met to protect this information throughout its lifecycle through to disposal.
Privacy is precious
Finally, our privacy is precious. This overarching message from the OPC was reinforced throughout the Privacy Forum. Brought home by the perspectives most top of mind for the average New Zealander at the moment; the housing (and rental) shortage, and of course the global COVID-19 pandemic.
On that second point, the uptake and use of the NZ COVID-19 Tracer app have undoubtedly benefited from support from the OPC, including removal of personal registration information and later the addition of Bluetooth tracing. Without there being trust from the New Zealand public about the protection of their privacy, the usefulness of the app may have been more limited. As a people, it appears we are much less likely to trade off our privacy for personal safety, and why should we – this shouldn’t need to be a choice.
When it comes to protecting personal information, what goes around comes around. We should always protect other people’s personal information with at least the same concern as we hold for our own precious personal information, or the next notifiable breach of personal information could be your own.
Feel free to contact the team at Axenic if you have any questions on the above or just on cybersecurity and privacy in general.