Right to privacy in New Zealand

The New Zealand Bill of Rights Act 1990 (NZBORA) is based on the International Covenant on Civil and Political Rights,[6] however no express right to privacy is included in the Act. Despite the lack of an express right, privacy is the foundation for many of the rights contained within NZBORA, such as freedom from unreasonable search and seizure as protected by section 21.[7] The fact that a right to privacy is not included in NZBORA does not affect or invalidate it in any way.[8] It is suggested that privacy was not included in NZBORA due to its difficulty to define, and because the social environment at the time was not one in which it was appropriate to implement a right with vague and uncertain parameters.[9]

The current Privacy Commissioner, John Edwards

New Zealand has a statute entitled the Privacy Act 1993. However, despite its declaration that it is an Act to promote and protect individual privacy, it in fact only covers information privacy. The Privacy Act was created to combat concerns about technological advances and their potential to be used to access private information, when this risk had been far less under manual data systems.[10]

The Act contains 12 Information Privacy Principles which govern the handling of private information by agencies. An 'agency' is widely defined as any person or body of persons, whether public or private, and whether corporate or unincorporated, with specified exceptions.[11] There are also numerous exceptions to the Information Privacy Principles, which can be found both within the principles and in other places within the Act.[12]

When an individual feels there has been a breach of the principles he or she can lodge a complaint with the Privacy Commissioner.[13] The Privacy Commissioner investigates the complaint and undertakes a process of conciliation rather than punishment.[14] If the complaint cannot be settled, it may be referred to the Human Rights Review Tribunal, which may or may not consider the situation anew, and it's quite likely that they won't consider a complaint at all (especially if the issue is related to debt). If the Tribunal finds there has been a breach, it may award a range of remedies including damages and restraining orders.[15] With one exception, none of the Information Privacy Principles are enforceable in court.[16]

The Privacy Act recognises that privacy is not an absolute concept and that there are other factors which need to be weighed to determine what the outcome should be. The Privacy Commissioner must always have regard to factors such as human rights, social interests, and international obligations and guidelines.[17] The Privacy Commissioner is able to make authorisations regarding the use of private information which would normally be contrary to the Act if he or she is satisfied that the public interest or benefit outweighs the interference with privacy.[18]

The Broadcasting Act 1989 requires broadcasters to maintain standards consistent with the privacy of the individual. The Act establishes the Broadcasting Standards Authority (BSA), which has the functions of receiving and deciding complaints against broadcasters, issuing opinions relating to ethical conduct and standards in broadcasting, and issuing codes of practice for broadcasters and encouraging compliance with them.[19] Privacy is consistently mentioned in the codes and standards of practice issues by the BSA.[20] While the Broadcasting Act does not provide any explanation of what constitutes a breach of privacy, the BSA has seven principles relating to alleged breaches of privacy.[21] In considering a complaint, the BSA can award a variety of remedies if it finds there has been a breach, but there is no ability to take a complaint to a court of law based on the standards contained within the Act.[22]

Two government bodies are responsible for monitoring New Zealand's national security: the Government Communications Security Bureau (the 'GCSB') and the Security Intelligence Service (the 'SIS'). Prior to the introduction of the Intelligence and Security Act 2017, these bodies operated strictly independently of one another, and general mystery surrounded their exact functions and capabilities. Much of the confusion originated from the fact that the SIS and GCSB appeared to have differing objectives which meant that, if required, co-operation and coordination would likely be complex and convoluted.

For example, only the SIS could perform surveillance, or spy, on New Zealanders, as provided by the New Zealand Security Intelligence Service Act 1969. There were stipulations as to what 'spy-activities' were permitted, and as a pre-requisite, any proposed surveillance had to be relevant to "security" and its associated threats, such as instances of 'espionage, sabotage, subversion or terrorist attacks'.[30]

Kim Dotcom in 2014. The Court of Appeal ruled that the GCSB's surveillance of Dotcom was unlawful.

In September 2012 Paul Neazor, the Inspector-General of Intelligence and Security advised John Key, the then New Zealand Prime Minister, of a situation which would later be called an "unlawful interception" of an individual known as Kim Dotcom by the GCSB.[31] Following a formal request from the United States' Federal Bureau of Investigation that Kim Dotcom be extradited to the United States, the GCSB spied on Mr Dotcom in order to assist the FBI's request.[31] However, as the GCSB did not have the legal authority to conduct surveillance, Justice Gilbert of the Court of Appeal, deemed unlawful.[32]

Following this widely publicised incident, GCSB Director Ian Fletcher and Chief Executive of the Department of the Prime Minister and Cabinet Andrew Kibblewhite initiated a review of compliance.[33] They assigned the then Cabinet Secretary Rebecca Kitteridge with undertaking the review to look into the "activities, systems and processes since 1 April 2003".[34] This date is significant as it was the date from which the Government Communications Security Bureau Act 2003 came into force.

Rebecca Kitteridge in 2015. She conducted a review of the GCSB's compliance with the law. She is also current Director of the NZ SIS.

The “Kitteridge Report” ultimately concluded that GCSB lacked the legal basis and authority to perform many of its intelligence acts – including the surveillance carried out on Kim Dotcom. The Kitteridge Report made a number of recommendations to ensure that the Government agency had the legal authority to do the activities necessary. All of the recommendations presented in the Kitteridge Report were accepted by the Government and GCSB which led to a number of legislative reforms. These included giving the GCSB the express capability to legally perform surveillance on New Zealanders when required by the SIS, the police or Defence forces.[35] At the time when these changes were introduced, with mounting public concern about New Zealanders' rights to privacy, the then Prime Minister John Key stated that the "new legislation does not add up to an expansion of the bureau’s powers".[35]

It is now permissible for GCSB to legally spy on New Zealanders as a result of the 2013 reforms.[30] In addition, the GCSB's role has expanded and it is now able to perform surveillance on "behalf of the SIS, the police or the Defence forces, or for the purposes of cyber security".[36]

In August 2016 the then Prime Minister John Key announced that due to the threat of ISIS and global terrorism, the New Zealand Government would be introducing new legislation to provide further safeguards for New Zealanders.[37]

New Zealand's first Intelligence and Security Review was undertaken by Sir Michael Cullen and Dame Patsy Reddy, and looked at "the legislative framework governing the agencies and considered whether they were well placed to protect New Zealand’s current and future national security while protecting individual rights".[38] The review was completed at the end of February 2016, and its findings proposed that one Act be introduced to bring all of New Zealand's intelligence and security agencies together.[30]

Cullen and Reddy identified a number of issues in their report. One of the prominent issues identified was that the fragmented legislative landscape meant that it was difficult to bring the multiple agencies together when required. Because each intelligence and security agency operated under its own legislative framework, it was confusing for New Zealanders to understand which agency was responsible for what, and exactly what their lawful powers and capabilities were.

The reviewers concluded that a "single Act" was necessary to overcome these issues.[39] They commented that a single Act would:

"give a comprehensive and much clearer view of the agencies' functions and powers, and the checks and balances that apply to the operation of their powers … [and] would avoid inconsistencies and gaps between various statutes and enable a consistent set of fundamental principles to be applied to the agencies and their oversight".[40]

Understandably, drawing the two bodies together would make it easier for them to co-operate and work together when required. Another issue concerning to the reviewers was the lack of security protection available to New Zealanders under the prevailing legislation. The most recent piece of legislation dealing with intelligence and surveillance was enacted some 47 years ago, the New Zealand Security Intelligence Service Act 1969. Over the course of those years and the accompanying advances in technology, the need to overhaul the law has increased markedly. As terrorist groups continue to advance in their technological capabilities, the current legislation was quickly becoming out-dated and unsuitable for present day society.

The purpose of the Intelligence and Security Act 2017 was to bring clarity and cohesion to the GCSB and SIS, the two agencies in New Zealand responsible for monitoring the country's security and intelligence.

The Act was "a direct response to the report of the First Independent Review of Intelligence and Security in New Zealand: Intelligence and Security in a Free Society, and it replaces the four Acts that applied to the GCSB, the NZSIS, and their oversight bodies".[41]

Given the importance of this proposed legislation, when public submissions for the Bill were called for, 92 were received by the Select Committee. These included submissions made by the New Zealand Law Society,[42] the New Zealand Human Rights Commissioner,[43] and the Privacy Commissioner[44] and many of their recommendations were similar in nature expressing concern over the words used to draft the Bill making the powers of the bodies uncertain, and also the potential for ordinary New Zealanders' privacy rights to be breached.

Although the Act intended to give oversight and transparency to the New Zealand intelligence and security agencies, the Act was drafted in a manner that gave far-reaching powers to the GCSB and SIS to perform surveillance on New Zealand citizens and non-residents in ways that had previously been prohibited. The basis for doing so was that New Zealand's national security is at stake with the ever-present and increased risk of terrorism in today's society.

The new Act has extended the GCSB's capabilities to perform surveillance on New Zealanders, whereas previously, only the SIS was permitted do this. This extension of the GCSB's powers has the potential to have serious ramifications for all New Zealanders, as author and associate professor of law Stephen Penk notes, "surveillance of an individual may lead to a loss of privacy through an individual’s loss of control or autonomy when, typically, he or she is subjected to undesired monitoring of his or her functions, movements or communications"[45]

As per the recommendations made by Cullen and Reddy the new Act covers a number of points such as:

• Bringing the GCSB and SIS together under a single Act for the purpose of achieving co-operation between the agencies.[39]
• Clarifying the rules regarding monitoring, gathering, and storing of human intelligence.[39]
• Making the SIS and the GCSB state-sector government departments, and therefore requiring them to comply with all regulations governing state-section government bodies.[39]

The Act's purpose was expressed in Section 3; which is to "protect New Zealand as a free, open, and democratic society".[39] This is achieved by:

a. Establishing intelligence and security agencies that will effectively contribute to –

1. The protection of New Zealand’s national security;
2. The international relations and well-being of New Zealand; and
3. The economic well-being of New Zealand

b. Giving the intelligence and security agencies adequate and appropriate functions, powers, and duties;

c. Ensuring the functions of the agencies are performed –

1. In accordance with New Zealand law and all human rights obligations recognised by New Zealand law;
2. With integrity and professionalism; and
3. In a manner that facilitates effective oversight;

d. Ensuring that the powers of the agencies are subject to institutional oversight and appropriate safeguards.

Part 2 of the Act "continues the SIS and the GCSB" but clarifies that they will remain two separate agencies with differences in capabilities and methods.[46] Although Part 2 makes note of these differences, they will continue to have shared objectives and functions under a "joint warranting" framework.[46]

In response to concerns that this proposed legislation interferes with New Zealanders' human rights, Part 2 provides a number of safeguards.[46] One such safeguard is expressed in sections 12 and 13 that "require that the agencies operate in accordance with New Zealand law and all human rights obligations, including when co-operating or sharing intelligence with foreign partners".[46] These sections were a direct recommendation of the Human Rights Commission to ensure that New Zealand complies with its international and domestic human rights obligations.[47]

Section 22 of the Act provided a further safeguard extending protection to "the right to engage in lawful advocacy, protest and dissent".[46] This is an important and long-standing human right that ought to be protected. The right to freedom of expression is enshrined in the New Zealand Bill of Rights Act 1990, with section 14 stating that "everyone has the right to freedom of expression, including the freedom to seek, receive and impart information and opinions of any kind in any form". The right has also been expressed in many other human rights instruments, such as Article 19 of the International Covenant on Civil and Political Rights, which also upholds this right. It is also reflected in the Universal Declaration of Human Rights: "Everyone has the right to freedom of opinion and expression; this right includes freedom to hold opinions without interference and to seek, receive and impart information and ideas through any media and regardless of frontiers".[48]