Protecting privacy is their business

Maligned and misunderstood, the Privacy Act aims to protect individual rights in the information age. JAN CORBETT meets the man in the firing line.

Six floors up, in a narrow office overlooking the grounds of Old Government House by Auckland University, two men wearing telephone headsets speak intently into their microphones, looking for all the world like air traffic controllers.

In fact, they are dealing with the fallout when people believe someone's activities have collided with their right to privacy.

Privacy Commissioner Bruce Slane says setting up the 0800 number for the confused and aggrieved - a line used by beneficiaries checking their rights and chief executives checking their obligations under the Privacy Act - is one of the best things his office has done.

Downstairs, a team of four investigators (four more work in Wellington) process the complaints that pour in at about 16 a week.

As usual in the public sector, demand exceeds supply. The office's $2.1 million annual budget is insufficient to meet an ideal goal of a three-month turnaround - complainants can wait up to 18 months for a decision.

If the people approaching the office each week have anything in common, it is their relative powerlessness. "We don't get complaints from the well-off," says Mr Slane.

Instead, they are middle to lower New Zealanders - particularly the poor and beneficiaries, whose economic circumstances mean they are more vulnerable to Government agencies and debt collectors analysing their circumstances and acting on their credit information.

Passed in 1993, the Privacy Act has 100 pages, 33 sections, eight schedules and is possibly the most misused and misunderstood law to make it on to the statute books.

Mr Slane, a former lawyer, largely blames his old profession for interpreting the act too conservatively and providing poor training in it to their clients. "I scolded the lawyers for taking a rigid approach."

The Privacy Act gives New Zealanders more protection against unnecessary intrusion into their lives, and more access to the information held about them, than any other democratic country allows.

Senior law lecturer Tim McBride, a civil liberties campaigner, says it is envied internationally, especially for its seamless treatment of public and private agencies.

Conceived originally to police the extent to which Government agencies could use computer technology to data-match in the war against benefit fraud, the Privacy Act also allowed us for the first time to know what information public and private agencies hold on us, what they can do with it, and to have the details corrected if needed.

Any agency gathering information about us (except news organisations, the courts, Parliament, MPs, commissions of inquiry and the Ombudsman) must conform to 12 privacy principles.

The information must be gathered for a lawful and specified purpose and, where practical, directly from the person it concerns. The agency collecting information must identify itself and say why it needs to know about you. It must also say if it intends passing that information to another agency. An agency cannot collect information by snooping on you.

Once it has information, it must take reasonable steps to ensure it is accurate, and keep it somewhere secure. It must allow you to see the information and correct it.

It cannot use the information for purposes other than it was originally collected for, and should discard what it has on you once it is no longer needed.

And no one can use data on public registers such as births, deaths and marriages, land valuation and electoral rolls for unauthorised commercial purposes.

But that has not stopped direct marketing agencies getting bulk access to many of those lists because the separate laws governing each register make them publicly accessible and override the Privacy Act.

But if Mr Slane gets his way, this bulk sale of public information will stop.

That was one of the 154 mostly technical recommendations he made in his 1998 review of the act.

He also suggested increased protection for victims of domestic abuse, and for police and jurors by allowing them to have personal details which would normally be on public registers held separately.

And he wants the right of employers and insurance companies to ask for medical and criminal records to be restricted.

His recommendations are now with constitutional lawyer Mai Chen for analysis.

When we meet him, Mr Slane is fresh from a night and a morning of media interviews trying to point out that the Privacy Act is not to blame for paranoid schizophrenic Lachlan Jones slaughtering flatmate Malcolm Beggs then killing himself.

Mr Beggs could have been told his new flatmate was mentally ill, so long as the hospital had a clearly stated policy of revealing that information.

It annoys Mr Slane when agencies use the Privacy Act as an excuse not to give out information they have no intention of revealing anyway.

But even after nearly a decade of having to explain and re-explain the act, and of being cast as the villain who personifies a law that has been blamed for murder, suicide, parents being left ignorant of their teenagers' pregnancies or drug habits, or neighbours left unaware of a paedophile next door, Mr Slane declares happily that he loves his job for its variety and novelty and intends staying on for several years yet.

Apart from the news media, which took grave exception to the act and are exempt from it, Mr Slane believes it is generally well regarded by the public and private sector agencies which must observe it.

He says they realised early on that he was not a privacy zealot and recognised that privacy and publicity must be balanced.

If anything has been frustrating, he chuckles, it was not finding a rogue sector that he could have had the professional satisfaction of cleaning up.

But in an age when technology outstrips laws, threats to privacy constantly emerge.

Right now, privacy and civil rights watchdogs are being exercised by the Crimes Amendment Bill.

Designed to outlaw computer hacking, it exempts the police, Security Intelligence Service and Government Communications Security Bureau. In other words, it would legitimise those agencies' ability to read your e-mail and the contents of your computer hard-drive without your knowledge.

One development that pleases the commissioner is agencies carrying out privacy impact reports before adopting new information-handling programmes, in the same way that environmental impact reports are now routine.

Mr McBride the civil libertarian wants to go a step further. He says the Complaints Review Tribunal - the final stop for complaints to the Human Rights, Race Relations and Privacy Commissioner's offices - should be replaced by a human rights court on the lines of the Environment Court.

Nevertheless, the courts are busy carving out privacy case law on their own.

In a significant decision, Justice Nicholson ruled in 1999 that the Sunday Star-Times could not reveal the psychiatric history of a public figure whom the paper intended profiling.

The judge considered it would breach the person's privacy and there was no countervailing public interest.

* Privacy Hotline 0800 803 909