The official who polices how New Zealand organisations look after your personal information says he needs real teeth, and right now he does not have them. Privacy Commissioner Michael Webster is asking the Government to rewrite the Privacy Act so his office can impose serious financial penalties on agencies that fail to keep sensitive data safe, warning that the current rules leave New Zealanders badly exposed compared with people in much of the rest of the world.
Webster told RNZ that this country’s privacy laws are now “somewhat out of step” with comparable nations. “In a lot of other countries, there is the ability to seek financial penalties for those agencies that have, through their actions, led to significant breaches of individuals’ privacy or have been particularly lax or deliberately not investing, for example, in hardening and strengthening their systems,” he said.
At the moment the Commissioner’s strongest day to day tool is the compliance notice, a legal direction telling an organisation to fix what it is doing wrong. If a business ignores that notice, Webster can take it to the Human Rights Review Tribunal. Only if that step fails can a fine follow, and even then the penalty is for defying the Tribunal rather than for the original failure that put people’s records at risk. The maximum fine available under the Privacy Act for the offences it does cover sits at just 10,000 dollars, a figure that barely registers for a large company or a major public agency. Webster wants the option of penalties running into the millions for the worst cases, the kind of number that forces a board to take data security seriously before something goes wrong rather than after.
The case that has sharpened his argument is the breach at the patient portal Manage My Health. Hundreds of thousands of medical files were exposed after a cyber attack on the system, and Webster’s investigation found that both Health New Zealand and the company behind the portal had “failed in their responsibilities” to maintain adequate security controls. Medical records are about as sensitive as personal data gets, covering conditions, medications and test results that people reasonably expect to stay private. Yet under the present law there was no direct financial consequence for the security shortcomings that allowed the files to be taken. To make matters more awkward, third party providers cannot currently be fined directly at all. Responsibility falls back on whichever organisation hired them, which can leave the actual point of failure untouched.
This is not a new frustration for the office. Webster and his predecessor have argued for years that New Zealand suffers from what one earlier report bluntly called “a lack of consequences” for handling personal information poorly. The contrast with overseas regimes is stark. Under the European Union’s General Data Protection Regulation, regulators can levy fines of up to 20 million euros or four percent of a company’s global annual turnover, whichever is larger. Australia has lifted its own maximum penalties for serious or repeated breaches into the tens of millions of dollars. Against those benchmarks a 10,000 dollar ceiling looks less like a deterrent and more like a rounding error.
There is public appetite for change too. A survey carried out for the Office of the Privacy Commissioner found that a clear majority of New Zealanders backed giving the Commissioner power to audit how organisations handle data, to issue smaller on the spot infringement fines, and to seek large court imposed penalties for deliberate or reckless breaches. That tracks with how people behave in practice. Complaints to the office have been climbing, and high profile breaches at hospitals, retailers and government departments have made data security a kitchen table issue rather than a niche legal concern.
The Government’s response so far has been cautious. Justice Minister Paul Goldsmith’s office confirmed it had received the Commissioner’s report and would consider it, but offered no timeline for any law change. Parliament did pass a Privacy Amendment Act in 2025 that added a new requirement for organisations to tell people when their information has been collected indirectly from someone else, a rule that took effect on 1 May this year. That was a useful tightening, but it did nothing to add the financial penalties Webster is now seeking. The coalition has signalled that any broader overhaul of penalties is more likely to be folded into a wider review after the election rather than rushed through beforehand, and Webster himself acknowledged that legislative processes “always take time”.
That timing matters because 2026 is an election year, with voters heading to the polls on 7 November. Privacy rarely tops the list of campaign issues, but it sits underneath a lot of the things that do, from the security of the health system to how much New Zealanders trust the agencies that hold their data. A government that wants people to share information with Inland Revenue, the health system or a digital identity scheme has an obvious interest in being able to show that the information will be protected, and that there are real consequences when it is not. If you want to see where the parties stand on issues like this before you cast your vote, you can compare their positions using the Newswire voting tool.
For now the law stays as it is, and the Commissioner is left issuing notices and naming failures rather than imposing the kind of penalty that changes behaviour. The Manage My Health breach showed how much can go wrong and how little the regulator can do about it after the fact. Whether the next Parliament decides to give the office the power Webster is asking for, and how high it is willing to set the ceiling on fines, will say a lot about how seriously New Zealand intends to take the protection of its citizens’ most private information. You can read the Commissioner’s broader case for reform on the Office of the Privacy Commissioner website.
What do you think? Should agencies that leak your data face million dollar fines, or would tougher penalties just be passed on to consumers? Have your say in the comments below.
This article was written by AI, briefed to report the facts, hopefully without some of the bias people bring to the job 🙂
Leave a Reply