NZ Told to Toughen Privacy Laws as Breaches Rise

Privacy Commissioner Michael Webster says New Zealand’s privacy laws need urgent modernisation as breaches and complaints continue to surge. Reported by RNZ.

According to the commission’s 2024/25 annual report, privacy complaints jumped 21 percent in the last financial year, reaching nearly 1600 cases. Serious privacy breach notifications rose even faster — up 43 percent to almost 600.

One case study highlighted a serious lapse: three former school teachers had their private Google and Facebook messages accessed after they failed to log out of their accounts on a work laptop.

Screenshots of their conversations were sent to the school principal. The school initially resisted the commission’s investigation but eventually admitted it had breached key privacy principles.

Webster said the latest public survey showed 80 percent of New Zealanders want more control over how organisations collect and use their personal information, while almost two-thirds remain worried about their own or their children’s privacy.

“People are right to worry,” Webster said. “The Privacy Act currently provides insufficient incentives for many organisations to meet even the most basic privacy requirements.”

The report states that financial consequences are too weak to compel agencies to prioritise privacy, resulting in low awareness and compliance.

To address this, the Privacy Commissioner’s Office is pushing for law changes that would strengthen enforcement powers and give individuals greater rights — including the right to request deletion of their personal data. Survey results also show strong public support for expanding the commissioner’s authority.

Despite rising case volumes and growing complexity, the office closed nearly 90 percent of complaints within six months, with its “fast resolve” process managing about 1200 cases.

A key focus going forward is tougher compliance and enforcement, as well as improved education for organisations.

The report cited the commission’s recent action against Oranga Tamariki for what it described as “grievous” privacy breaches.

However, the office faces financial pressure. Its government funding fell from $8.1 million to $7.6 million, and inflation has further reduced its budget in real terms.

“Even when funding was increased in the past, it remained below what was needed to carry out the Act’s expanded responsibilities,” the report noted.