Preparing For The New Privacy Legislation
About the Author:
Paul Wilton (editor)
CA with degrees in commerce, accounting and information technology. Paul worked overseas in the “Big 4” accounting firms and served as a director at Audit New Zealand before setting up his own consultancy. Author of A-Z of New Zealand Business Law, Paul has over 20 years of experience as a business owner and consultant. He joined FBA in 2004 and is totally committed to providing excellence in quality and value to our subscribers.
Here's what we recommend…
Dealing with privacy breaches
Identify and train someone at work to take responsibility for dealing with privacy breaches;
Make sure your staff understand what a privacy breach is, whether it is notifiable, what to do and who to advise if one occurs;
Update your privacy policies. This advises what personal information you are collecting, why, and what you will do with it. It can also act as authorisation for you to use the information in ways that would otherwise not be permissible in Law. Develop a policy for mandatory reporting of notifiable breaches.
Revise your processes for dealing with breaches, including notification and liaison with the affected individuals and office of the Commissioner, protocols to ensure that the effects of the breach are curtailed and that similar breaches do not recur;
Cross-border privacy and data protection
Now is the time to identify the data or information that is stored or processed offshore. This could be by offshore offices of your business, related parties, those with whom you are authorised to share the information or other third parties such as your Internet Service Provider (ISP);
Consider and plan what reasonable, proactive measures you will take to protect the end use of the data. How will people be properly advised about the use and sharing of their data;
Satisfy yourself that the data which you pass on to others offshore will be subject to similar protections as are required in New Zealand. This may be by way of warranty or agreement concerning the data protection.
The earlier that you start to address these issues, the easier it will be to ensure that you are not caught short and subject to possible fines once the legislation comes into force, and it almost certainly will.
Once you are clear about your current situation and what needs to be done, however, you may find that you do not have to go overboard with efforts that could effectively be reinventing the wheel.
Keep a watchful eye out for seminars and helpful tips on the website of the Privacy Commissioner. It is likely that much of the difficult work will be done for you - and watch this space. These articles are only the first of our briefings on the introduction of the new legislation. Finally, seek legal advice as required.
Related Articles
Computer security is back in the spotlight. Smaller businesses are more likely to be the target of scams, however, than attacks of the nature that shut down our stock exchange last month.