The Privacy Commissioner says Facebook has breached the Privacy Act 1993.
The Commissioner’s finding comes after Facebook refused a complainant access to personal information held on the accounts of several other Facebook users.
The social media company said the Privacy Act did not apply to it and it did not have to comply with the Commissioner’s request to review the information requested by the complainant.
The Commissioner found Facebook was subject to the Privacy Act and had fundamentally failed to engage with the Act. He said Facebook’s position that the Privacy Act did not apply to it was surprising and contrary to its own Data Policy in regards to responding to legal requests for any personal information it held.
This simply isn’t acceptable. The Privacy Act applies to all companies operating in New Zealand, regardless of where they hold data. Facebook operates in New Zealand, so it is subject to the law, no matter how inconvenient it is to lawless, tax-cheating silicon valley tech-bros.
Not that it is actually inconvenient. The Privacy Commissioner’ statement makes it clear that Facebook had a number of options available to it, and there’s a strong possibility they could have lawfully refused the request. Instead, they simply refused to process it. Unfortunately, there’s no criminal penalties under the Privacy Act. This sort of attitude from foreign multinationals is a strong argument that we need some.
Um… The National Party and some of its former Cabinet Members have been scoffing at the Privacy Act so why woukd Facebook think their NZ users give a toss?
To be slightly clear, Facebook’s argument isn’t actually about where it holds data, even though to my understanding it’s still wrong for precisely the same reason. Its argument is that because it operates its New Zealand business through Facebook Ireland for tax cheating reasons, that only Irish privacy laws apply to them, and under those they are actively obliged not to release any information to the New Zealand privacy commissioner.
Essentially, it’s the same argument as whether we can tax Facebook under the New Zealand system: Do they have a significant business presence here and thus have a local operation that falls under NZ jurisdiction, or are people really dealing directly with Facebook Ireland?
I’d go with I/S that the idea is a complete legal fiction, and regardless of whether they meet with the physical requirements of the law as is currently written, Facebook has so many customers here that they cannot reasonably be said not to be under New Zealand jurisdiction when they deal with New Zealand citizens, and that the law needs to be rewritten to deal with large tech companies, like Facebook, Apple, etc… who deliberately try to avoid passing tests about setting up local offices in order to avoid dealing with local laws or taxes.
The office of the Privacy commissioner has an FAQ on this matter here: https://privacy.org.nz/further-resources/knowledge-base/view/154
Poor corporations, can’t kill us in peace.
https://www.theguardian.com/environment/2018/mar/15/microplastics-found-in-more-than-90-of-bottled-water-study-says
NZ’s tradition of toothless laws around privacy (and civil rights) remains unmolested.
Watch the screams begin if Andrew Little puts teeth into corporate law. The small workplace changes drew vitriol. Do you remember the farming lobby calling Jacinda “a pretty communist?” They don’t expect the ordinary person to defeat them.