Dear GNSO Colleagues,

on the day of departure from Wellington, I found an article in a NZ newspaper “Privacy law upgrade to stop misuse"  - I think this article contains a number of concerns which are similar to our discussions about WHOIS (though the article deals also with some wider issues). But the following aspects relate also in one way or the other to what we have to consider (my remarks in brackets):

• "reforming the 13-year-old Privacy Act was a priority to keep pace with developments in technology" (to keep pace with today's issues seems to mean, after 13 years: to be more aware of the dangers which appeared in the meantime)
• "include bringing New Zealand's information-sharing law in line with Europe's, and limiting data shared through public registers" (to upgrade means to look for international examples where more limits on public registers are imposed than before)
•  "that technology was posing a major challenge in maintaining existing privacy laws"
• "Police also warned of growing incidents of identity theft. 'The volume is astronomical compared with 15 years ago,' Police Identity Intelligence Unit representative David Kennedy said. ID theft was a fundamental privacy breach and businesses that stored unnecessary personal details about customer databases could be contributing to the problem" (the tendency of businesses to store more personal data is possibly a contributing factor to privacy breach)
• "Australian Privacy Commissioner Karen Curtis issued a stern warning about the consequences a business faced if it did not safeguard personal information" (I do not remember that we devoted much time and considerations what kind of 'consequences' can and will be imposed in cases where WHOIS data have been misused).

The full text of the article follows at the end.

I hope to be online for our meeting today.


Norbert Klein

= = =
The Dominion Post, NZ, 31 March 2006
Privacy law upgrade to stop misuse
by ANNA CHALMERS

The Government has announced plans to update privacy laws amid growing criticism that personal information is being misused.

Associate Justice Minister Clayton Cosgrove told a privacy forum in Wellington yesterday that reforming the 13-year-old Privacy Act was a priority to keep pace with developments in technology, science, and human rights.

Proposed amendments are understood to include bringing New Zealand's information-sharing law in line with Europe's, and limiting data shared through public registers.

"There are also reforms to ensure that personal information is not misused," Mr. Cosgrove said.

The moves come as a survey issued this week shows New Zealanders are increasingly concerned about privacy.

Privacy Commissioner Marie Shroff said the "skimming" of $23,000 from an Auckland ATM machine had also highlighted private security issues. The commission's survey results showed 93 per cent of New Zealanders thought businesses needed to act to protect private information. "Modern technology offers many benefits to business and consumers. But we should recognize people have significant concerns about threats to privacy."

Assistant Privacy Commissioner Blair Stewart said marketing companies used public registers, such as the Motor Vehicle Register, to access thousands of names and addresses daily. Under the proposed changes, a cap of about 30 would be imposed to limit this.

Delegates were also told that technology was posing a major challenge in maintaining existing privacy laws.

The growing use of radio frequency identification — monitoring tags that contain a unique identifier and transmitter — posed a range of privacy dilemmas, Otago University law professor Paul Roth said.

Unlike bar codes, the data can be read from a distance and was used by businesses in employee identification cards, medication, livestock, and clothing. Some United States defense employees have RFID [radio frequency identification] tags embedded in their skin.

Police also warned of growing incidents of identity theft. "The volume is astronomical compared with 15 years ago," Police Identity Intelligence Unit representative David Kennedy said. ID theft was a fundamental privacy breach and businesses that stored unnecessary personal details about customer databases could be contributing to the problem. "The information is a lot more dangerous and a lot more valuable than people realize."

Australian Privacy Commissioner Karen Curtis issued a stern warning about the consequences a business faced if it did not safeguard personal information.

Past experience showed the public voted with their feet when companies were caught abusing privacy, she said
= = =