Greenleaf, Graham; Bygrave, Lee --- "Not Entirely Adequate but Far Away: Lessons from How Europe Sees New Zealand Data Protection" [2011] UNSWLRS 44

Last Updated: 24 November 2011

Not entirely adequate but far away: Lessons from how Europe sees New Zealand data protection

Graham Greenleaf, Professor of Law & Information Systems, University of New South Wales
Lee Bygrave, Associate Professor, Faculty of Law, University of Oslo

Citation

This paper was published in (2011) Privacy Laws & Business International Report, Issue 111, 8-9, July 2011. This paper may also be referenced as [2011] UNSWLRS 44.

Abstract

The principal legal criteria for assessing a data protection regime are the rules of EU’s data protection Directive 95/46/EC (and more precisely article 25 of the Directive) as construed and applied by the EU Court of Justice. There are as yet no decisions of the Court interpreting the concept of “adequacy”. The principal methodological criteria for assessing a data protection regime are set out by the Article 29 Data Protection Working Party in two ‘Opinions’ by it in 1997 and 1998. While the core criteria suggested by the Working Party are not in themselves legally binding, they are the considered view of Europe’s data protection authorities as to what constitutes “adequacy”. The criteria have formed an important point of departure for European Commission decisions on the adequacy of third country regimes—decisions that are legally binding.

The Working Party’s favourable ‘Opinion 11/2011 on the level of protection of personal data in New Zealand’ (4 April 2011) is the first time a non-European country with legislation that largely predates Directive 95/46/EC and is modelled primarily on the 1980 OECD Guidelines on data protection has been given an adequacy finding. Moreover, the recommendation of adequacy has been given despite considerable shortcomings in the NZ data protection regime. This not only reiterates the by now trite point that adequacy does not equal equivalence, it also illustrates how much variation from the criteria set out in 1997 and 1998 is accepted as not preventing a finding of adequacy. So it is valuable to consider the Opinion in some detail, particularly with a view to drawing lessons on the balance that the Working Party is ready to strike between pragmatism and formalism.

This article concludes that the reasons given by the Working Party for finding adequacy despite putative weaknesses in New Zealand’s regime are primarily very practical ones relating to the geographical and economic position of New Zealand: its relative geographic isolation; the limited EU-sourced data likely to be transferred to New Zealand (which minimises the problem of onward transfers); and the reciprocal lack of direct marketing into the EU that could be expected from NZ. This Opinion signals significant pragmatic preparedness on the part of the Working Party. It also underlines the fact that it is the effect of a third party’s laws on EU citizens that counts toward adequacy, not the effect on the country’s own citizens. It will be relatively rare that personal data on EU citizens ends up in New Zealand, so a good deal of tolerance of variation from the core principles previously set out by the Working Party is permitted by them in delivering an adequacy opinion. We could say (with some exaggeration) that the standard of adequacy is in inverse proportion to proximity, provided that ‘proximity’ is considered to include the economic and social, not only the geographical.

In a country like India, where outsourcing of the processing of European data is of large scale, as are other forms of business and travel involving personal data, different considerations are likely to apply. In Europe they probably will not say ‘Delhi is far away’, even though they have found that Wellington is.

What did we previously know?

The principal legal criteria for assessing a data protection regime are the rules of Directive 95/46/EC (and more precisely article 25 of the Directive) as construed and applied by the EU Court of Justice. There are as yet no decisions of the Court interpreting the concept of “adequacy”. The principal methodological criteria for assessing a data protection regime are set out by the Article 29 Data Protection Working Party in its document “Transfers of personal data to third countries: Applying Articles 25 and 26 of the EU data protection directive” (WP 12, DG XV D/5025/98, adopted on 24 July 1998), and its earlier document “First orientation on Transfers of Personal Data to Third Countries: Possible Ways Forward in Assessing Adequacy” (WP 4, XV D/5020/97-EN final, adopted on 26 June 1997).

While the core criteria suggested by the Working Party are not in themselves legally binding, they are the considered view of Europe’s data protection authorities as to what constitutes “adequacy”, and are derived from the Working Party’s assessment of the most important requirements of the EU Directive and other international data protection instruments. Moreover, the criteria have formed an important point of departure for European Commission decisions on the adequacy of third country regimes—decisions that are legally binding.

The Working Party’s recent favourable ‘Opinion 11/2011 on the level of protection of personal data in New Zealand’ (4 April 2011) is the first time a non-European country with legislation that largely predates Directive 95/46/EC and is modelled primarily on the 1980 OECD Guidelines on data protection has been given an adequacy finding. Moreover, the recommendation of adequacy has been given despite considerable shortcomings in the NZ data protection regime. This not only reiterates the by now trite point that adequacy does not equal equivalence, it also illustrates how much variation from the criteria set out in 1997 and 1998 is accepted as not preventing a finding of adequacy. So it is valuable to consider the Opinion in some detail, particularly with a view to drawing lessons on the balance that the Working Party is ready to strike between pragmatism and formalism. The Opinion is discussed in PLBIR Issue 111, p XX.

The content principles in NZ

The Working Party found seven instances of where New Zealand’s content principles were not fully ‘adequate’, but they were neither singly nor jointly sufficient to prevent a finding of adequacy.

One shortcoming relates to an exception in New Zealand to the transparency principle (that people should be informed about the purpose for which data will be processed) where the agency believes, on reasonable grounds, that non-compliance would not prejudice the data subject’s interests. Opinion 11/2011 observes that this exception ‘comes from the harm-based approach adopted in New Zealand’ and is acceptable primarily because the NZ Act has an unusually wide scope, which ‘covers all personal information, including conversations, gossip and information in a person’s mind’. Therefore, according to the Opinion, ‘some flexibility is required to make the Act workable in practice and a harm-based approach is one way to achieve this’. Further, the information collected is still covered by the other Principles.

Another exception to transparency is where special authority is granted by the Privacy Commissioner, intended to cover unanticipated circumstances. However, the agency is first required to attempt to collect the information directly from the individual, and obtain the individual’s consent. If the individual refuses to consent, the Commission cannot grant an authorization. Only where such direct collection is not possible, and there is a high level of public interest, or clear benefit to the individual, can be Commissioner grant such authority. The limited scope of these exceptions to the ‘basic rule’ prevent this being a problem in the view of the Working Party.

The lack of a right of opposition in the NZ law was not seen as a problem because EU citizens have that right in relation to EU data before it is transferred to New Zealand.

New Zealand’s Privacy (Cross-Border Information) Amendment Act 2010 created a weak restriction on onward transfers, allowing the Privacy Commissioner to issue a transfer prohibition notice where, in the recipient country, the data will not be subject to a law providing comparable safeguards to the Privacy Act, and the transfer would be likely to breach the basic principles of national application set out in the OECD guidelines. The Working Party considers that the effectiveness of this provision is likely to depend on European data protection authorities alerting the Privacy Commissioner to a transfer. While the new provisions will have ‘alerted businesses to the need to provide ‘adequacy’ in relation to any onward transfers’, the main factor stressed in the Opinion is that ‘given the geographical isolation of New Zealand from Europe, its size and the nature of its economy, it is unlikely that New Zealand agencies will have any business interest in sending significant volumes of EU-sourced data to third countries’. As a result, ‘although the Working Party does not consider that New Zealand law complies fully with the onward transfer principle, it does not believe that there is a major shortfall or that this needs to stand in the way of an “adequacy” finding’.

Although the Working Party considers that an individual should have the right to opt out of direct marketing at any time, and New Zealand law does not generally provide this, it is not found to be a ‘major shortfall’ preventing an adequacy finding. The reason is that ‘it is most unlikely that individuals in the EU will be sent direct marketing from New Zealand’.

Moreover, because ‘automated decision making is not common in New Zealand’ the Working Party in effect ignores that there is no requirement in New Zealand law concerning the private sector for individuals to be told the reasons behind individual automated decision-making.

The procedural and enforcement mechanisms in the New Zealand Act were considered by the Working Party to be quite sufficient to meet the requirements of adequacy.

Conclusions

The reasons given by the Working Party for finding adequacy despite putative weaknesses in New Zealand’s regime are primarily very practical ones relating to the geographical and economic position of New Zealand: its relative geographic isolation; the limited EU-sourced data likely to be transferred to New Zealand (which minimises the problem of onward transfers); and the reciprocal lack of direct marketing into the EU that could be expected from NZ. This Opinion signals significant pragmatic preparedness on the part of the Working Party. It also underlines the fact that it is the effect of a third party’s laws on EU citizens that counts toward adequacy, not the effect on the country’s own citizens. It will be relatively rare that personal data on EU citizens ends up in New Zealand, so a good deal of tolerance of variation from the core principles previously set out by the Working Party is permitted by them in delivering an adequacy opinion. We could say (with some exaggeration) that the standard of adequacy is in inverse proportion to proximity, provided that ‘proximity’ is considered to include the economic and social, not only the geographical.

In a country like India, where outsourcing of the processing of European data is of large scale, as are other forms of business and travel involving personal data, different considerations are likely to apply. In Europe they probably will not say ‘Delhi is far away’, even though they have found that Wellington is.

Nonetheless, reading between the lines of the Opinion, we get the impression that the Working Party is fairly eager to find adequacy. While they are not quite ‘bending over backwards’ to do so, they show considerable readiness to sympathise with New Zealand’s approach to data protection and thereby ‘forgive’ its putative blemishes. There is some advantage to be gained for the Working Party and the EU more generally in proclaiming New Zealand adequate at this juncture: it sends a signal to APEC and member governments that the EU adequacy apparatus, despite being cumbersome and slow, is still operating and ready to play ball with the ‘good guys’ in the region.

Note: The authors assisted Prof Paul Roth in writing the expert report for the European Commission which is referred to in the Article 29 Working Party’s Opinion.