Personal Information, the Internet and the Law

Forums › ICT Policies and Regulation › Personal Information, the Internet and the Law

1080p

1332 posts

Uber Geek
Inactive user

#106437 24-Jul-2012 12:09

I am interested to know what New Zealand law regulates right now in regard to the storage of personal information by businesses and other types of organisations.

My question is this - given a New Zealand based and owned company - if you submit and permit them to store your information (within x server, and/or x database) and then later change your mind and decide to revoke your permission; what must that company do with your information - if anything?

This is assuming you submit a request to have your information scrubbed from their database and servers and any/all backups and no longer use their services if that is what their terms and conditions state.

I'm currently poking about in the Legislation site and am not having a lot of luck figuring this out on my own. Anyone have a pointer to where I can read more?

blair003

557 posts

Ultimate Geek

#661165 24-Jul-2012 18:26

I suspect it varies by the nature of the information and why they are holding it.

Did you read:
http://privacy.org.nz/information-privacy-principles/

if you have an actual problem with a business retaining your personal information when they have no need to do so, you should first contact the business and ask them to remove your personal information from their databases. If they have no need for it and you are being a pain, they may just agree.

If they refuse to do so without reasonable grounds, you could probably contact the privacy commissioner and take it from there. (but if they say they will remove it, I doubt they are under any obligation to prove that they have done it)

If it's publicly available information you are probably out of luck.

(if this is just a hypothetical question then I don't have any first hand experience)

1080p

1332 posts

Uber Geek
Inactive user

#661308 24-Jul-2012 20:53

Cheers for the reply, I did read the Privacy website but found the information to be fairly vague. The question I have is simply an academic one.

I am not 100% sure that I like agencies being able to collect information about me and then be able to hold on to it after our business has concluded; especially since most of the reason they hold on to it is for marketing. I'll have to think on it some more.

I would imagine, though I haven't done so before, that sending mail to a company requesting your personal information be scrubbed from their databases would in many cases be ignored or denied.

Perhaps freitasm could chime in; what is your response to a request by someone to scrub names, e-mail, physical & IP addresses after they decide to leave Geekzone?

blair003

557 posts

Ultimate Geek

#661379 24-Jul-2012 23:50

Yeah I think it's an important question going forward.

But if you made the information public voluntarily (e.g. posting on a forum or on facebook, or having your email address listed in a publicly available profile on GZ), and a company (e.g. facebook or GZ) takes that public information and puts it in a private profile they have created for you, do you have any legal basis for telling them to remove that information from their systems at a later date?

You certainly have the right to get them to update the information if its wrong, but I don't know about removal if you made it public in the first place.

1080p

1332 posts

Uber Geek
Inactive user

#661422 25-Jul-2012 08:03

I'd agree with the public part of your statement. Sure, if I post my e-mail address and name on a forum then I'd have no right complaining.

The thing is, though; almost every service that collects your data allows you to set privacy options too. You can pick and choose which data you would like to share with the public. Would data you kept 'private' then count as public data?

As for Facebook, I have deliberately limited the scope of this discussion to New Zealand based services because Facebook would most likely only obey the law in the country they are based in.

My thoughts are currently directed to New Zealand based shopping sites, auction sites, forum sites etc... I am forever fearful that the data I shared at one point will eventually end up in the wrong hands.

My intuition is that once my business has been concluded and I have chosen to end the relationship with a particular service, my data (which is still my personal data) should be erased upon my request.

gzt

17165 posts

Uber Geek

Lifetime subscriber

#662591 26-Jul-2012 19:44

1080p: My thoughts are currently directed to New Zealand based shopping sites, auction sites, forum sites etc... I am forever fearful that the data I shared at one point will eventually end up in the wrong hands.

My guess is there is no obligation to delete data. What can be done with that data is governed by the privacy act. IIRC you have the right to request a copy of your own data under the privacy act, but that's about it. There are obligations for data security and the like.

You can make a good case that storage of identifying information beyond a certain time would extend beyond the purpose that it was provided for, therefore identifying information should be removed on that basis, but I'm not aware of anything that spells that out exactly.

Have read through here and see if you can make that case:

http://privacy.org.nz/the-privacy-act-and-codes/

The Act itself is online as well.

My guess is storage has not been specifically considered in great detail but you may be able to infer the correct outcome from what has been defined by the legislation.

In general I agree. The number of websites that ask for and get personal information is huge and many of them are technically on the cheap side to say the least.