Managing Metadata for Privacy

I'm sure everyone that has used the internet in the last few years has had one of those pop-ups asking what kind of cookies you want enabled. These pop-ups can be confusing and in my experience, seem keen to ensure you enable all cookies rather than actually enabling only the necessary ones. So what are you agreeing to exactly when you enable all the cookies? Cookies are small text files that are stored on your computer or mobile device when you visit a website. They can be used to remember your preferences and login information, track your activity on the site, and deliver personalised advertising. While cookies can be useful for improving the user experience, they can also raise privacy concerns. For example, cookies can be used to track your browsing activity across multiple sites, which can be used to build a profile of your interests and behavior. It's important to understand how cookies are being used on the sites you visit, and to make informed choices about what information you are willing to share. Most web browsers allow you to control which cookies are stored on your device, and you can also use tools like browser extensions and privacy-focused search engines to limit tracking and protect your privacy online. Some cookies are creepier than others. Take a look at some common types of cookies: Session Cookies: These cookies are temporary and are stored only during a user's browsing session. They are deleted as soon as the session ends or the browser is closed. Session cookies help maintain user session information and enable essential website functionalities. Persistent Cookies: Unlike session cookies, persistent cookies remain on a user's device even after the browsing session ends. They have an expiration date set by the website, and they are used to remember user preferences and settings for future visits. First-party Cookies: First-party cookies are set by the website domain the user is visiting. They enable the website to remember information about the user, such as language preferences, shopping cart contents, or login credentials. First-party cookies are generally considered less invasive to privacy. Third-party Cookies: These cookies are set by domains other than the website the user is visiting. They are typically used for advertising, tracking user behavior across different websites, and delivering targeted ads. Third-party cookies can raise privacy concerns as they allow third-party entities to collect and track user information across multiple websites. Strictly Necessary Cookies: These cookies are essential for the functioning of a website. They enable basic features like page navigation, access to secure areas, and form submission. Strictly necessary cookies do not require user consent as they are necessary for the website to provide requested services. Analytical or Performance Cookies: Analytical cookies collect data about how users interact with a website, including pages visited, time spent, and error messages. The information gathered helps website owners understand and improve the performance and user experience. Advertising Cookies: Advertising cookies are used to track user behavior and interests to deliver targeted ads. They collect information about browsing habits, visited websites, and clicked ads. Advertisers use this data to personalise advertisements and measure their effectiveness. One cookie example you might be familiar with is the google analytics. Google has a specific cookie called "DV" that is used by Google to collect information about user behavior on websites that use Google services, such as Google Analytics. This is a bit creepy when you consider that so many websites (maybe up to 86% of them) use Google analytics! This means your behaviour across hundreds, thousands maybe millions of websites can be tracked all by Google (and then probably sold off to other companies)! If you're not already creeped out, check out this article by the Electronic Frontier Foundation .

So this is interesting! Did you know that personal information that can no longer be connected to a person is effectively "disposed of"? According to the New Zealand Privacy Act 2020, personal information can be considered disposed of if it is effectively de-identified. De-identification is a process that removes or modifies identifiable elements from personal information to ensure that the remaining data no longer relates to an identifiable individual. When personal information is de-identified, it means that the data has been altered or transformed in a way that makes it practically impossible to identify the individuals to whom it belongs. The Privacy Act recognises de-identified information as no longer falling under the scope of "personal information" because the risk of identifying individuals is significantly reduced. Isn't that cool? To ensure that personal information is properly de-identified, the Privacy Act provides guidance on key principles that need to be followed. These principles include: Irreversibility: The de-identification process should be irreversible. Once the personal information is de-identified, it should not be possible to re-identify individuals using the remaining data alone or in combination with other information. Reasonable means: De-identification should be carried out using reasonable means and methods appropriate to the nature of the personal information and the purpose for which it will be used. Reasonable likelihood of re-identification: The likelihood of re-identifying individuals from the de-identified information, considering the available or reasonably likely resources and techniques, should be low. By effectively de-identifying personal information, organisations can reduce the privacy risks associated with data handling. De-identified information can be used for research, statistical analysis, or other purposes without violating privacy laws, as long as the de-identification process is conducted in accordance with the principles outlined in the Privacy Act. Remember, if you are handling personal information and considering de-identification, it's important to refer to the specific provisions and guidance provided by the New Zealand Privacy Act and seek legal advice if needed to ensure compliance with the law. There is a spectrum of de-identification from pseudonymisation to anonymisation. Pseudonymisation is the process of replacing identifying information with a pseudonym or alias. For example, replacing someone's name with a unique ID number. Pseudonymisation can help protect personal information by making it more difficult to identify individuals. Replacing identifying information with pseudonyms may be considered de-identification *if* there is no longer any record of the original identity. In that way it would be similar to anonymisation, which is the process of removing all identifying information from data so that it cannot be linked back to an individual, even with additional information. For example, removing all identifying details from a medical study dataset. Anonymisation can help protect personal information while still allowing the data to be used for research or other purposes. 

Data mapping is one of those new buzzwords that's been rattling around the information community for a while now. At its most basic level, data mapping is figuring out where your information is and where it goes. In order to map your data, you'll have to take a close look at all the personal information that your organisation collects, processes, and stores. This might include things like customer names and addresses, employee contact details, financial information, and more. The idea is to create a comprehensive picture of how personal information flows through your organisation, from the moment it's collected to the moment it's deleted or destroyed. During the data mapping process, it might be useful to create a visual map or diagram that shows all the different systems, applications, and databases that handle personal information. You might also look at things like who has access to personal information, how long it's kept for, and what security measures are in place to protect it. Why is this important? Well, understanding how personal information is handled is essential for ensuring that it's being protected properly. It can also help identify any potential risks or vulnerabilities, such as systems that might be more prone to security breaches, or areas where personal information might be accidentally disclosed. Overall, data mapping is a valuable tool for any organisation that handles personal information. By taking the time to map out all the data you collect and process, you can better understand privacy risks and take steps to ensure that personal information is being handled in a responsible and secure way. We're experts at finding out where data is hiding in your organisation, but if you just need some quick guidance you can check out the guidance here at data.govt.nz .

Privacy breaches happen all the time to organisations all over the world. We've had some notable ones here in NZ which provide some good 'what not to do' examples, but chances are, your organisation will experience at least a few in its lifetime! They key thing is how you manage them. Before we jump into managing a breach, it's useful to explain the difference between an incident and a breach. A privacy incident refers to any situation where there is a potential unauthorised access, use, or disclosure of personal information. This might be an unsecured system or an HR file left on a copier. On the other hand, a privacy breach occurs when there is an actual unauthorised access, use, or disclosure of personal information. This can happen if a hacker breaks into a database, if an employee accidentally sends an email to the wrong person, or if a physical document goes missing. Basically, any time personal information is exposed in a way that wasn't supposed to happen, it's considered a privacy breach. This is a big deal because personal information is sensitive and can be used for things like identity theft. If you think there's been a privacy breach, it's important to take action right away to protect people's privacy. To determine if a privacy incident is a breach under the New Zealand Privacy Act, you should consider the following factors: Nature of the information: Personal information includes details like names, contact information, financial data, or any other data that identifies an individual. If the incident involves unauthorised access to this kind of information, it raises concerns for a potential breach. Unauthorised access or disclosure: A privacy breach occurs when there is an unauthorised access or disclosure of personal information. If someone gains access to or shares personal information without proper authorization, it could be considered a breach. Likelihood of harm: The Privacy Act considers the potential harm or adverse effects that could result from a privacy breach. If there is a risk of harm to individuals, such as identity theft, financial loss, or reputational damage, it strengthens the case for a breach. Steps taken to mitigate harm: If an organisation takes prompt action to minimise the impact of the incident and protect individuals affected by the privacy incident, it demonstrates commitment to handling the situation responsibly. Reporting obligations: Organisations are required by law to notify the Privacy Commissioner and affected individuals in the event of a privacy breach that could cause serious harm. Compliance with these reporting obligations is an important factor in determining if an incident qualifies as a breach. Breaches can be a really scary time for the victims of the breach and the people who (hopefully unwittingly) caused the breach. This can be magnified if the breach reaches the threshold of being notifiable under the Privacy Act. We can help figure out your threshold and identify whether you need to get the Privacy Commission involved. We're experts at dealing with breaches (we love a little drama in our lives!) and have a strong belief in a no-blame culture, unless the breach is caused by malicious activity of course. If you need some help figuring out whether you're dealing with an incident or a breach or maybe you just need a calming pat on the head, we're here to help! We also recommend checking out the OPC guidance on managing breaches .

The GDPR, or the General Data Protection Regulation, is a data protection law that was introduced in the European Union in 2018. It sets out strict rules for how organisations should collect, use, and protect personal information, and includes provisions for things like obtaining consent, data subject rights, and breach notifications. While GDPR is a European law, it can be relevant in a New Zealand context for a few reasons. First, if your organisation handles personal information from people in the EU, you may need to comply with GDPR regardless of where you're located. Second, GDPR has set a new standard for data protection globally, and many countries, including New Zealand, are taking inspiration from it as they develop their own privacy laws. Finally, even if you don't have any direct connection to the EU, complying with GDPR can be a good way to demonstrate to your customers or users that you take their privacy seriously, and that you're committed to protecting their personal information. We're experts in figuring out whether the GDPR applies to your organisation so if you're worried about it, get in touch with us!

Basically, personal information is any information that can be linked to a specific individual, whether directly or indirectly. Under the Privacy Act 2020 in New Zealand, personal information is defined as any information about an identifiable individual. This might sound straightforward but in practice it is a lot murkier. Personal information can include the obvious stuff like a person's name, address, phone number, email address, date of birth, financial information or medical history. But it also includes opinions or evaluative comments (like about their performance at work or why someone was or wasn't chosen to do something)a bout an individual, as well as any information that relates to an individual's race, ethnicity, religion, political views, sexual orientation, or other personal characteristics. You can see how this starts to get complicated. Because personal information can be so tricky to pin down, we can often fall into the trap of assuming that personal information only includes things like names and contact information. In reality, personal information can include a wide range of details, including opinions, preferences, and even some forms of anonymous data. Another thing to keep in mind is that just because information has been made public, doesn't remove the fact that it still counts as personal information. While some information may become less sensitive if it's been made public, it can still be considered personal information if it can be linked to an identifiable individual. This means organisations and businesses still need to think carefully before collecting, holding and sharing publicly available personal information. The other key thing to remember is that information that has been anonymised or pseudonymised, may still count as personal information. Overall, it's important to take a comprehensive and thoughtful approach to figuring out what is and isn't personal information. That's where pros like Wrybill come in!

Watch Caitlin talk about dating apps and privacy during Privacy Week

A privacy policy is a document that outlines an organisation's practices and procedures for handling personal information. It's basically a set of rules that tells people what information you're collecting from them, how you're using that information, who you're sharing it with (if anyone), and how you're protecting it. Privacy policies are really important because they help build trust between organisations and their customers or users. By being transparent about your data practices, you can show people that you take their privacy seriously and that you're committed to keeping their information safe. Plus, in many countries, having a privacy policy is required by law, so it's always a good idea to make sure you have one in place if you're collecting any kind of personal information from people. 

A Privacy Impact Assessment (PIA) is an evaluation of the potential impact that a new project, program, or policy may have on individuals' privacy. Essentially, it's a way to identify and address any privacy risks or concerns before they become a problem. By conducting a PIA, you can ensure that you're being transparent and accountable to the people whose data you're handling, while also avoiding costly data breaches or regulatory penalties. It's kind of like a check-up for your privacy practices, and just like with any other check-up, it's better to catch any potential issues early on rather than waiting until they become serious problems. So I know what they are now, how do I start? Define the scope: Start by identifying the specific project, system, or process that you will be assessing. This will help you to focus your efforts and ensure that you are addressing the right issues. Map data flows: Identify all of the personal information that will be collected, used, or shared as part of the project. This includes data that will be collected directly from individuals, as well as data that may be obtained from other sources. Identify privacy risks: Consider how the personal information that you have identified could be misused, disclosed, or otherwise compromised. Think about the potential impact on individuals and the organization. Evaluate privacy controls: Review the existing controls that are in place to protect personal information. This includes technical controls, administrative controls, and physical controls. Identify additional controls: Determine whether additional controls are needed to address the privacy risks that you have identified. This may include changes to processes, policies, or technology. Develop a mitigation plan: Create a plan to address any privacy risks that you have identified. This should include specific steps that will be taken to reduce the risk and protect personal information. Monitor and review: Once the project is implemented, continue to monitor and review its impact on privacy. This will help you to identify any new risks that may arise and ensure that your privacy controls remain effective. Obviously, we'd love to help you out with a PIA but if you're looking for general information, the Privacy Commissioner has a useful toolkit to get you started.