Office of the Privacy Commissioner | Harmful Digital Communications Act FAQs
Harmful Digital Communications Act FAQs
Background and overview
What is the Harmful Digital Communications Act?
Which sections of the Privacy Act does the HDCA amend?
Amendments to Principles 10 and 11
How does the HDCA amend privacy principle 10 of the Privacy Act?
How does the HDCA amend privacy principle 11 of the Privacy Act?
What do the changes to Principles 10 and 11 mean for the public?
Amendments to Section 56
How has section 56 of the Privacy Act been changed by the HDCA?
What does the section 56 amendment mean for the public?
Do the Privacy Act amendments only apply to digital communications?
Related issues
What does “highly offensive to an ordinary reasonable person” mean?
Aside from privacy, how else does the HDCA affect me?
What defines a Harmful Digital Communication?
How will the principles be enforced?
What is the approved agency’s role?
What other options do victims have under the HDCA?
Background and overview
What is the Harmful Digital Communications Act?
The Harmful Digital Communication Act (HDCA) aims to deter, prevent and mitigate harm caused to individuals by digital communications. Examples include cyber bullying, harassment and “revenge porn” (distribution of intimate videos and/or photographs without the subject’s consent).
In addition to introducing new communication principles, criminal offences and a standard takedown procedure for removing content on request, the HDCA amends the Harassment Act 1997, the Human Rights Act 1993, the Crimes Act 1961 and the Privacy Act 1993.
The HDCA is the result of recommendations from the Law Commission’s review of existing laws, which found that 1 in 10 New Zealanders had experienced a harmful digital communication at some stage. The Law Commission recognised that the definition of publicly available communication had shortcomings because advances in technology had made it easier to create and distribute digital communications.
Further, the Law Commission recognised the effect the same advancements had on the ability to collect information in a domestic affairs setting. The HDCA is a step towards addressing those shortcomings.
Which sections of the Privacy Act does the HDCA amend?
1) The “publicly available publication” exception in privacy principles 10 (a) and 11(b).
2) The domestic affairs exemption in section 56.
Amendments to principles 10 and 11
How does the HDCA amend privacy principle 10 of the Privacy Act?
Principle 10 specifies that agencies that obtain information for one purpose may not use it for another purpose.
One of the exceptions to privacy principle 10 is if information is collected from a public source. The HDCA has changed that exception by adding “and that, in the circumstances of the case, it would not be unfair or unreasonable to use the information.”
This means that the simple fact that information is publicly available no longer provides a complete exception to privacy principle 10. Using information that is public but would be unfair or unreasonable to use is now a breach of the privacy principle.
How does the HDCA amend privacy principle 11 of the Privacy Act?
Principle 11 limits agencies’ ability to disclose an individual’s information.
One of the exceptions to that is if that information was derived from a public source. Agencies could disclose publicly available information to anyone (for example, information published on a blog or in the newspaper).
The HDCA has put limits on this exception by adding “and that in the circumstances of the case, it would not be unfair or unreasonable to disclose the information.” This means that an agency can only disclose publicly available information if it is not unfair or unreasonable to do so.
What do the changes to Principles 10 and 11 mean for the public?
The HDCA amendments to the Privacy Act have placed new limits on distributing publicly available information. You can now be found liable for using or distributing information that was already in the public domain (if the use or disclosure has a harmful impact on the individual the information is about).
For example, assume sensitive medical details about you are inadvertently published on a doctor’s website. Under the amended privacy principle 10, anyone who uses that information could be found liable, even though the information has become publicly available.
Anyone who distributes that information (for example, by sharing a link to the post on social media) could be found liable for breaching privacy principle 11. Prior to the HDCA amendments, using and distributing the blog post would not have been a breach of the Privacy Act due to the “publicly available” exception.
Data breaches are another good example. Assume someone hacks into a government agency’s computer system, then posts a large amount of sensitive information (such as people behind on their child support payments, people who have voluntarily checked into mental health facilities or people who have had CYFs complaints) on an anonymous blog. Under privacy principle 10, anyone who uses that information would be in breach of the Act, because even though the information is public, it’s unfair and unreasonable to use it.
Further, anyone who shared a link to the blog would be in breach of privacy principle 11 because distributing the information would be both unfair and unreasonable.
Do the amendments to privacy principles 10 and 11 forbid me from using or distributing public information?
No. The amendments only apply to situations where it would be unfair or unreasonable to disclose or use public information. The amendments serve to set an outer limit to the way publicly available information can be used or distributed, but the threshold of “unfair or unreasonable” is deliberately quite high (in light of your right to freedom of expression). This is important because it means that the exception to each principle will still apply in most cases.
Amendment to Section 56
How has Section 56 of the Privacy Act been changed by the HDCA?
Section 56 of the Privacy Act specifically excludes domestic affairs from the scope of the Privacy Act. This means that people can not be held liable for collecting, distributing or using any information that relates to their family or household (even if harmful to another individual).
The HDCA amendment means this exclusion will no longer apply in circumstances where “collection, disclosure or use would be highly offensive to an ordinary reasonable person.”
What does the section 56 amendment mean for the public?
In most cases, the domestic affairs exemption in Section 56 will continue to apply as usual, and domestic affairs will not be covered under the Privacy Act. The new clause applies only to material that would be highly offensive to an ordinary reasonable person.
The best examples of this in action are “revenge porn” situations and use of CCTV, where personal information may be collected and/or distributed in a domestic context, but can be highly distressing or damaging for the subject of that information.
Do the Privacy Act amendments only apply to digital communications?
No. While the HDC Act’s title implies that it only relates to digital communications, the amendments to the Privacy Act are not limited to digital information. Practically speaking, though, the effect of the new provision may well arise in online scenarios– as digital communications and social media enable the kind of collection and disclosure that triggers the new “highly offensive” limitation on the domestic affairs exception.
What does “highly offensive to an ordinary reasonable person” mean?
The term can apply to a range of situations. The conventional test is whether a hypothetical reasonable person would be highly offended if they were put in the same position as the person whose privacy has been allegedly infringed.
The standard is equivalent to that used in the Broadcasting Standards Authority code of practice, and the test is also used by judges in privacy law cases.
Related issues
Aside from privacy, how else does the HDCA affect me?
Three other aspects of the HDCA come into effect immediately:
1) A new criminal offence, “causing harm by digital communication”. This is punishable by up to two years in prison or a maximum fine of up to $50,000 for individuals and $200,000 for companies.
2) A broadening of the “incitement to commit suicide” criminal offence. This offence now applies regardless of whether victims attempt to take their own lives. Offenders can serve up to three years in prison for this offence.
3) A “safe harbour” provision for content hosts. Hosting providers can now avoid liability by following a clear complaints process when you contact them about harmful material hosted on their systems. This means you can contact them in the first instance and resolve immediate problems quickly.
There are also new aspects that come into effect in 2017:
1) New communications principles to define your rights and responsibilities in a civil context. These principles are over and above the criminal offences spelled out in the HDCA, and will be managed by the District Courts and an approved agency.
2) An approved agency to handle disputes involving harmful digital communications. You will be able to call on this agency to help resolve issues involving harmful digital communications. This agency will be able to refer matters to the District Court if a resolution can’t be reached.
3) New District Court powers. District Courts will be able to order a range of remedies for civil cases involving harmful digital communications, such as takedown orders, cease and desist orders, name suppression orders and orders to publish corrections and apologies. The District Court will not be able to give fines or prison terms, but it will be able to fine individuals up to $5,000 or sentence them to 6 months in prison if they don’t comply with District Court orders.
What defines a Harmful Digital Communication?
The HDCA establishes a number of principles on top of the new criminal offences. These principles define harmful digital communications in a civil setting, and are in addition to the new criminal offences. These principles come into effect in 2017.
1) A digital communication should not disclose sensitive personal facts about an individual.
2) A digital communication should not be threatening, intimidating or menacing.
3) A digital communication should not be grossly offensive to a reasonable person in the position of the affected individual.
4) A digital communication should not be indecent or obscene.
5) A digital communication should not be used to harass an individual.
6) A digital communication should not make a false allegation.
7) A digital communication should not contain a matter that is published in breach of confidence.
8) A digital communication should not incite or encourage anyone to send a message to an individual for the purpose of causing harm to the individual.
9) A digital communication should not incite or encourage an individual to commit suicide.
10) A digital communication should not denigrate an individual by reason of his or her colour, race, ethnic or national origins, religion, gender, sexual orientation, or disability.
How will the principles be enforced?
The HDCA establishes a new approved agency that will investigate and attempt to resolve harmful digital communications. You will be able to contact this agency with any alleged breaches the principles. The agency is scheduled to take up this role by 2017.
What is the approved agency’s role?
The approved agency will investigate alleged breaches of the 10 principles and work with parties to find a resolution. In circumstances where the parties cannot agree on a resolution and/or there has been a clear breach of the HDC, the agency will refer cases to the District Court.
The approved agency has not yet been confirmed. It will be confirmed and resourced by the time the relevant portion of the HDCA comes into effect in 2017.
What other options do victims have under the HDCA?
1) Contact the organisation hosting the harmful content, who can avoid any liability by following a clear complaints process – which may involve removing the content within 48 hours.
2) Contact the Police if the communication is objectively harmful (such as intimate images posted without consent), is otherwise harassing or encourages suicide – sending these communications may be an offence.
3) Contact the Police if the communication threatens your safety. The Police can bring a HDCA case directly to the District Court if the communication is a direct threat to the safety of an individual, under Section 10 (1)(d) of the Harmful Digital Communications Act.
4) Contact the relevant school if a student is receiving harmful digital communications that breach the communication principles from another student.
The first two options are available immediately, while options 3 and 4 will be available by 2017.