Cybersecurity Policy Report, New Zealand Privacy Commissioner Offers Guidance on Data Anonymization, (Sep 17, 2024)
Agencies using data anonymization and de-identification techniques are accountable for protecting people’s privacy, said New Zealand Privacy Commissioner Michael Webster in a statement. The successful anonymization of information forecloses the risk of revealing the personal details of identifiable people, he noted. The statement followed inquiries by members of the public regarding the use of taxpayers’ personal information and hashing by the Inland Revenue Department (IRD).
New Zealand’s Privacy Act allows the disclosure of anonymized information if the disclosure does not risk revealing personal details about identifiable people, Mr. Webster explained. The privacy commissioner expects that information disclosed is successfully anonymized and that there is no likelihood of re-identification. The inadvertent release of personal information through re-identification has the potential to seriously harm individuals, he stressed.
Mr. Webster listed steps that could be taken to prevent re-identification, including ensuring a privacy impact assessment is completed for any significant project using people’s personal information; doing so will provide the agencies an understanding of the scope of how personal identification could be re-identified. Further, he suggested removing any information that could potentially be used to re-identify an individual and ensuring third-party service providers understand and comply with their privacy obligations.
News: InternationalLegislation DataPrivacy